NIST SP 800-61 Rev. 3 RS.CO: RS.CO Mechanisms in place in advance to coordinate with affected parties

CSF 2.0 Category: response activities are coordinated with internal and external stakeholders as required by laws, regulations or policies. Priority High. N1: reporting and communication fall into four kinds: incident coordination (current and planned response activities among parties with response roles), incident notification (formally informing affected customers, employees, partners, regulators or others about a data breach or other incident), public communication (for example answering media inquiries) and incident information sharing (usually voluntary sharing of threat information based on what the organization observed). R1: have mechanisms in place in advance to coordinate with affected parties about incidents when needed. These items apply to RS.CO-02 and RS.CO-03.