Keep statutory notification readiness and named incident roles

Information governance, information security and data protection officer: Keep statutory notification readiness and named incident roles. Starts when: An incident, or an annual exercise. Steps: Classify the incident; Named contactable roles act; Notify within the statutory deadline; Post-incident review feeds the risk register. Done when: Roles are named and contactable, the notification deadline is met and the review changes the register. Rules that apply: Cyber criteria 5.2 to 5.5; ICO enforcement (Enfield's notice of October 2025 was lifted March 2026).