--- name: compliance-breach-notification description: Assess breach notification readiness across GDPR, US state laws, HIPAA, PCI DSS, NIS2 and contractual SLAs, with a notification decision tree and template library. Use when the user wants to check who they would have to notify after a data breach and whether their own process could meet every deadline they are bound by. metadata: argument-hint: "[project] [--skip-checks]" workflow: compliance phase: 1 artifact: 01-assess/ --- # Breach Notification Compliance Assessment Assess breach notification compliance for "$ARGUMENTS". Map notification requirements by jurisdiction, evaluate contractual SLA obligations, and create a notification decision tree and template library. **Arguments.** `$ARGUMENTS` may contain the project name and optional flags. Take the first token as `` and treat `--skip-checks` as a flag; never include flags in file paths. All paths below use ``. If `--skip-checks` is present, skip the prerequisite check and, **before writing any artifact**, append one line to `.singularskills/log.jsonl`: `{"ts":"","skill":"compliance-breach-notification","workflow":"compliance","phase":1,"project":"","event":"skipped","artifact":"01-assess/","note":""}`. ## Prerequisites **Part of a workflow.** This skill is phase 1 (Assess) of the GRC Lifecycle workflow (`compliance`); cross-domain workflows run it too. First check `.singularskills/log.jsonl` for an open run for this project: a `run-started` line with `"project":""` and no later `run-finished` line for the same `workflow` and `project`. If one exists, the conductor is running you: continue here. Otherwise, if the user asked to start, run, continue or resume a process or workflow rather than this one step, do not continue here: invoke the `workflow` skill with the workflow the user asked for, or `compliance` when they named none, followed by ``; it runs this phase in order, asks before it writes and records the run. Otherwise continue here: a later phase runs on its own, behind its gate. Run this skill's gate before writing: `sh /scripts/gate.sh `, where `` is the folder that contains `.singularskills/` (use `.` when you are already there). If it exits non-zero, stop and tell the user what it printed, unless `--skip-checks` was given (see Arguments). On a refusal, before you stop, append this line to `.singularskills/log.jsonl` (create the folder and file if missing): `{"ts":"","skill":"compliance-breach-notification","workflow":"compliance","phase":1,"project":"","event":"refused","artifact":"01-assess/","note":""}`. Once the gate has passed, or under `--skip-checks` once you have appended the `skipped` line, append this line before you start work: `{"ts":"","skill":"compliance-breach-notification","workflow":"compliance","phase":1,"project":"","event":"started","artifact":"01-assess/","note":""}`. Read `.singularskills/compliance//00-scope.md`. If this file does not exist, tell the user: > Phase 0 (Scope) has not been completed for "". Run `/compliance-regulatory-landscape ` first, or use `--skip-checks` to bypass. ## Process 1. **Read context files:** - Read `references/grc-lifecycle-guide.md` for GRC methodology reference - Read `references/assessment-template.md` for output structure - Read `.singularskills/compliance//00-scope.md` for scope and control framework context 2. **GDPR breach notification (Art 33-34):** - Assess notification to supervisory authority procedures (72-hour timeline from awareness) - Evaluate notification content requirements (nature of breach, categories/numbers affected, DPO contact, consequences, measures taken) - Review notification to data subjects procedures (without undue delay if high risk to rights and freedoms) - Assess breach severity assessment methodology (risk to individuals determination) - Evaluate cross-border notification procedures (lead supervisory authority identification) - Review breach record-keeping obligations (all breaches, not just notifiable ones) 3. **US state breach notification laws:** - Map notification requirements across all applicable states - Assess state-specific timelines (varies 30-90 days; some states have specific deadlines: Colorado 30 days, Florida 30 days, Washington 30 days) - Evaluate Attorney General notification thresholds per state (e.g., 500+ individuals in many states) - Review definition of "personal information" variations by state (some include login credentials, biometrics, health data) - Assess consumer reporting agency notification requirements (typically 1,000+ individuals) - Evaluate encryption and redaction safe harbors by state - Review content requirements for notification letters per state 4. **HIPAA breach notification (if applicable):** - Assess individual notification procedures (60 days from discovery, written notification) - Evaluate HHS/OCR notification requirements (60 days for 500+ affected, annual log for under 500) - Review media notification requirements (500+ individuals in a single state/jurisdiction) - Assess breach risk assessment methodology (4-factor test: nature of PHI, unauthorized person, actual access/use, mitigation extent) - Evaluate Business Associate notification obligations to Covered Entity (without unreasonable delay, no later than 60 days) 5. **PCI DSS breach notification:** - Assess card brand notification procedures and timelines - Evaluate acquiring bank notification requirements - Review forensic investigation requirements (PFI engagement) - Assess card reissuance cost liability and recovery procedures - Evaluate PCI Forensic Investigator engagement readiness 6. **NIS2 breach notification (if applicable):** - Assess early warning notification procedures (24 hours to CSIRT/competent authority) - Evaluate incident notification requirements (72 hours with initial assessment) - Review final report requirements (1 month with root cause analysis, mitigation measures, cross-border impact) - Assess significant incident determination criteria - Evaluate voluntary notification provisions for near-misses 7. **Contractual SLA obligations:** - Map customer notification timelines from DPAs and BAAs - Assess vendor/partner notification obligations (upstream and downstream) - Evaluate contractual penalties for notification delays - Review cooperation and information sharing obligations with customers - Assess cyber insurance notification requirements and timelines - Evaluate board and executive notification procedures (internal escalation) 8. **Notification decision tree:** - Assess existence and accuracy of breach classification criteria (severity levels) - Evaluate decision tree for determining notification obligations by breach type and jurisdiction - Review escalation procedures from detection to notification decision - Assess parallel notification workflow management (multiple jurisdictions simultaneously) - Evaluate legal hold and privilege considerations in breach investigation 9. **Template library and readiness:** - Assess existence of pre-drafted notification templates per jurisdiction - Evaluate template content compliance with jurisdiction-specific requirements - Review communication channel readiness (email, postal, website substitute notice, media) - Assess call center and response team readiness for individual notifications - Evaluate credit monitoring and identity protection service arrangements - Review regulatory filing templates and portal access (state AG portals, HHS portal) 10. **Write the artifact** to `.singularskills/compliance//01-assess/breach-notification.md` following the assessment template structure with: - **GDPR Notification** — 72-hour process, content, and data subject notification readiness - **US State Laws** — jurisdiction map, timelines, AG thresholds, and safe harbors - **HIPAA Notification** — individual, HHS, and media notification procedures (if applicable) - **PCI DSS Notification** — card brand and forensic investigation readiness (if applicable) - **NIS2 Notification** — early warning, incident notification, and final report procedures (if applicable) - **Contractual SLAs** — customer and vendor notification timeline compliance - **Decision Tree** — breach classification, determination workflow, and escalation - **Template Library** — pre-drafted templates and communication readiness - **Evidence Inventory** — existing evidence and evidence gaps - **Remediation Priorities** — ranked list of gaps to address ## Output The breach notification assessment written to `.singularskills/compliance//01-assess/breach-notification.md`. Present a summary to the user highlighting: - Number of jurisdictions mapped and notification timeline compliance readiness - Fastest required notification timeline and current capability to meet it - Template and communication readiness score — score = (Compliant + 0.5 × Partial) ÷ applicable step-9 readiness items (N/A excluded), as a percentage - Top 3 gaps requiring remediation **Record the run.** After you have written the artifact, append this line to `.singularskills/log.jsonl` (the `started` line of Prerequisites, with `"event":"finished"`): `{"ts":"","skill":"compliance-breach-notification","workflow":"compliance","phase":1,"project":"","event":"finished","artifact":"01-assess/","note":""}`. Open the artifact with this frontmatter (`agent` is the agent you run in, or `unknown`; `gate` is `passed` when the gate ran clean and `skipped` under `--skip-checks`): ```yaml --- skill: compliance-breach-notification workflow: compliance phase: 1 project: started: finished: agent: gate: --- ``` End the artifact with `## Decisions` and `## Open questions`, in this shape: ```markdown ## Decisions - — — ## Open questions - ``` End the artifact with this paragraph, verbatim: > **Not legal or audit advice.** This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.