Timing

Once a decision to notify has been made, the notification should be sent in the most expedient time possible, but without compounding the harm from the initial incident through premature announcement based on incomplete facts or in a manner likely to make identity theft or fraud more likely to occur as a result of the announcement.

Since various jurisdictions have legal requirements regarding timing, care should be taken that each affected party is notified within the time limits of their local jurisdiction. Jurisdictional timing and other notification requirements should be included in the incident response plan for quick reference.