ADDITIONAL QUESTIONS
Do you have defined cybersecurity incident escalation criteria, notifications, activations, and/or courses of action?
If so, what actions would be taken at this point? By who?
Who would this incident be reported to?
Would any additional reports or notifications be made (e.g., to law enforcement for reasons related to public safety)? ○ Are points of contact identified?
Would leadership be notified?
Does the organization report cybersecurity incidents to outside organizations? If so, to whom?
What, if any, mandatory reporting requirements do you have?
Are these criteria the same across the organization?
Made with FlippingBook - Online catalogs