← NIST CSF 2.0 · RESPOND — Incident Response Reporting

RS.CO-02 — Internal and external stakeholders are notified

high breach-notificationincident-response

Requirement

Internal and external stakeholders are notified of incidents in accordance with the organisation's reporting criteria.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

notifynotificationinformcommunicate

Required element 2 — any one of

customerregulatorstakeholderaffectedauthority

Supporting terms — specificity signals

72 hourslatemplatestatus pagelegal reviewspokesperson

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no notification process

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.33	Notification of a breach to the supervisory authority	breach-notification incident-response
SOC 2	CC7.4	Incident response programme	incident-response breach-notification
PCI DSS 4.0.1	12.10	Incident response plan for suspected compromise of account data	incident-response breach-notification
HIPAA	164.308(a)(6)(ii)	Response and reporting (R)	incident-response breach-notification
HIPAA	164.404-410	Breach notification to individuals, HHS and the media	breach-notification incident-response
NDPA 2023	s.40	Personal data breaches: notification and breach records	breach-notification incident-response
GDPR	Art.34	Communication of a breach to data subjects	breach-notification
SOC 2	CC7.3	Evaluation of security events	incident-response