Disclosure and notification — the security incident's social contract

An incident becomes a disclosure problem the moment you know who was affected, and the deadlines are not yours to set: GDPR allows 72 hours from becoming aware of a personal-data breach, and contracts and sector regulators impose their own. Each audience needs a different message on a different channel — customers on the status page, regulators in writing, internal teams immediately — and the order matters, because a public statement that gets ahead of the customer notice becomes its own incident. What you are able to say is bounded by what you can evidence, which is why containment preserved the logs rather than wiping the host.

The disclosure

The disclosure is the cluster’s notification. The disclosure informs the customers, the regulators, and the public about a security incident.

flowchart TD
    A[Security incident] --> B[Disclosure]
    B --> C[Customer-facing]
    B --> D[Internal]
    B --> E[Regulatory]
    B --> F[Public]

The disclosure is the cluster’s notification.

The audience

The audience is the recipient of the disclosure. The audience depends on the incident:

• Customer-facing. The customers who are affected.
• Internal. The internal teams (security, legal, PR).
• Regulatory. The regulators (GDPR, HIPAA, PCI-DSS).
• Public. The public (CVE, blog post).

flowchart LR
    A[Audience] --> B[Customer]
    A --> C[Internal]
    A --> D[Regulatory]
    A --> E[Public]

The audience is the recipient.

The channel

The channel is the medium of the disclosure. The channel depends on the audience:

• Customer-facing. Email, status page, in-app notification.
• Internal. Slack, email, page.
• Regulatory. Official letter, regulatory portal.
• Public. Blog post, press release.

flowchart LR
    A[Channel] --> B[Email]
    A --> C[Status page]
    A --> D[Slack]
    A --> E[Blog post]

The channel is the medium.

The timing

The timing is the disclosure’s schedule. The timing depends on the audience:

• Customer-facing. As soon as the impact is known.
• Internal. As soon as the incident is detected.
• Regulatory. Within the regulatory deadline (e.g., GDPR requires 72 hours).
• Public. After the incident is contained.

flowchart TD
    A[Timing] --> B[Customer: ASAP]
    A --> C[Internal: ASAP]
    A --> D[Regulatory: per deadline]
    A --> E[Public: after containment]

The timing is the schedule.

The disclosure content

The disclosure content is the message. The disclosure content includes:

• What happened. The incident’s description.
• What was affected. The impact’s scope.
• What we did. The remediation.
• What we are doing. The follow-up.
• What you can do. The customer’s actions.

Subject: Security incident notification

We are writing to inform you of a security incident that
affected our service on [date].

What happened:
  [description]

What was affected:
  [scope]

What we did:
  [remediation]

What we are doing:
  [follow-up]

What you can do:
  [customer actions]

The disclosure content is the message.

The remediation

The remediation depends on the audience:

# Option 1: Send the customer-facing disclosure
# (notification-specific)

# Option 2: Send the internal notification
# (Slack, email)

# Option 3: Submit the regulatory notification
# (regulatory-specific)

# Option 4: Publish the public disclosure
# (blog post, press release)

The remediation is the disclosure.

Production discipline

A security incident disclosure is the cluster’s hypothesis. The discipline is to walk the 11-step methodology applied to the security layer, identify the audience, apply the remediation. The security is the cluster’s protection; the remediation is the disclosure.

• Fix the audience before the channel. Customers, internal teams, regulators, and the public each get a different message on a different medium.
• Work to the regulatory deadline, not the investigation’s pace. GDPR gives 72 hours from becoming aware of a personal-data breach; the public statement waits until the incident is contained.

Quiz