The canon · Security · SEC-4.1

Describe the incident notification obligation and timeline owed to the insurer.

This is one of the twenty-five questions a carrier reviewer sends a vendor, in the words an examiner uses. Below it: the answers that make a reviewer stop on this item, derived by running Vaulith's rules engine on an estate that gets everything wrong, and the free questions that reach it.

What stops a reviewer here

One finding reaches this item.

Will be questionedR-INCIDENT-NOTICE · blocks this item

No incident notification commitment to the insurer is stated

You have not committed to a time within which the insurer is told of a security incident. Section 500.17 gives the carrier seventy-two hours to notify its own regulator once it determines an incident has occurred, including one at a third-party service provider, and section 500.11(b)(3) has the carrier require notice from its vendors for exactly that reason. A reviewer therefore looks for a vendor commitment inside that window, and treats a longer one, or none, as a term to be negotiated before the contract can be signed.

To fix: Commit to notifying the insurer within seventy-two hours or less of discovering an incident that touches their data, write it into the contract and the incident response plan, and record the number here.

How it is scored

Credit per verdict, times the weight.

A contextual item carries weight 1. A pass earns 1.00 of it, a questioned answer 0.60, an escalated one 0.20 and a stop 0.00. An unanswered item earns nothing and still takes the citation penalty, so a profile cannot be improved by leaving an inconvenient question blank. The whole arithmetic is shown on the homepage and in every assessment.