CCSP - Cloud Security Operations (17% of the exam) - Section 5.5
Manage communication with relevant parties.
Communication with vendors, customers, partners, regulators and other stakeholders, including what must be disclosed and when.
stakeholder communicationregulator notificationvendor and partner communicationbreach disclosure
Practice question for this objective
lock_openFree sampleCloud Security Operationseasy
A cloud security team confirms a breach that exposed regulated personal data. What is the primary factor that determines when the relevant data protection regulator must be notified?
AThe moment the incident response team has fully eradicated the threat and closed the incident
BThe notification timeframe defined by the applicable law or regulation, measured from awareness of the breachcheck_circle Correct
CThe next scheduled quarterly compliance review with the internal audit function
DThe cloud provider's preference for when its customers should contact outside authorities
Understand that regulator breach notification is triggered by the legal timeframe running from the organisation's awareness of the breach. Breach notification laws impose a defined deadline that starts when the organisation becomes aware of a qualifying breach, so the applicable legal timeframe, not incident closure or internal cadences, governs when the regulator must be told.
Why A is wrong: Waiting for full closure is tempting but wrong; many regimes require notification while response is still underway, well before eradication.
Why B is correct: Regulatory notification duties are set by law and run from the point the organisation becomes aware, so the legal timeframe is the controlling factor.
Why C is wrong: Aligning to an internal review cadence sounds orderly but ignores statutory clocks that demand notification within days, not at the next review.
Why D is wrong: A provider may offer support, but a customer's legal notification duty is set by regulation, not by the provider's scheduling preference.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCSP bank for this domain.
Customer notifications should be withheld indefinitely until every technical root cause is fully understood
errorWhy it is wrong: Delaying until complete root-cause certainty conflicts with disclosure duties and expectations; interim notice is often required before analysis is finished.
The notification should be delayed until every technical root cause is fully resolved and closed
errorWhy it is wrong: Statutory windows require timely reporting on the facts known so far; waiting for full remediation typically breaches the deadline the notification exists to meet.
Threat actors, because their behaviour dictates the timing of every operational response
errorWhy it is wrong: Threat actors are the adversaries causing the incident; they have no legitimate interest to be served and are never a communication audience.