Kit · Compliance
Regulatory notification kit
The statutory clock starts at awareness, and it does not pause while you investigate. This kit gives the test, the timeline, and the content of each submission — so the decision to notify is made from a checklist rather than from instinct.
- Early warning
- 24 hours
- Notification
- 72 hours
- Final report
- 1 month
Start the clock before you are sure
The deadline runs from the moment the organisation became aware of a significant incident — not from confirmation, not from the end of the investigation. Waiting for certainty is the single most common way the 24-hour window is missed.
An early warning that later proves unnecessary costs you an email. A missed early warning costs you a finding on the record.
The significant-incident test, in operational language
Written so an analyst can apply it at 03:00. If any box is ticked, escalate to the SOC Officer for a notification decision immediately.
What each submission must contain
| Stage | Deadline | Content |
|---|---|---|
| Early warning | 24 hours from awareness | Whether the incident is suspected to be caused by unlawful or malicious acts, and whether it could have cross-border impact. Detail is not expected. |
| Incident notification | 72 hours from awareness | Updates the early warning; initial assessment of severity and impact; indicators of compromise where available. |
| Intermediate report | On request | Status updates, provided when the authority asks for them. |
| Final report | 1 month after notification | Detailed description; severity and impact; type of threat or root cause; mitigation applied and ongoing; cross-border impact where applicable. |
| Ongoing incident | If still open | A progress report at the one-month point, then the final report within one month of the incident being handled. |
Submission runbook
The mechanics. Settle every one of these before you need them, not during.
Rehearse it once a year
The first time someone attempts a statutory submission should not be during a live incident. Run a dry submission annually: the named submitter logs in, drafts from the template, and confirms the access still works. Access expires quietly.
Next kit
Monthly report & KPI kit
A complete report table of contents, the KPI catalogue with definitions and targets, and the production procedure that gets it out on time.