What it asks for. This Respond category, called Communications in CSF 1.1, asks that response activities are coordinated with internal and external stakeholders as required by laws, regulations or policies. It covers notifying stakeholders and sharing information, including RS.CO-2 on reporting incidents consistent with established criteria.
In practice. The incident plan defines who must be notified, by whom and within what time, including management, legal, regulators, customers, insurers and law enforcement. Pre approved templates and contact lists exist, and notifications are logged. Evidence includes communication plans, notification records and regulator correspondence.
Common gaps. Organisations often discover regulatory reporting deadlines during an incident rather than before it. Contact lists are outdated and decision authority for external statements is unclear.