Incident Response
Customer, regulator, law-enforcement, data-subject, contractual, vendor, and privacy notification obligations are evaluated, approved, executed where required, and retained.
Use this guide to put the control into operation, decide what records to retain, and check that an auditor can trace the evidence back to the work your team performed.
Maintained by GreenHat Security · Reviewed August 21, 2026
Potential notification obligations are evaluated with appropriate legal, privacy, contractual, customer, and operational input, and every decision and communication is approved, consistent, and traceable.
First SOC 2 program
Maintain current legal and privacy contacts, centralize customer security commitments, use a notification decision checklist, and prevent unapproved incident statements from being sent by engineering or support.
As the company scales
Connect incident facts to jurisdiction, contract, customer, insurer, regulator, law-enforcement, and data-subject decision paths with tracked deadlines, approval workflow, audience reconciliation, and communication records.
Name primary and backup incident, legal, privacy, executive, customer, communications, and insurance contacts and define who may approve each type of notice.
You should end up with: Notification role and approval matrix
Record what happened, dates, systems, data and customers potentially affected, current certainty, containment status, geography, and known contractual commitments.
You should end up with: Versioned incident fact summary
Route the facts to qualified reviewers who can assess applicable customer, contractual, privacy, regulatory, insurance, vendor, or law-enforcement considerations.
You should end up with: Tracked obligation assessment with advice references
For every relevant audience, preserve the decision-maker, rationale, approval, target timing, dependencies, and changes as facts develop.
You should end up with: Notification decision log
Use controlled drafts, confirm recipient lists and facts, coordinate customer and public channels, and record who approved the final message.
You should end up with: Approved notice and reconciled recipient list
Keep sent content, timestamps, delivery evidence, responses, supplemental updates, and any corrective actions arising from the communication process.
You should end up with: Complete communication and follow-up record
Build the evidence set in three layers: what defines the control, who approved or reviewed it, and what proves it operated. Collect operating records when the work happens so they remain dated, attributable, correctly scoped, and traceable to the underlying activity.
Before sharing, remove unrelated personal or customer data, never expose passwords, tokens, or secret values, preserve enough source context to authenticate the record, and use the secure exchange approved for the engagement.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
Confirm what the record proves
Each relevant audience has an attributable, dated notify or do-not-notify decision based on the facts then known, with changes preserved as the incident develops.
Include this context
Incident and audience
Include this context
Decision
Include this context
Decision-maker and time
Include this context
Facts considered
Include this context
Rationale
Include this context
Target timing or next review
Weak evidence to avoid
A final yes or no in meeting notes without the audience, decision-maker, facts, rationale, timestamp, or changed decisions.
Confirm what the record proves
Qualified legal or privacy reviewers received a defined fact set and their advice or decision reference informed the notification path.
Include this context
Incident and referral time
Include this context
Reviewer
Include this context
Fact-summary version
Include this context
Questions or considerations
Include this context
Advice or decision reference
Include this context
Follow-up
Weak evidence to avoid
An email saying legal was consulted without reviewer identity, fact version, timing, question asked, or recorded outcome.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
Confirm what the record proves
The exact communication sent to a defined audience matches approved facts, wording, timing, and authorization.
Include this context
Incident and audience
Include this context
Notice version
Include this context
Approver and approval time
Include this context
Approved content
Include this context
Planned send time
Include this context
Recipient basis
Weak evidence to avoid
An editable draft with no version, audience, approver, approval time, recipient basis, or proof that it was the sent text.
Confirm what the record proves
Approved customer notices and updates were sent to the intended recipients, at recorded times, with delivery, responses, and follow-up preserved.
Include this context
Incident and notice version
Include this context
Recipient population
Include this context
Send time and channel
Include this context
Delivery result
Include this context
Sender
Include this context
Follow-up or corrections
Weak evidence to avoid
A statement that customers were informed without the recipient population, exact approved message, send time, channel, or delivery record.
Type 1
The current notification decision workflow, role and approval matrix, customer and contractual commitment sources, controlled communication process, and latest decision or exercise record showing the process is usable at the review date.
Type 2
Every declared incident and privacy, security, service, or customer-impact event that met the documented trigger for notification evaluation during the review period, including notify, do-not-notify, deferred-pending-facts, supplemental, and corrected decisions; plus every notification-decision tabletop or exercise due under the period-effective schedule, at least annually, including due, completed, cancelled, missed, and rescheduled occurrences. Preserve the original scheduled occurrence when an exercise moves and link it to the replacement date and final result. If no event met the trigger, retain full-period incident and referral exports, the evaluation applied to that population, and an attributable management confirmation.
Reconcile every declared incident plus privacy, support, and service-impact referral to the notification-trigger evaluation and decision log, then reconcile approved notices to recipient and delivery records. Separately reconcile every exercise due on the period-effective calendar to its results, participants, decisions, findings, and corrective actions, retaining cancelled, missed, and rescheduled occurrences and linking each original date to any replacement. For a zero-trigger period, preserve the full-period source exports, documented evaluation, covered dates, and management confirmation; a zero-trigger period does not remove the scheduled exercise population.
Use this checklist to prepare for procedures an auditor may perform. The exact steps and sample selection depend on your engagement scope and the service auditor's professional judgment.
Determine whether the control is designed to achieve this result: Potential notification obligations are evaluated with appropriate legal, privacy, contractual, customer, and operational input, and every decision and communication is approved, consistent, and traceable.
Compare the documented owner with the intended role (CISO / Incident Commander / Privacy-Legal Owner), then compare dated records with the stated cadence: Per event/incident; tabletop at least annually.
Reconcile every declared incident plus privacy, support, and service-impact referral to the notification-trigger evaluation and decision log, then reconcile approved notices to recipient and delivery records. Separately reconcile every exercise due on the period-effective calendar to its results, participants, decisions, findings, and corrective actions, retaining cancelled, missed, and rescheduled occurrences and linking each original date to any replacement. For a zero-trigger period, preserve the full-period source exports, documented evaluation, covered dates, and management confirmation; a zero-trigger period does not remove the scheduled exercise population.
The current notification decision workflow, role and approval matrix, customer and contractual commitment sources, controlled communication process, and latest decision or exercise record showing the process is usable at the review date.
Every declared incident and privacy, security, service, or customer-impact event that met the documented trigger for notification evaluation during the review period, including notify, do-not-notify, deferred-pending-facts, supplemental, and corrected decisions; plus every notification-decision tabletop or exercise due under the period-effective schedule, at least annually, including due, completed, cancelled, missed, and rescheduled occurrences. Preserve the original scheduled occurrence when an exercise moves and link it to the replacement date and final result. If no event met the trigger, retain full-period incident and referral exports, the evaluation applied to that population, and an attributable management confirmation.
Records showing that an accountable person reviewed, approved, challenged, or accepted the work.
For each selected record, confirm it demonstrates Each relevant audience has an attributable, dated notify or do-not-notify decision based on the facts then known, with changes preserved as the incident develops.
For each selected record, confirm it demonstrates Qualified legal or privacy reviewers received a defined fact set and their advice or decision reference informed the notification path.
Dated proof that the control actually ran, such as tickets, logs, settings, exports, reports, and test results.
For each selected record, confirm it demonstrates The exact communication sent to a defined audience matches approved facts, wording, timing, and authorization.
For each selected record, confirm it demonstrates Approved customer notices and updates were sent to the intended recipients, at recorded times, with delivery, responses, and follow-up preserved.
Use the categories that apply to this control: connect any policy or design artifact to its approval or review record, then trace a selected operating record through execution, result, and any exception or remediation.
These identifiers help you navigate related Trust Services Criteria. They do not reproduce the criteria or prove that this control fully addresses them in your environment.
Confirm final scope, mappings, and testing expectations with your service auditor. SOC 2® is an AICPA trademark; GreenHat Security is not affiliated with or endorsed by AICPA.