NIST CSF 2.0 RS.CO-02: Notify Stakeholders of Incidents

RS.CO-02 says internal and external stakeholders are notified of incidents. When something goes wrong, the right people need to hear about it at the right time: leadership, affected customers, business partners, regulators and sometimes law enforcement. The outcome is met when you decide who to tell, when and how before the incident, and then follow that plan. CSF is voluntary, and there is no CSF certification to claim.

What good looks like

A notification matrix lists every audience, the trigger for telling them, the deadline, the owner and the channel. Contracts and legal duties are already mapped into it. Templates exist and have been reviewed by whoever handles legal matters. Management approves external notices, and each notice is logged with time and recipient.

How to implement it

• List your audiences: executive team, all staff, affected customers, partners, insurer, regulators, law enforcement and the press contact.
• Pull notification clauses from customer and supplier contracts and note each deadline. Some state hours, not days.
• Ask your legal adviser which breach notification laws apply to the places you operate and the data you hold. This guide cannot give you that answer.
• Define triggers by severity, such as confirmed exposure of customer data or loss of service for more than a set time.
• Draft templates for each audience in plain language: what happened, what it means for them, what you are doing, what they should do, who to contact.
• Assign an owner for each audience and a backup.
• Rehearse once a year with a tabletop that includes drafting and approving a customer notice.

A worked example

A 60 person company discovers that a misconfigured storage bucket exposed a customer report file for six days. The incident lead consults the notification matrix instead of debating who to call.

Internally, the executive team is told within the hour and all staff get a short holding message so they do not speculate. For customers, the matrix points to contracts. Two customers have clauses requiring notice within 72 hours of confirmed exposure, and the file contained data from one of them. The legal adviser confirms whether any breach law applies. The insurer is notified because the policy requires early notice.

The customer notice uses the approved template: what happened, which data, the period of exposure, what was done, what the customer should do, and a named contact. A senior leader approves it, the owner sends it, and the time and recipient are logged. A second notice follows when the investigation closes.

Timing and tone

• Tell people what you know and what you do not. Do not guess at scope.
• Do not promise outcomes you cannot verify.
• Send updates on a schedule you can keep.
• Keep one source of truth so staff and customers hear the same account.

Evidence to collect

• The notification matrix with a review date.
• The contract clause list with deadlines.
• Approved templates.
• Logs of notices sent in a real incident or exercise.
• Tabletop exercise notes.

Common gaps

Nobody knows who may speak for the company. Contract deadlines are discovered during the incident. Templates promise more than you can verify. Internal staff learn about it from customers. The insurer is told late and a claim is affected.

Quick check

Sources

• NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters