The organization must establish, document, and maintain an incident notification procedure to ensure timely and effective communication with service recipients. The procedure must require immediate internal reporting and subsequent notification to service recipients without undue delay when a significant incident is likely to negatively affect service delivery.

The procedure must ensure the notification content is comprehensive and, as a minimum, includes the following to the extent the information is available:

• Impact analysis and duration: A clear statement on the expected and actual consequences of the incident and the expected duration of the disruption.
• Mitigation guidance: Actionable steps, measures, or countermeasures that recipients can immediately implement to reduce personal risks or mitigate the negative impact of the incident.
• Communication schedule: The planned timeline for follow-up updates and the designated channel for obtaining additional information.