Incident notification matrix

The clock starts before the paperwork does. An incident declared in Jira or ServiceNow opens the task with just a discovery date; the forensics report, contract stack, and processing records attach as they arrive. Every deadline on the case runs off that one timestamp.

Grain scopes the affected data — elements, residency, encryption, per system — while a second pass mines the customer contracts for notice clauses and named security contacts. Then the notification matrix runs as a gate across every statute in play: triggers, safe harbors, thresholds. Unknowns block: a system whose encryption status is unconfirmed holds its jurisdictions rather than guessing.

What counsel sees is the case organized: how many records, where the people live, what was encrypted, which contracts carry clocks. And the check results in plain terms — what's exempt and why, which twelve states trigger, and the one honest “we don't know yet” that's holding Colorado.

The packet is the entire notification posture: the matrix itself, per-jurisdiction regulator letters and individual notices with state-mandated content, a counsel brief, and every proposed dispatch as a checkable action. Validations list what's unresolved — Colorado's hold sits here until the forensics addendum lands — and an independent pass confirms no notice exists for a jurisdiction the matrix cleared.

Alex works the case by asking Nia — which states flipped since the last addendum, what Maryland requires before individuals are told. New forensics re-run only the affected jurisdictions; a regulator's reply wakes the task with Nia's draft response attached. Dispatches — mail-house, portals, email — execute in the firm's own systems after approval, never before.