[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frs-co":3},{"item":4,"lessons":16,"controls":67,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rs-co","RS.CO-2","Incident Response Reporting and Communication",89,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This Respond category, called Communications in CSF 1.1, asks that response activities are coordinated with internal and external stakeholders as required by laws, regulations or policies. It covers notifying stakeholders and sharing information, including RS.CO-2 on reporting incidents consistent with established criteria.\n\n**In practice.** The incident plan defines who must be notified, by whom and within what time, including management, legal, regulators, customers, insurers and law enforcement. Pre approved templates and contact lists exist, and notifications are logged. Evidence includes communication plans, notification records and regulator correspondence.\n\n**Common gaps.** Organisations often discover regulatory reporting deadlines during an incident rather than before it. Contact lists are outdated and decision authority for external statements is unclear.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},88,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"international-operation-dismantles-west-african-scam-networks","International Operation Dismantles West African Scam Networks","2026-10-13T18:21:28.9+00:00",{"slug":24,"title":25,"published_at":26},"tfg-london-cyberattack-hits-multiple-retail-brands-across-shared-it-infrastructure","TFG London Cyberattack Hits Multiple Retail Brands Across Shared IT Infrastructure","2026-10-13T18:21:02.732+00:00",{"slug":28,"title":29,"published_at":30},"ransomware-negotiator-arrested-for-extortion-insider-threat-within-cybersecurity-industry","Ransomware Negotiator Arrested for Extortion: Insider Threat Within Cybersecurity Industry","2026-10-12T22:20:50.499+00:00",{"slug":32,"title":33,"published_at":34},"cybersecurity-executive-arrested-for-alleged-extortion-tied-to-shinyhunters-breach","Cybersecurity Executive Arrested for Alleged Extortion Tied to ShinyHunters Breach","2026-10-10T14:20:17.236+00:00",{"slug":36,"title":37,"published_at":38},"ransomware-recovery-firm-ceo-charged-with-defrauding-victims-while-secretly-paying-attackers","Ransomware Recovery Firm CEO Charged with Defrauding Victims While Secretly Paying Attackers","2026-10-09T20:20:24.799+00:00",{"slug":40,"title":41,"published_at":42},"ransomware-recovery-firm-ceo-indicted-for-secretly-paying-hackers-and-defrauding-clients","Ransomware 'Recovery' Firm CEO Indicted for Secretly Paying Hackers and Defrauding Clients","2026-10-08T20:20:23.319+00:00",{"slug":44,"title":45,"published_at":46},"ransomware-recovery-firm-charged-with-secretly-paying-ransoms-while-billing-victims-19m","Ransomware Recovery Firm Charged With Secretly Paying Ransoms While Billing Victims $19M+","2026-10-08T10:22:14.978+00:00",{"slug":48,"title":49,"published_at":50},"fraudulent-recovery-firm-exploited-ransomware-victims-for-11m","Fraudulent Recovery Firm Exploited Ransomware Victims for $11M","2026-10-08T10:20:22.998+00:00",{"slug":52,"title":53,"published_at":54},"ransomware-recovery-firm-defrauded-victims-by-secretly-paying-ransoms","Ransomware Recovery Firm Defrauded Victims by Secretly Paying Ransoms","2026-10-08T00:20:18.733+00:00",{"slug":56,"title":57,"published_at":58},"advantest-ransomware-attack-exposes-sensitive-personal-data-months-later","Advantest Ransomware Attack Exposes Sensitive Personal Data Months Later","2026-10-07T14:21:11.519+00:00",{"slug":60,"title":61,"published_at":62},"phishing-email-exposes-13m-records-in-arizona-court-breach","Phishing Email Exposes 1.3M Records in Arizona Court Breach","2026-10-07T02:20:25.376+00:00",{"slug":64,"title":65,"published_at":66},"automated-noise-overwhelms-googles-bug-bounty-program","Automated Noise Overwhelms Google's Bug Bounty Program","2026-10-05T16:21:27.854+00:00",[68,73,78,82,86,91],{"slug":69,"name":70,"problem":71,"stories":72},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",16,{"slug":74,"name":75,"problem":76,"stories":77},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",12,{"slug":79,"name":80,"problem":81,"stories":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":83,"name":84,"problem":85,"stories":77},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":87,"name":88,"problem":89,"stories":90},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",9,{"slug":92,"name":93,"problem":94,"stories":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",8,[97,103,108,114,120,125,130,135],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","17","Control 17","Incident Response Management",48,{"family":104,"item":105,"code":106,"title":106,"together":107},"itil","overview","ITIL",38,{"family":109,"item":110,"code":111,"title":112,"together":113},"gdpr","33","Article 33","Notification of a personal data breach to the supervisory authority",35,{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",32,{"family":98,"item":121,"code":122,"title":123,"together":124},"3","Control 3","Data Protection",30,{"family":109,"item":126,"code":127,"title":128,"together":129},"32","Article 32","Security of processing",29,{"family":98,"item":131,"code":132,"title":133,"together":134},"13","Control 13","Network Monitoring and Defense",25,{"family":5,"item":136,"code":137,"title":138,"together":139},"de-cm","DE.CM-1","Continuous Monitoring",23]