Specifications

Breach Response

A breach is assessed, then disclosed to the people affected — within the window the law sets.

What it ensures

A breach handled quietly is a breach compounded. This control requires assessment before notification and holds the incident open until notice has gone to affected consumers within the statutory window.

It removes the option of closing an incident internally and hoping.

Watch it run

A possible breach of consumer information is detected — and the clock the states set begins.

Illustrative run — one case moving through the Breach Response specification.

Breach detected Assessed Notified Closed (no notice req.)
Permitted transition Forbidden move Start Terminal state
A breach is assessed, then disclosed to the people affected within the statutory window. Quietly closing it without notice is in red.
✕ refused ✕ Close quietly ✕ Notify past window 1 ✓ Detected 2 ✓ Assessed 3 ✓ Notified
Ready

A possible breach of consumer information is detected.

  1. Ready

    The detection

    Something may have been exposed. From here, the law sets both a duty and a deadline.

  2. Blocked

    Before the assessment

    Notifying or closing before establishing scope and who’s affected is refused. The assessment comes first.

    What it satisfies

    Forbidden transition: no notification or closure may issue before the breach is assessed.

    State data-breach notification laws Guidance State data-breach notification laws (all 50 states) Every U.S. state requires entities that suffer a breach of personal information to assess it and notify affected consumers (and often regulators) within a defined window. Triggers, timing, and content vary by state.
  3. Permitted

    The assessment

    Before anyone is notified, the agency establishes what happened and who is affected.

  4. Blocked

    The wrong move

    Handling it quietly is the tempting path — and the one that turns a breach into a cover-up. Closing without notice is refused.

    Where it comes from

    Every state requires notice to affected consumers (and often regulators) after a breach of personal information, within a defined window.

    What it satisfies

    Refusing to close without notice, and sending it within the statutory window, enforces the state data-breach notification laws that apply.

    State data-breach notification laws Guidance State data-breach notification laws (all 50 states) Every U.S. state requires entities that suffer a breach of personal information to assess it and notify affected consumers (and often regulators) within a defined window. Triggers, timing, and content vary by state.
  5. Blocked

    Past the window

    A late or deficient notice is its own violation — the duty includes the deadline and the content. Refused.

    What it satisfies

    Guarded: notice must issue within the statutory window and carry the required content.

    State data-breach notification laws Guidance State data-breach notification laws (all 50 states) Every U.S. state requires entities that suffer a breach of personal information to assess it and notify affected consumers (and often regulators) within a defined window. Triggers, timing, and content vary by state.
  6. Permitted

    Notified

    The people affected learn what happened, in time to act.

  7. On the record

    The proof

    The file shows the breach was assessed and consumers notified within the window.

Why it holds

Why the whole holds

No single response plan guarantees disclosure. What holds is that a breach can’t be closed without notifying the people affected, in time. Reliability isn’t good intentions under pressure; it’s that quiet closure has no path.

Why it matters

Every state imposes breach-notification duties with deadlines; missing or skipping notice converts a security failure into a separate, well-publicized legal one.