How to answer 'What is your security incident notification timeline?' on a CAIQ
I. Reviewer Guidance & Pitfalls
Reviewers reconcile this against your DPA. Quote the same number of hours in both, and distinguish detection→page (internal) from confirmation→customer-notice (contractual).
II. Example Answer Passing Enterprise Audit
Compliant Response
Sealed · SEF-03
Sev-1 incidents page on-call within 15 minutes; affected customers are notified within 72 hours of confirmation, per the DPA.
Filling out a CAIQ or SIG Lite right now?
QuietQuestionnaire drafts answers with citations pulled directly from your own SOC 2 report, catches contradictions reviewers reject, and locks exports behind cryptographic human sign-off.
No spam · No credit card · Confidential by default