A key customer contract requires the company to notify the customer of any breach affecting its data within a shorter window than the applicable regulator requires. How should the incident response procedures address this?
Select an answer to reveal the explanation.
Short Explanation
A contract doesn't replace the law, it stacks on top of it. If the customer gets a shorter clock than the regulator, your process has to hit the customer's clock, or you've breached the contract while being perfectly compliant. The trap is thinking 'the law wins' means the contract doesn't count.
Full Explanation
Contractual obligations are binding commitments that sit alongside legal and regulatory requirements; meeting one does not discharge the other. When a customer contract requires faster breach notification than the regulator, the incident response plan must be designed so the organization can meet the strictest applicable commitment, which means notification procedures, contact lists, decision authority and templates must support the shorter window. The idea that statutory requirements override contracts confuses conflict with addition; there is no conflict here, because notifying the customer earlier does not violate the regulation. Waiting to notify the customer until after the regulator would likely breach the contractual window and exposes the organization to penalties and loss of trust. Renegotiating the contract may be an option for the business to consider, but leaving procedures unchanged until it happens leaves the organization exposed today and assumes the customer will agree. Exam caveat: if a law ever prohibited early disclosure, for example during a law enforcement investigation, legal counsel would decide how to proceed; that is not the situation described. Operational check: confirm the incident response plan's notification matrix lists the customer's contractual window and that tabletop exercises test meeting it.