Incident response and incident notification are two related but distinct processes that organizations should follow when dealing with security incidents. Incident response is the process of identifying, containing, analyzing, eradicating, and recovering from security incidents, while incident notification is the process of communicating the relevant information about the incident to the appropriate internal and external stakeholders, such as senior management, regulators, customers, and media12.

Not all security incidents are security breaches, which are defined as unauthorized access to or disclosure of sensitive or confidential information that could result in harm to the organization or individuals3. A security incident may become a security breach based on the analysis of the impact, scope, and severity of the incident, as well as the applicable legal and regulatory requirements. When a security breach is confirmed or suspected, the organization should trigger its incident notification or crisis communication process, which should include the following elements:

A clear definition of roles and responsibilities for notification and communication

A list of internal and external stakeholders who need to be notified and their contact information

A set of predefined templates and messages for different types of incidents and audiences

A communication strategy and timeline that aligns with the incident response plan and the business continuity plan

A feedback mechanism to monitor and measure the effectiveness of the communication and adjust as needed

Incident notification and communication are critical for managing the reputation, trust, and compliance of the organization, as well as for mitigating the potential legal, financial, and operational consequences of a security breach. References:

1: Incident Response Plan: Frameworks and Steps

2: A Guide to Incident Response Plans, Playbooks, and Policy

3: What is Incident Response? Plan and Steps

: Incident Response and Breach Notification

: Incident Response Communication: Best Practices

: The Importance of Incident Response Communication