---
title: "Map all of your notification obligations before an incident occurs."
impact: CRITICAL
impactDescription: "essential for correctness or security"
tags: cybersecurity-compliance, legal, nis2, dora, sec-cybersecurity-rules
---

## Map all of your notification obligations before an incident occurs.

Create a matrix of every regulation, customer contract, and insurance policy that imposes notification requirements, including timelines, recipients, content requirements, and methods. Do not try to figure this out during the chaos of an active incident.