<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-stakeholder-notification
description: >-
  Implement automated stakeholder notification with role-based routing, multi-channel delivery, regulatory compliance tracking, and audit trails.
domain: cybersecurity
subdomain: incident-management
tags:
  - notification
  - stakeholder-routing
  - regulatory-compliance
  - multi-channel
  - audit-trail
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  nist-csf: ["RS.CO-1", "RS.CO-2", "RS.CO-3"]
  frameworks: ["NIST SP 800-61", "GDPR Art. 33/34"]
---

# Performing Stakeholder Notification

## Overview

Notification failure during incidents causes secondary damage: regulatory fines for missed breach notification windows, executive surprise that erodes trust, and external disclosure before internal alignment. Automated routing with audit trails removes human error from time-critical notification chains.

Mode: `[MODE: INCIDENT]` — Notification is a compliance obligation, not just courtesy.

## Severity-Based Routing Matrix

| Severity | Immediate (T+0) | 15 min | 30 min | As Required |
|---|---|---|---|---|
| S1 (Critical) | IR Team, CISO, CTO, Legal | Exec team, PR | Board (if material), Regulators | Customers, partners |
| S2 (High) | IR Team, Security Lead | CISO, service owners | — | Affected business units |
| S3 (Medium) | IR Team, service owners | Security Lead (daily digest) | — | — |
| S4 (Low) | Assigned analyst | Security Lead (weekly digest) | — | — |

## Channel Selection

| Channel | Use Case | Severity | Notes |
|---|---|---|---|
| PagerDuty/OpsGenie | On-call escalation | S1, S2 | Requires acknowledgment — auto-escalates |
| Slack (#security-incidents) | Real-time coordination | S1–S3 | Post, don't assume read |
| Slack (#exec-security) | Executive awareness | S1 | Pin summary post |
| Email | Formal notifications, external, regulatory | All | Required for audit trail |
| SMS | Urgent executive contact | S1 only | CISO, CTO |
| Phone | Escalation failure | S1 | No PD ack within 10 min |

## Regulatory Notification Windows

| Regulation | Who to Notify | Deadline | Condition |
|---|---|---|---|
| GDPR Art. 33 | Supervisory Authority (DPA) | 72 hours of awareness | Breach affecting personal data |
| GDPR Art. 34 | Data subjects | Without undue delay | High risk to rights/freedoms |
| HIPAA Breach Rule | HHS + affected individuals | 60 days (>500: media too) | PHI breach |
| PCI DSS | Acquiring bank + card brands | Immediately upon discovery | Cardholder data compromise |
| SEC Rule 10b-5 | Board, then public (material) | 4 business days (material) | Material cybersecurity incident |
| State breach laws | AG + affected residents | Varies by state (30–90 days) | PII breach |

## Notification Audit Trail Fields

| Field | Description |
|---|---|
| `notification_id` | UUID per notification event |
| `incident_id` | Links to parent incident record |
| `recipient` | Name and role |
| `channel` | Delivery method used |
| `sent_at` | ISO-8601 timestamp |
| `delivered_at` | Confirmed delivery timestamp |
| `acknowledged_at` | Recipient acknowledgment timestamp |
| `regulatory_flag` | Boolean — triggers SLA compliance check |
| `content_hash` | SHA-256 of notification body for tamper evidence |

## Workflow

1. Incident severity determined by IC — triggers routing matrix lookup
2. Automated notification system sends to all T+0 recipients for that severity
3. Audit trail entry created for every send attempt
4. PagerDuty/OpsGenie escalation started for on-call roles
5. Communications Lead drafts stakeholder update for 15-min recipients
6. Regulatory flag checked — if personal data involved, DPO and Legal engaged
7. Regulatory notification filed within applicable window with audit record
8. All recipient acknowledgments tracked until complete

## Verification

- [ ] Routing rules documented for all severity levels
- [ ] Multi-channel delivery tested (send to yourself, verify receipt)
- [ ] Audit trail captures sent, delivered, acknowledged timestamps
- [ ] Regulatory windows configured with automated reminders
- [ ] Notification templates reviewed by Legal annually

## Related Techniques

- [Building War Room Procedures](../building-war-room-procedures/SKILL.md)
- [Performing Incident Severity Classification](../building-incident-severity-matrices/SKILL.md)
