RES-02 · Resilience and Response
Breach notification within statutory time
Reportable incidents are assessed and notified to regulators and affected people within the applicable deadlines.
4frameworks fully address it
3partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2PartialCC7.5 Communication of incidents without statutory deadlines.
- ISO 27001PartialA.5.24 Reporting without statutory timing.
- NIST CSFFullRS.CO-02
- PCI DSSPartial12.10.1 Notification to brands and acquirers.
- HIPAAFull164.404
- GDPRFullArt. 33, 34
- EU AI ActFullArt. 73
- NIST AI RMFAbsent No notification obligation; the framework is voluntary guidance.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Assessment records, notification evidence, timing.
?Why it exists
The clock starts at awareness, not at certainty.
For a smaller organizationKnow your deadlines before you need them.