<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-stakeholder-notification
description: >-
  Implement automated stakeholder notification with role-based routing, multi-channel delivery, regulatory compliance tracking, and audit trails.
domain: cybersecurity
subdomain: incident-management
tags:
  - notification
  - stakeholder
  - routing
  - compliance
  - audit-trail
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.CO-2", "RS.CO-3"]
  frameworks: ["NIST SP 800-61", "GDPR"]
---

# Performing Stakeholder Notification

## Overview

Automated routing based on severity and incident type reduces notification
latency and ensures regulatory compliance. Multi-channel delivery reaches
stakeholders through preferred channels.

## Routing Matrix

```
S1: Immediate → IR Team, CISO, CTO, Legal | 15 min → Exec, PR | As needed → Board, Regulators
S2: Immediate → IR Team, Security Lead | 30 min → CISO, service owners
S3: 1 hr → IR Team, service owners | Daily digest → Security Lead
S4: 4 hr → Assigned analyst | Weekly digest → Security Lead
```

## Multi-Channel Delivery

```yaml
channels:
  page: [pagerduty, opsgenie] — S1, S2
  slack: security-incidents (S1-S3), exec-security (S1)
  email: formal notifications, external, regulatory
  sms: S1 only — CISO and CTO
  phone: S1 escalation failure (no ack in 10 min)
```

## Audit Trail

```
Every notification records: notification_id, incident_id, recipient,
channel, sent_at, delivered_at, acknowledged_at, regulatory_flag
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Routing rules cover all severity levels
- [ ] Multi-channel delivery tested
- [ ] Audit trail captures all sends
- [ ] Regulatory deadlines tracked
