Incident notice
What to write for how soon you tell the customer about an incident
The row asks how soon the customer hears when something goes wrong with their data. If you do not have a number of hours you can keep, say so. Then say who tells them, and when.
This is a practical note for a security review, not legal advice.
What the row is asking
The row asks how soon you tell this customer that something has gone wrong with their data. Reviewers call it a breach notification timeline, a breach notification SLA, or how fast they hear from you. The words differ. The question is the same.
A SOC 2 report does not answer it. The report can describe a control. It does not say how soon this customer hears, or who sends the note.
This is a different clock from the email that says you added or replaced a vendor. That note has its own period, usually in the agreement. Do not paste that period here.
A penetration test is a different row. A test date does not say how soon you would tell the customer about an incident.
How long you keep customer data is a different clock again. A retention sentence does not say when the customer hears about an incident.
What reviewers accept
They accept a plain description of what you actually do. Name who sends the note, what you tell them, and when the clock starts. Start it when you confirm their data is affected, unless the agreement you signed says a different start.
A number of hours is welcome when you already keep it. Write the number you have used, or the number in the agreement you signed. A sample from someone else's page is not your number.
No number is a complete answer when you have not committed to one. Say that you tell the customer after you confirm their data is affected, and that you have not set a number of hours.
If the agreement already names a period, quote that period and say you follow the clause. Do not add a shorter promise on the form. If you are unsure what the clause requires, ask a lawyer.
If you have not had an incident, say that. Then say what you would do. An incident you have not had is not a history you can describe.
An honest line does not force the deal through. The answer that fails is a clock you cannot keep when they ask who sent the note and when it went out.
Answers you can paste
Use the line that is true. Replace the brackets. Delete anything that is not true.
You already keep a clock
We tell the customer within [number of hours, or number of days] after we confirm an incident that affects their data. [Name or role] sends the note. It says what happened, which of their data was affected, and what we are doing. We do not start that clock until we have confirmed their data is affected.
The agreement already names the period
Our agreement says we notify you within [the period written in the agreement] after we confirm an incident that affects your data. We follow that clause. We are not adding a shorter promise on this form.
No number of hours yet
We tell the customer when we confirm an incident that affects their data. [Name or role] sends the note. It says what happened, which of their data was affected, and what we are doing. We have not committed to a number of hours. We will not write one until we can keep it.
No incident yet
We have not had an incident that affected customer data. If we confirm one, [name or role] will tell the customer what happened, which of their data was affected, and what we are doing. We have not set a number of hours.
What not to write
Do not write a number of hours you have not kept and cannot keep. A hope is not a clock.
Do not paste 72 hours or 48 hours because a template or a sample answer used that number. Use a number only when your agreement states it, or you already tell customers on that clock.
Do not invent an SLA on the form. This note does not write one. A number you have not agreed, and do not already keep, is not a commitment you can stand behind.
Do not copy the period from the email that says a vendor was added. Adding a company is a different notice.
Do not tick yes for a documented incident process that lives only in someone's head. If the steps are not written down where the person on call can follow them, say they are not written down.
Do not answer with a SOC 2 report, a penetration-test date, or a mean time you do not measure.
Do not describe an incident you have not had as if it happened.
Where this answer lives
Keep the sentence in the questionnaire answer you control. The vendor list is a different page. It names the companies that handle customer data.
Trust Prep does not store a number of hours, does not fill this row, and does not email anyone.
A company, a location, or an agreement link shows on the public page only after you save it. A number of hours does not, because there is no field for it.
If you want the longer notes
The overview line about what you do when something goes wrong is in the security questionnaire guide.
The email that says you added or replaced a vendor is a different clock. What to put in that note is in the subprocessor change notice.
A penetration test does not answer how soon the customer hears. What to write on that row is in the penetration test guide.
How long you keep customer data, the other clock in the agreement, is in the data retention guide.
Who can still open customer data, and whether that access is gone when someone leaves, is a different row. What to write is in the access review guide.
A log of who did what is a different record from how soon you tell the customer about an incident. What to write is in the audit log guide.
What the agent is allowed to do is a different row from how soon you tell the customer about an incident. What to write is in the agent permissions guide.
Where someone sends a vulnerability report is a different row from how soon you tell the customer about an incident. What to write is in the vulnerability reporting guide.
Related guides
Optional next step: a living page
The sentences above are enough for the row in front of you.
If you want one link for the companies that handle customer data, Trust Prep publishes that vendor list as a page you edit when a company changes. The row can name the company, what it does, the location, the agreement link, and the date you last checked it. Reviewers open a public link made from your company name, without an account. They can copy the table or download the spreadsheet there. You can fill in the list and preview the page before you pay to publish the link. Publishing turns on after we confirm your payment.
The page does not store a number of hours. That sentence stays in the answer you keep.