# ISMS Communication Plan: [Organization name]

> Plan for internal and external communication about the information
> security management system (ISMS): what is communicated, when, with
> whom, by whom and how, and how each communication is recorded. It
> supports ISO/IEC 27001:2022 + Amd 1:2024 clause 7.4 (communication)
> and links to clause 7.3 (awareness), clause 5.2 (policy
> communication) and Annex A controls A.5.5 (contact with authorities),
> A.5.6 (contact with special interest groups), A.5.24 to A.5.26
> (incident management) and A.6.8 (event reporting). Replace every
> `[bracketed]` value and every row marked *Example*.

<!--
Guidance: How to use this template
- Use it when you set up the ISMS and review it every year and after
  every major incident, reorganisation or new regulation.
- Fill the audience list (section 3) first from the context and
  interested parties document (DOC-ISMS-003), then the communication
  matrix (section 4). Every interested party with a requirement should
  appear in at least one row.
- Main pitfall: a plan that lists only internal newsletters. Auditors
  look for external communication too: customers, regulators, the
  certification body, suppliers, and what happens during an incident.
- Clause 7.4 needs a deliberate plan for internal and external
  communication: the message, its timing, the audience and the channel.
  "Who communicates" was an explicit item in the 2013 edition and is
  kept here as good practice: an unnamed sender means nobody sends.
- Detailed incident and crisis messaging lives in the incident
  response plan and the crisis plan; this plan points to them.
- Related templates: `isms/isms-context-interested-parties`,
  `compliance/incident-response-plan`,
  `isms/crisis-management-communications-plan`,
  `isms/security-event-reporting-procedure`,
  `isms/authority-special-interest-contacts`,
  `security/security-awareness-program`,
  `isms/security-whitepaper-trust-center`,
  `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: Name a single owner for the plan and an approver from communications or top management. Spokesperson lists change often: keep them in an annex or linked contact list so the plan does not need re-approval for each name change. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-027 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@head-of-communications], [@ciso], [@legal-counsel], [@isms-steering-committee] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.2, 7.3, 7.4; Annex A A.5.5, A.5.6, A.5.24 to A.5.26, A.6.8) |
| Next scheduled review | YYYY-MM-DD |
| Interested parties source | DOC-ISMS-003 (context and interested parties) |
| Approved spokespersons | [Linked contact list, reference] |
| Communication log location | [Tool or folder] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Head of communications | [@head-of-communications] | [Reviewed] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First issue |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Added regulator rows after NIS2 applicability assessment |
| [x.y] | YYYY-MM-DD | [@author] | [Change summary] |

## Contents

- [1. Purpose and scope](#1-purpose-and-scope)
- [2. Principles](#2-principles)
- [3. Audiences](#3-audiences)
- [4. Communication matrix](#4-communication-matrix)
- [5. Internal communication](#5-internal-communication)
- [6. External communication](#6-external-communication)
- [7. Incident and crisis communication](#7-incident-and-crisis-communication)
- [8. Approval, classification and channels](#8-approval-classification-and-channels)
- [9. Annual communication calendar](#9-annual-communication-calendar)
- [10. Communication log](#10-communication-log)
- [11. Measuring effectiveness](#11-measuring-effectiveness)
- [12. Size tiers](#12-size-tiers)
- [13. Records and evidence](#13-records-and-evidence)
- [14. References](#14-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Purpose and scope

<!-- Guidance: State what the plan covers and what it leaves to other documents. A common gap is marketing or sales making security claims (for example "fully encrypted", "certified") that the ISMS cannot support. Bring those messages into scope. -->

This plan sets out how [Organization name] communicates about
information security and the ISMS with people inside and outside the
organisation. It covers:

- communication of the information security policy and topic-specific
  policies (clause 5.2 and A.5.1);
- messages that build awareness and report ISMS performance;
- communication with customers, suppliers, regulators, authorities,
  the certification body and special interest groups;
- public security statements, including the trust centre and claims
  about certification;
- the hand-over to incident and crisis communication.

| Item | Value |
|---|---|
| In scope | [All ISMS-related communication within the scope in DOC-ISMS-002] |
| Out of scope | [General corporate communication with no security content] |
| Detailed procedures elsewhere | [Incident response plan DOC-ISMS-020, crisis plan DOC-ISMS-078, event reporting DOC-ISMS-023] |
| Plan owner | [@isms-manager] |

## 2. Principles

<!-- Guidance: Keep principles few and testable. An auditor may ask a staff member how they would report a suspected incident or who may speak to the press about security. The answers should match these principles. -->

1. **One source of truth.** Policies, contacts and status messages come
   from controlled documents (DOC-ISMS-028); copies are links, not
   attachments.
2. **Named senders.** Every planned communication has a named sender
   role. Only approved spokespersons speak externally about incidents
   or security posture.
3. **Classification first.** Messages are classified before sending
   (DOC-ISMS-042). Threat and incident information shared with
   external groups uses an agreed sharing protocol, such as FIRST TLP
   2.0.
4. **Accurate claims.** External security claims are checked by the
   ISMS manager against evidence; certification claims follow the
   certification mark rules (DOC-ISMS-097).
5. **Two-way channels.** Every audience has a way to raise security
   concerns: staff report events (A.6.8), customers and researchers
   reach a published security contact.
6. **Recorded.** Communications that prove an ISMS requirement (policy
   communication, regulator contact, customer notification) are logged
   (section 10).

## 3. Audiences

<!-- Guidance: Derive audiences from interested parties in DOC-ISMS-003 and their requirements. For each, ask: what do they need to know from us, what do we need from them, and is there a deadline set by law or contract? -->

| Audience ID | Audience | Internal or external | What they need from us | What we need from them | Source requirement |
|---|---|---|---|---|---|
| AUD-01 | Top management and board | Internal | ISMS performance, risks above appetite, decisions needed | Direction, resources, approvals | Clauses 5.1, 9.3 |
| AUD-02 | All staff and contractors | Internal | Policies, awareness, how to report events, changes affecting them | Following rules, reporting events | Clauses 5.2, 7.3, A.6.8 |
| AUD-03 | Control and risk owners | Internal | Tasks, deadlines, audit results, metrics | Evidence, status updates | Clauses 6.1, 9.1 |
| AUD-04 | Customers | External | Security posture, certification status, incident notifications, subprocessor changes | Security requirements, questionnaires, incident contacts | Contracts, DOC-ISMS-014 |
| AUD-05 | Suppliers and processors | External | Our security requirements, incident duties, changes | Incident notices, assurance reports | A.5.19 to A.5.22 |
| AUD-06 | Regulators and supervisory authorities | External | Mandatory notifications, responses to requests | Guidance, requests | DOC-ISMS-014 (for example GDPR, NIS2, DORA where applicable) |
| AUD-07 | Law enforcement and national CSIRTs | External | Incident reports where required or useful | Threat information, support | A.5.5 |
| AUD-08 | Special interest groups and ISACs | External | Shared threat indicators under agreed protocol | Threat intelligence, good practice | A.5.6, A.5.7 |
| AUD-09 | Certification body | External | Audit information, notification of significant changes | Audit plans, findings, certificate | Certification agreement |
| AUD-10 | Insurers | External | Incident notification per policy terms, posture information at renewal | Coverage, incident support | Insurance contract |
| AUD-11 | Public, media and security researchers | External | Approved statements, vulnerability disclosure channel | Responsible disclosure reports | Policy, reputation |

## 4. Communication matrix

<!-- Guidance: This is the core of clause 7.4. One row per recurring communication. Keep "how" concrete (channel and format) and say where the record is kept. An auditor picks two rows and asks for the last instance of each. -->

| Comm ID | What | When | With whom | Who sends | How | Record |
|---|---|---|---|---|---|---|
| COM-001 *(Example)* | Information security policy and changes | On approval and annually | AUD-02 | ISMS manager on behalf of CEO | Intranet page plus e-mail with acknowledgement | Acknowledgement report |
| COM-002 *(Example)* | ISMS performance report | Quarterly | AUD-01 | ISMS manager | Steering committee meeting, report DOC-ISMS-081 | Minutes |
| COM-003 *(Example)* | Management review outputs | After each review | AUD-01, AUD-03 | ISMS manager | Minutes and action list | DOC-ISMS-085 |
| COM-004 *(Example)* | Internal audit results | After each audit | AUD-01, AUD-03 | Internal audit lead | Audit report DOC-ISMS-084, closing meeting | Report distribution list |
| COM-005 *(Example)* | Awareness campaign | Monthly topic, annual course | AUD-02 | Security awareness lead | Intranet, chat channel, course platform | Platform completion data |
| COM-006 *(Example)* | Security event reporting reminder | Onboarding and twice a year | AUD-02 | Security team | Handbook, poster, chat pinned message | Log entry |
| COM-007 *(Example)* | Security posture and certificate status | On request and on certificate changes | AUD-04 | Sales engineering with ISMS manager review | Trust centre, questionnaire answers | Trust centre version history, DOC-ISMS-115 |
| COM-008 *(Example)* | Subprocessor and significant change notices | As contracts require, before the change | AUD-04 | Privacy lead | E-mail to contract contacts, trust centre update | Notification log |
| COM-009 *(Example)* | Security requirements and changes | At contract and on change | AUD-05 | Supplier manager | Contract schedule, supplier portal | Supplier file DOC-ISMS-066 |
| COM-010 *(Example)* | Mandatory incident notifications | Within legal or contractual deadlines | AUD-04, AUD-06 | Legal counsel and privacy lead, approved by incident commander | Regulator portal, formal letter | Incident record DOC-ISMS-021 |
| COM-011 *(Example)* | Contact details review with authorities | Annually | AUD-06, AUD-07 | ISMS manager | Contact list check | DOC-ISMS-069 |
| COM-012 *(Example)* | Threat information sharing | As events occur | AUD-08 | Security team lead | ISAC platform under TLP | Sharing log |
| COM-013 *(Example)* | Significant ISMS changes | Before or as soon as the change is decided | AUD-09 | ISMS manager | E-mail to the certification body contact | ISMS change record DOC-ISMS-025 |
| COM-014 *(Example)* | Public security statements | On approval | AUD-11 | Head of communications with ISMS manager review | Website, press statement | Approval record |
| [COM-NNN] | [what] | [when] | [audience IDs] | [role] | [channel and format] | [record] |

## 5. Internal communication

<!-- Guidance: Internal communication proves three things to an auditor: the policy was communicated (5.2), people are aware (7.3), and management receives the information it needs (9.3). Plan messages for each. -->

### 5.1 Policy and awareness

Share the information security policy with everyone working in the
ISMS scope, and decide which interested parties outside the
organisation may receive it (for example customers on request). New staff
receive it at onboarding (with the employee security handbook,
DOC-ISMS-073); all staff receive changes when approved. Awareness
messages follow the security awareness programme
(`security/security-awareness-program`) and the competence and training
matrix (DOC-ISMS-026).

### 5.2 Management reporting

| Report | Audience | Frequency | Content |
|---|---|---|---|
| ISMS performance report (DOC-ISMS-081) | Steering committee | Quarterly | Objectives status, metrics, incidents, audit findings, risk changes |
| Risk summary | Top management | Quarterly and on new High or Critical risk | Risks above appetite, acceptance requests |
| Management review pack | Top management | At least annually | All clause 9.3 inputs |
| Board summary | Board or owners | Annually | Posture, certification status, major incidents, investment needs |

### 5.3 Operational messages

Control owners receive reminders for recurring tasks from the ISMS
annual calendar (DOC-ISMS-032): access reviews, backup tests, policy
reviews and evidence collection. Use the same channel each time so
messages are recognised and not mistaken for phishing.

## 6. External communication

<!-- Guidance: External communication carries legal and contractual risk. Make sure each message type has an approver and that regulator and customer deadlines are in the legal register, not only in people's heads. This is a documentation format, not legal advice. -->

| Audience | Typical messages | Approver | Notes |
|---|---|---|---|
| Customers | Security questionnaires, trust centre, certificate copy, incident and breach notices, subprocessor changes | ISMS manager (posture), legal (notices) | Use the answer library (DOC-ISMS-115) for consistency |
| Regulators | Incident notifications, responses to inquiries, registrations | Legal counsel and top management | Deadlines differ by regime, for example GDPR Article 33 (72 hours to the supervisory authority where feasible) and NIS2 Article 23 (early warning within 24 hours); check each law in DOC-ISMS-014 |
| Authorities and CSIRTs (A.5.5) | Incident reports, requests for help | ISMS manager or incident commander | Keep contacts current in DOC-ISMS-069 |
| Special interest groups (A.5.6) | Indicators, lessons learned | Security team lead | Share only under the agreed protocol; remove personal and customer data |
| Certification body | Change notifications, audit planning, responses to findings | ISMS manager | See DOC-ISMS-025 section 8 |
| Suppliers | Requirements, incident coordination, audit requests | Supplier manager | Follow the supplier agreement (DOC-ISMS-068) |
| Public and media | Statements, website security page, vulnerability disclosure policy | Head of communications and CEO | Never confirm incident details before the incident commander approves |

Certification claims: refer to the certificate only within its scope
and validity, and follow the certification body's mark rules
(`isms/certification-mark-usage`, DOC-ISMS-097).

## 7. Incident and crisis communication

<!-- Guidance: Do not duplicate the incident response plan here. Show who decides on communication during an incident and where the detailed procedure lives. The sequence below must match DOC-ISMS-020 and DOC-ISMS-078; update all three together. -->

During a security incident, communication follows the incident response
plan (`compliance/incident-response-plan`, DOC-ISMS-020). When an
incident becomes a crisis, the crisis management and communications
plan (`isms/crisis-management-communications-plan`, DOC-ISMS-078) takes
over. The flow below shows the main decision points.

```mermaid
sequenceDiagram
  participant Staff as Staff member
  participant SEC as Security team
  participant IC as Incident commander
  participant LEG as Legal and privacy
  participant COMMS as Communications
  participant EXT as Customers and regulators
  Staff->>SEC: Reports suspected event (DOC-ISMS-023)
  SEC->>IC: Escalates confirmed incident
  IC->>LEG: Requests notification assessment
  LEG-->>IC: Notification duties and deadlines
  IC->>COMMS: Approves holding statement
  COMMS->>EXT: Sends approved notice or statement
  EXT-->>COMMS: Questions and follow-up
  COMMS->>IC: Reports external messages sent, for the log
```

| Situation | Who decides on communication | Detailed procedure |
|---|---|---|
| Suspected event reported by staff | Security team on triage | DOC-ISMS-023 |
| Confirmed incident, no external impact | Incident commander | DOC-ISMS-020 |
| Personal data breach | Legal counsel and privacy lead, incident commander approves | DOC-ISMS-020, `compliance/personal-data-breach-assessment` |
| Incident affecting customers or regulated services | Incident commander with top management | DOC-ISMS-020 |
| Crisis (major outage, public attention, extortion) | Crisis team | DOC-ISMS-078 |

## 8. Approval, classification and channels

<!-- Guidance: Define who approves which message type and which channels are approved for which classification. A common finding is sensitive incident detail shared in a public chat channel or on an unapproved messaging app. -->

| Message type | Classification *(Example)* | Approver | Approved channels |
|---|---|---|---|
| Policy publication | Internal | Policy owner and top management | Intranet, document system |
| Awareness content | Internal or Public | Security awareness lead | Intranet, chat, course platform |
| ISMS performance and audit results | Confidential | ISMS manager | Document system with restricted access |
| Incident status (internal) | Confidential | Incident commander | Dedicated incident channel, bridge call |
| Customer and regulator notifications | Confidential | Legal counsel | Regulator portal, formal e-mail from a monitored mailbox |
| Threat sharing | TLP label as agreed | Security team lead | ISAC platform, encrypted e-mail |
| Public statements | Public | Head of communications and CEO | Website, press release |

Out-of-band channels: keep a backup channel for incidents where e-mail
or chat may be compromised (for example a phone tree or a separate
messaging tenant), tested during exercises.

## 9. Annual communication calendar

<!-- Guidance: Put recurring communications on a calendar so none are missed. Align with the ISMS annual calendar (DOC-ISMS-032) and the audit programme. -->

| Month *(Example, 2027)* | Communication |
|---|---|
| January | Annual policy acknowledgement campaign (COM-001); awareness course opens (COM-005) |
| February | Q4 performance report to steering committee (COM-002) |
| March | Authority and special interest contact review (COM-011) |
| April | Internal audit results (COM-004) |
| May | Q1 performance report (COM-002); event reporting reminder (COM-006) |
| June | Management review outputs (COM-003) |
| August | Q2 performance report (COM-002) |
| September | Supplier requirements refresh (COM-009) |
| October | Awareness month campaign (COM-005) |
| November | Q3 performance report (COM-002); event reporting reminder (COM-006) |
| December | Plan review and calendar for next year |

## 10. Communication log

<!-- Guidance: Log communications that prove a requirement or carry legal weight. Routine chat messages need no log. Record enough to show what was sent, to whom, when, by whom and whether it was acknowledged. -->

| Log ID | Date | Comm ID | Audience | Sender | Channel | Summary | Acknowledged or response | Reference |
|---|---|---|---|---|---|---|---|---|
| LOG-001 *(Example)* | 2027-01-15 | COM-001 | AUD-02 (320 staff) | ISMS manager | E-mail with acknowledgement | Policy v3.0 published | 312 of 320 acknowledged by 2027-01-31 (97.5%) | Acknowledgement report |
| LOG-002 *(Example)* | 2027-02-05 | COM-013 | AUD-09 | ISMS manager | E-mail | Notified cloud migration ISMS-CHG-007 | Certification body confirmed receipt 2027-02-08 | DOC-ISMS-025 |
| LOG-003 *(Example)* | 2027-02-26 | COM-008 | AUD-04 (hospital customers) | Privacy lead | E-mail | New cloud subprocessor notice, at least 60 days before the planned cutover | No objections received | Notification log |
| LOG-004 *(Example)* | 2027-03-10 | COM-011 | AUD-06, AUD-07 | ISMS manager | Phone and e-mail | Annual contact check, 2 numbers updated | Updated in DOC-ISMS-069 | Contact list v4 |
| [LOG-NNN] | YYYY-MM-DD | [COM-NNN] | [audience] | [role] | [channel] | [summary] | [result] | [reference] |

The entries LOG-001 to LOG-003 use the Quillmere Health Systems
setting (320 staff, hospital customers).

## 11. Measuring effectiveness

<!-- Guidance: Measure whether messages reached people and changed behaviour, not just whether they were sent. Feed results into the measurement programme (DOC-ISMS-080). -->

| Measure | Target *(Example)* | Source |
|---|---|---|
| Policy acknowledgement rate within 30 days | 95% or more | Acknowledgement report |
| Staff who can name the event reporting channel (spot check) | 90% or more | Internal audit interviews |
| Mandatory notifications sent within deadline | 100% | Incident register DOC-ISMS-021 |
| Customer questionnaire answers consistent with the answer library | 100% reviewed before sending | DOC-ISMS-115 |
| Authority contact list reviewed on schedule | Annually | DOC-ISMS-069 |

## 12. Size tiers

<!-- Guidance: Scale the plan to the organisation. The requirement is the same; the number of audiences, channels and approvers differs. These are the library's working tiers. -->

| Aspect | Small: Quillmere Analytics Ltd (46 staff) | Medium: Quillmere Health Systems (320 staff) | Large: Quillmere Group (2,400 staff, 6 sites in 4 countries) |
|---|---|---|---|
| Plan owner and sender | The part-time ISMS manager sends most messages; the managing director approves external statements | ISMS manager, privacy lead and a communications lead | CISO's security office with corporate communications and site coordinators |
| Key external audiences | B2B customers (as processor), cloud provider, certification body | Hospitals, health regulators, data protection authority, colocation provider | Customers, regulators in 4 countries, OT suppliers, certification bodies for ISO 9001, ISO 22301 and ISO/IEC 27001 |
| Channels | Chat, e-mail, trust page | Intranet, learning platform, customer portal | Intranet in site languages, works council channels where required, regional media contacts |
| Incident communication | Managing director leads, with external counsel on call | Incident commander rota and legal | Crisis team per region, integrated with ISO 22301 crisis arrangements |
| Log | One table in this document | Ticketing tool with a communication category | Integrated management system log shared with quality and continuity |

## 13. Records and evidence

<!-- Guidance: List the records that prove communication happened as planned. Auditors usually ask for the policy communication record, one external notification and the authority contact list. -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| This plan, approved | Communication needs are determined (7.4) | ISMS manager | Document system | Current plus previous [3] versions |
| Communication log (section 10) | Planned communications happened | ISMS manager | [Tool or folder] | [3] years |
| Policy acknowledgement reports | Policy communicated (5.2) and awareness (7.3) | HR | Learning or HR system | [3] years |
| Notification records to regulators and customers | Legal and contractual duties met | Legal counsel | Incident record DOC-ISMS-021 | As set by law and DOC-ISMS-014 |
| Authority and special interest contact list | A.5.5, A.5.6 operate | ISMS manager | DOC-ISMS-069 | Current plus history |
| Certification body correspondence | Certificate kept accurate | ISMS manager | Certification folder | Certificate cycle plus [3] years |
| Approved public statements | Claims checked before publication | Head of communications | Approval records | [3] years |

Map these records to clauses 5.2, 7.3 and 7.4 and controls A.5.5,
A.5.6 and A.6.8 in the control evidence matrix
(`isms/control-evidence-matrix`, DOC-ISMS-033).

## 14. References

<!-- Guidance: Cite editions and check for new ones at each annual review. Legal deadlines change: check them in the official texts before relying on them. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | Current; Amd 1 published 2024-02-23 | Clauses 5.2, 7.3, 7.4, 9.3; Annex A A.5.5, A.5.6, A.5.24 to A.5.26, A.6.8 (cited only) |
| ISO/IEC 27002:2022 | Current | Guidance for A.5.5, A.5.6, A.6.8 |
| ISO/IEC 27035-1:2023 | Current | Incident management principles, including communication |
| ISO 22361:2022 | Current | Crisis management and communication |
| FIRST Traffic Light Protocol 2.0 | https://www.first.org/tlp/ | Information sharing labels |
| Regulation (EU) 2016/679 (GDPR), Articles 33 and 34 | Example of breach notification duties | Example only |
| Directive (EU) 2022/2555 (NIS2), Article 23 | Example of incident reporting duties | Example only |

Related templates: Context and interested parties
(`isms/isms-context-interested-parties`, DOC-ISMS-003), Incident
response plan (`compliance/incident-response-plan`, DOC-ISMS-020),
Crisis management and communications plan
(`isms/crisis-management-communications-plan`, DOC-ISMS-078), Security
event reporting procedure (`isms/security-event-reporting-procedure`,
DOC-ISMS-023), Authorities and special interest groups contacts
(`isms/authority-special-interest-contacts`, DOC-ISMS-069), Security
whitepaper and trust centre content
(`isms/security-whitepaper-trust-center`, DOC-ISMS-116), Security
questionnaire answer library
(`isms/security-questionnaire-answer-library`, DOC-ISMS-115),
Certification mark usage rules (`isms/certification-mark-usage`,
DOC-ISMS-097), ISMS change plan (`isms/isms-change-plan`,
DOC-ISMS-025).

Official texts: ISO/IEC 27001:2022 https://www.iso.org/standard/82875.html,
Amd 1:2024 https://www.iso.org/standard/88435.html, ISO/IEC 27002:2022
https://www.iso.org/standard/75652.html, ISO 22361:2022
https://www.iso.org/standard/50267.html.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.2,
7.3 and 7.4, Annex A controls A.5.5, A.5.6, A.5.24 to A.5.26 and
A.6.8), with ISO/IEC 27035-1:2023 and ISO 22361:2022 as references.
Legal deadlines from the GDPR and NIS2 are paraphrased examples from
the public texts; check the consolidated official texts and your own
obligations. TLP is cited by name as published by FIRST. Clause and
control numbers are cited with original descriptions; the text,
matrices and examples of this template are original, and no ISO/IEC
text is reproduced. You need the official standards to implement and
audit the requirements. Check the current editions before use.
Quillmere organisations and all figures are fictional examples. This is
a documentation format, not legal advice. Template licence: MIT.