The organization must establish responsibilities and procedures for identifying and recording breaches of personal data and for notifying required parties, including timing, and for disclosure to authorities under applicable law; an incident involving personal data must trigger a review to decide whether a breach requiring response has occurred, and where it has, response must include the relevant notifications and a record holding enough detail for regulatory or forensic reporting, including a description of the incident, its time period and consequences, who reported it, to whom, the steps taken to resolve it, whether personal data became unavailable, lost, disclosed or altered, what data was compromised and what notifications were made. A processor must have breach notification provisions in its customer contract specifying how it supplies the information the customer needs to notify authorities and the expected notification response times, and must notify the customer without undue delay.
ISO 27701:2019 6.13.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.