Tell the Regulator, the Agency, the Contracting Officer

Before the detail — Artifact: the incident record’s comms-log section, accepted only when every external-notification row names timestamp, audience, recipient, trigger family, rule source, signer, sent-artifact reference, and next-update time. Status of what follows: binding where the cited regime applies; the drafting-versus-signing split is house practice everywhere.

Prompt first: draft the initial notification, not the final one

Here is what we know at the deadline for this notification [paste:
detection time, the trigger family and instant that started this
clock, what has been confirmed, what has not].

Draft the INITIAL notification using the named regime's required
field set. For FedRAMP RFC-0031 as adopted, include detection time
and reportability-evaluation completion time; attack vector,
indicators, CVE, and root cause are ongoing-report fields when known.
For NERC CIP-008, the initial fields are functional impact, attack
vector, and intrusion level achieved or attempted.

Mark any required fact not supplied MISSING. Do not invent it. Mark
the signer field NEEDS-SIGNATURE - drafting is not signing.

Prompt and incomplete beats late and complete

FedRAMP’s proposed rule states the ordering directly: prioritize prompt notification with potentially incomplete information above delayed reporting with complete information. An initial report needs only two things: the detection time and the moment the evaluation of what to report was completed. An ongoing report adds what the initial one could not have: the attack vector, indicators of compromise, and — only once it exists — root cause.

That split matters because the earlier lesson on trigger families already established that root cause is not a required element of the federal major-incident report to Congress at all. A team that delays its initial notification to firm up a cause it does not owe anyone yet is trading a missed clock for information nobody asked for at that stage.

Three attributes, one signature

The electric-grid reliability standard’s cyber-incident-reporting requirement (NERC CIP-008) names three attributes an initial notification must carry at a minimum, to the extent known: functional impact, attack vector, and the level of intrusion achieved or attempted. Under R4.3, provide updates, if any, within seven calendar days of determining new or changed R4.1 attribute information; the clock does not restart for every unrelated new fact.

If the M-17-12 (the federal government’s 2017 policy on agency breach response, still in force) flow-down clause — which binds a subcontractor that never signed with the government — is in the contract, it requires Meridian to maintain the capability to construct a timeline of user activity and to identify the initial attack vector — content aimed at a different reader than NERC’s: the covered agency reading it needs to reconstruct what happened to a system it does not operate, not to score an impact level against a standard.

Neither of those obligations says who signs. The clock desk drafts and the risk acceptor signs external notifications as house practice: the clock desk — the named role introduced in the previous lessons, never the responder who is mitigating — drafts every notification against the applicable template and rule citation. An unsigned draft does not discharge the duty; if the deadline passes before transmission, the notice is late. The role split supports accuracy but never pauses the clock.

The comms log is evidence

Every notification sent, to every audience, belongs in the record’s section 7 comms log — the same document that already holds the timeline and the determination entries, not a separate file assembled after the fact. Its header line: | timestamp (UTC) | audience | recipient | trigger_family | rule_source | signer | sent_artifact | next_update_at |. The validator’s rule: an EXTERNAL NOTIFICATION row — audience of regulator, agency, or contracting officer — must have every column filled, with rule_source resolving in sources.json or naming a clock id from clocks.json; internal and customer rows may leave rule_source as none. A filled row supports evidence for IR-6 (the control family row for reporting security incidents) the same way the record’s other sections already do for incident handling and planning.

4.3’s rule: every update names the next applies here with one addition — a regulator-facing entry also names the rule it answers to, so a reviewer can check the log against 4.2’s obligation profile.

The commercial starting practice is a status page: one message, published once, to whoever is subscribed. The federal delta is a notification addressed to a specific, named recipient — an agency contact, the electricity-sector information-sharing center, the Department of Energy, a state utility commission — none of whom subscribed to anything and all of whom are owed a signed act, not a broadcast. The handoff artifact is the reporting-clock table with a recipient column, cited from the comms log entry that answered it. What is not equivalent: these recipients are owed a directed notification, not a broadcast; Meridian’s signature rule is house practice, not a modality supplied by every cited regime, and a comms log that cannot tell a public post from a directed notice is not evidence of either one.

Stop and escalate when a notification’s deadline is approaching and the confirmed facts do not yet fill the required fields — send the initial report with what is known and what is explicitly unknown, rather than holding it for completeness the rule does not require. The clock desk escalates to the risk acceptor for the signature, not for permission to wait.

Practice status — among organizations issuing regulator or agency notifications under a signed incident record, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

A notification that is prompt and incomplete meets its clock; one held for completeness the rule never required does not. The content a regime demands — an electric-grid standard’s three attributes, a federal contract clause’s timeline of user activity — differs by recipient, but the drafting-and-signing split holds everywhere: the clock desk drafts, the risk acceptor signs. The comms log that captures every notification, gated to its audience and traceable to its rule, is the evidence this module leaves behind. Module 5 turns from sending the notice to learning from the incident it described.

LEADERSHIP DECISION   name a signer for every external notification,
                      distinct from whoever drafts or mitigates
PRACTITIONER ACTION   send the initial report on time with explicit
                      gaps marked, add required attributes in the
                      update, and log every notification against
                      its rule and recipient
SUCCESS MEASURE       zero notifications held past their clock for
                      completeness the rule did not require - an
                      audit finding avoided at the next review