Skip to main content
← All controls
IR-6 / A.5.24 / A.5.26 / CIS-17.9 NIST SP 800-53 Rev 5

Do you know which regulators require notification, the timelines (e.g. 72 hours), and have a written escalation for that?

Demonstrate that the organization has identified all applicable breach notification requirements, documented mandatory timelines with sufficient specificity to operationalize them, and established a written escalation procedure that enables timely regulatory notification.

Description

What this control does

This control ensures the organization maintains a current, documented registry of all regulatory and contractual breach notification obligations, including specific timeframes (e.g., GDPR's 72-hour requirement, HIPAA's 60-day timeline, state breach laws' varying windows), and has established written escalation procedures to meet those deadlines. The registry must map applicable regulators to data types, geographic jurisdictions, and business units, with clear escalation paths from detection through legal review to regulator notification. This is foundational for incident response compliance, preventing missed notification deadlines that trigger compounding regulatory penalties and reputational harm.

Control objective

What auditing this proves

Demonstrate that the organization has identified all applicable breach notification requirements, documented mandatory timelines with sufficient specificity to operationalize them, and established a written escalation procedure that enables timely regulatory notification.

Associated risks

Risks this control addresses

  • Missed regulatory notification deadlines resulting in statutory penalties, compounding fines, and loss of safe harbor provisions under breach notification laws
  • Incomplete regulator identification leading to unreported breaches in jurisdictions where the organization processes personal data or operates critical infrastructure
  • Ad-hoc escalation during active incidents causing delays in legal review, executive approval, and regulator contact, exceeding mandatory windows
  • Inconsistent application of notification requirements across business units processing data under different regulatory regimes (GDPR, CCPA, HIPAA, PCI-DSS, sector-specific laws)
  • Failure to account for cascading notification obligations when a single incident triggers multiple regulatory frameworks with different clocks and recipient authorities
  • Lack of documented thresholds or triggers causing confusion about when escalation begins, delaying the notification clock start and compressing response time
  • Absence of pre-established regulator contact information and submission procedures forcing incident responders to research during time-critical windows

Testing procedure

How an auditor verifies this control

  1. Request the organization's breach notification regulatory registry or matrix documenting all applicable notification requirements.
  2. Verify the registry includes regulatory authority names, specific notification timelines (hours/days from discovery or occurrence), triggering thresholds, and geographic or sectoral applicability for each entry.
  3. Cross-reference the registry against the organization's data inventory, customer locations, and business operations to identify gaps in regulatory coverage (e.g., missing GDPR for EU customer data, omitted state laws for U.S. operations).
  4. Obtain the written breach escalation procedure and confirm it explicitly references the regulatory registry and assigns responsibility for timeline tracking.
  5. Trace the escalation workflow from initial detection through security triage, legal counsel involvement, executive notification, and regulator contact, validating defined roles and maximum elapsed time at each stage.
  6. Select three sample breach scenarios (e.g., ransomware affecting PII, healthcare data exfiltration, payment card compromise) and walk through the procedure with incident response personnel to verify they can identify applicable regulators and timelines.
  7. Review evidence of procedure testing or tabletop exercises within the past 12 months that specifically validated notification timeline adherence and escalation effectiveness.
  8. Confirm the registry includes documented contacts (email, phone, portal URLs) for each regulatory authority and was reviewed/updated within the past 12 months to reflect regulatory changes.
Evidence required Auditor collects the breach notification regulatory registry (spreadsheet, database export, or policy appendix) showing regulators, timelines, and applicability criteria; the written incident escalation procedure with notification workflow and role assignments; dated tabletop exercise reports or test results demonstrating timeline validation; and change control or review records showing the registry was updated within the audit period to reflect new or amended regulations.
Pass criteria The control passes if the organization maintains a documented registry identifying all applicable breach notification regulators with specific timelines, the registry reflects current regulatory obligations for all jurisdictions and data types in scope, and a written escalation procedure explicitly incorporates the registry and assigns clear accountability for meeting notification deadlines.