• A documented process governs communication during high-priority production incidents and outages, with internal legal and executive escalation required before any external disclosure.
• External notifications align with applicable state and federal legal requirements; regulatory and breach-notification obligations are governed by the incident response plan.
• The process defines timely initial notification, regular status updates through resolution, and a structured post-incident root-cause analysis.

Framework Alignment: NIST CSF RS.CO, RC.CO; CIS Control 17; SOC 1 Type II; GDPR Art. 33, 34; ISO 27001:2022 A.5.26, A.5.5