unified
UC-IR-08 — Notify authorities and affected parties within deadlines
Maintain a notification matrix of internal stakeholders, regulators, and other external parties with triggers, deadlines, content requirements, and approved communication owners. Require personnel to report suspected incidents to the response capability within defined timeframes, notify authorities and other required external bodies within their statutory windows, and share incident information with designated internal and external stakeholders as the communications plan directs. Notify affected individuals when thresholds are met — for high-risk personal-data breaches, communicate without undue delay in clear and plain language with mitigation advice; for regulated categories of data, notify individuals, media, and regulators within the mandated statutory windows when applicable thresholds are reached, honoring notification duties owed to partner organizations. Retain evidence of every notification's timing, audience, and content.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Incident Management & Response
- type
- corrective
- category
- administrative
Details
- unified_id
- UC-IR-08
- title
- Notify authorities and affected parties within deadlines
- statement
- Maintain a notification matrix of internal stakeholders, regulators, and other external parties with triggers, deadlines, content requirements, and approved communication owners. Require personnel to report suspected incidents to the response capability within defined timeframes, notify authorities and other required external bodies within their statutory windows, and share incident information with designated internal and external stakeholders as the communications plan directs. Notify affected individuals when thresholds are met — for high-risk personal-data breaches, communicate without undue delay in clear and plain language with mitigation advice; for regulated categories of data, notify individuals, media, and regulators within the mandated statutory windows when applicable thresholds are reached, honoring notification duties owed to partner organizations. Retain evidence of every notification's timing, audience, and content.
- domain
- Incident Management & Response
- control_type
- corrective
- control_category
- administrative
- members
- framework
- nist-800-53
- control_id
- IR-6
- coverage
- full
- relationship
- superset_of
- framework
- nist-csf-2
- control_id
- RS.CO-02
- coverage
- full
- relationship
- superset_of
- framework
- nist-csf-2
- control_id
- RS.CO-03
- coverage
- full
- relationship
- superset_of
- framework
- gdpr
- control_id
- GDPR-Art34
- coverage
- full
- relationship
- superset_of
- framework
- hipaa
- control_id
- HIPAA-164.400-414
- coverage
- partial
- delta
- individual notice within 60 days; media notice at 500+ residents of a state/jurisdiction; HHS notice at 500+ individuals (contemporaneous); HHS notification required for all breaches (sub-500 via annual log)
- relationship
- intersects_with
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-IR-08 — Notify authorities and affected parties within deadlines maps_to RS.CO-02 — Incident Response Reporting and Communication: Internal and external stakeholders are notified of incidents
- framework
- nist-csf-2
- control_id
- RS.CO-02
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2.0
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-IR-08 — Notify authorities and affected parties within deadlines maps_to GDPR-Art34 — Communication of a breach to the data subject
- framework
- gdpr
- control_id
- GDPR-Art34
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Regulation (EU) 2016/679
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- Privacy Breach Assessment & Notification operates UC-IR-08 — Notify authorities and affected parties within deadlines
- UC-IR-08 — Notify authorities and affected parties within deadlines mitigates Failure to detect, assess, and notify breaches on time
- strength
- primary
- rationale
- The notification matrix, statutory-window notifications to regulators/individuals, and retained evidence directly defend against late or incomplete breach notification (GDPR/HIPAA).
- UC-IR-08 — Notify authorities and affected parties within deadlines maps_to IR-6 — Incident Reporting
- framework
- nist-800-53
- control_id
- IR-6
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- Incident Management Lifecycle operates UC-IR-08 — Notify authorities and affected parties within deadlines
- UC-IR-08 — Notify authorities and affected parties within deadlines maps_to HIPAA-164.400-414 — Breach notification to individuals, media, and HHS (incl. business-associate duties)
- framework
- hipaa
- control_id
- HIPAA-164.400-414
- coverage
- partial
- delta
- individual notice within 60 days; media notice at 500+ residents of a state/jurisdiction; HHS notice at 500+ individuals (contemporaneous); HHS notification required for all breaches (sub-500 via annual log)
- relationship
- intersects_with
- source_version
- 45 CFR Parts 160/164 (Security, Privacy, Breach Notification)
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-IR-08 — Notify authorities and affected parties within deadlines maps_to RS.CO-03 — Incident Response Reporting and Communication: Information is shared with designated internal and external stakeholders
- framework
- nist-csf-2
- control_id
- RS.CO-03
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2.0
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.