Is it necessary to notify users about the incident?

Users should be notified of an incident if it affects their work, data security, or access to services. This increases trust and allows users to take measures (e.g., change passwords or prepare for disruptions).

If the incident does not directly impact users (e.g., internal technical issues, quick recovery without losses), notification may not be mandatory.

It is recommended to have pre-prepared incident management policies that define the criteria for notifying users.