Following a breach, what is the BEST source to determine the maximum amount of time before customers must be notified that their personal information…

Industry regulations and data protection laws (such as GDPR, CCPA, or HIPAA) are legally binding and explicitly define the maximum allowable timeframes for notifying affected individuals and regulatory authorities following a data breach involving personal information. These legal mandates are the ultimate authority and take precedence over internal policies or voluntary standards. An organization's incident response plan and security policies should be designed to ensure compliance with these external, legally enforceable requirements, but they are not the primary source of the obligation itself.

B. Industry standards: These are typically voluntary best practices or guidelines (e.g., ISO/IEC 27001, NIST frameworks) and are not legally enforceable unless explicitly required by a contract or regulation.

C. Incident response plan: This is an internal, operational document that outlines procedures. While it should incorporate legal notification timelines, the plan itself is not the source of the legal requirement.

D. Information security policy: This is a high-level internal document that sets the organization's security direction. It is subordinate to external laws and regulations, which are the definitive source for mandatory deadlines.

---

1. ISACA

CISA Review Manual

27th Edition. Domain 4: Information Systems Operations and Business Resilience

Section 4.3.3

Incident Management Tools and Techniques. The manual emphasizes that incident response procedures must incorporate and adhere to "legal and regulatory reporting requirements

" which often specify strict timelines for breach notification.

2. National Institute of Standards and Technology (NIST)

Special Publication 800-61 Rev. 2

"Computer Security Incident Handling Guide." Section 2.3.4

"Incident Response Team Structure

" discusses the need for legal advisors to be part of or available to the incident response team to ensure compliance with "applicable laws and regulations" regarding breach notification

which vary by jurisdiction.

3. General Data Protection Regulation (GDPR)

Article 33

"Notification of a personal data breach to the supervisory authority." This regulation legally mandates that data controllers notify the appropriate supervisory authority "without undue delay and

where feasible

not later than 72 hours after having become aware of it." This is a primary example of a regulation setting a maximum time limit.

4. Romanosky

S. (2016). "Examining the costs and causes of cyber incidents." Journal of Cybersecurity

2(2)

121–135. This academic paper analyzes data breach incidents and discusses how notification timelines are driven by a complex landscape of state and federal regulations

highlighting that legal statutes are the source of these obligations. DOI: https://doi.org/10.1093/cybsec/tyw001