incident-reporting-navigator

• SKILL.mdcore · 7,442 bytes

## Overview

When a security incident becomes a breach, the clock starts: GDPR's 72-hour supervisory notification, NIS2's staged incident reporting, SEC cyber disclosure rules, and sector-specific duties all run concurrently with different triggers, thresholds, and recipients. Missing a deadline or notifying the wrong authority turns a bad incident into a regulatory event.

This skill is a defensive compliance guide: mapping which regimes apply, building the decision-to-notify workflow, and preparing the evidence and communications machinery before an incident. It is practical guidance, not legal advice — counsel owns the final call on every notification.

Build the notification capability before the incident: pre-drafted templates, a decision tree for each applicable regime, named decision-makers with deputies, and a legal-engagement trigger in the IR plan. At 2 AM with a suspected breach, you should be executing a plan, not designing one.

## When to use

- Mapping incident-notification obligations across jurisdictions and sectors.
- Building the breach-notification decision workflow into incident response.
- Preparing notification templates and evidence packages in advance.
- Training executives on their disclosure duties and personal liability.