Who is accountable for incident notification under critical infrastructure law?

Why This Matters for Security Teams

Incident notification under critical infrastructure law is not just a legal deadline. It is an operational test of who can see the event, who can prove impact, and who can trigger escalation without delay. Regulated asset owners stay accountable even when cloud, SaaS, OT, or managed service providers run parts of the stack. That makes contract language, logging, and evidence retention part of the notification control surface, not administrative extras. Current guidance from CISA cyber threat advisories and the EU NIS2 Directive both reinforce that responsibility sits with the regulated entity, not the outsourced operator.

For NHI-heavy environments, this matters because incident reporting often depends on machine-to-machine evidence: token use, API calls, privileged session logs, and service-to-service access paths. If secrets are dispersed across tooling or if third parties control the only usable audit trail, the organisation may know it has an incident but still be unable to prove scope fast enough. NHI failure patterns described in 52 NHI Breaches Analysis show how quickly access sprawl turns into disclosure risk. In practice, many security teams discover reporting gaps only after a provider outage or credential compromise has already narrowed their notification window.

How It Works in Practice

Accountability should be designed into the incident workflow before an event occurs. That means mapping every in-scope system to a named responsible entity, then defining which provider actions are purely supportive and which are delegated operational controls. The legal duty to notify may remain with the asset owner, but the evidence needed to make that notification often lives in shared systems, backup platforms, SIEM pipelines, identity providers, and managed detection services.

Practitioners should align contracts and procedures around four things:

• notification triggers that define what constitutes a reportable event
• access to logs, timestamps, and custody records within the required timeframe
• named escalation contacts for the provider and the regulated entity
• testing that proves the owner can obtain evidence even if a supplier is unavailable

That approach is consistent with the control logic in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where auditability, incident response, and supply chain oversight intersect. It also mirrors the breach lessons in Schneider Electric credentials breach and JetBrains GitHub plugin token exposure, where access artifacts mattered as much as the compromise itself. The operational question is not whether a vendor helped, but whether the regulated entity can still validate impact and notify on time. These controls tend to break down in multi-vendor environments where logs are fragmented across jurisdictions and no single party controls the full evidence chain.

Common Variations and Edge Cases

Tighter notification governance often increases coordination overhead, requiring organisations to balance speed against contractual complexity and provider dependency. Best practice is evolving, especially where cloud shared-responsibility models, multi-tenant SaaS, or OT service contracts blur operational boundaries. There is no universal standard for this yet, but current guidance suggests that if the regulated entity is in scope, it must retain decision authority for notification even when suppliers detect, contain, or investigate the incident.

Edge cases appear when a managed service provider is the first to see the alert, when a third-party platform stores the evidence, or when legal regimes impose different timelines across regions. In those cases, the critical control is pre-agreed information access, not informal trust. Organisations should also verify that third-party administrators cannot block or delay disclosure by withholding credentials, dashboards, or log exports. The broader NHI risk is visible in NHIMG research: The 2026 Infrastructure Identity Survey found that 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic deployments, which is a warning sign for incident escalation as well. Notification duties become harder to meet when the systems producing the evidence are themselves over-privileged and poorly governed.

Related resources from NHI Mgmt Group

• Who is accountable for operational trust during a cyber incident?
• Who is accountable when sovereign recovery fails during a regulated incident?
• Who is accountable when a provider discloses data under legal demand?
• Why is NHI governance critical in the age of AI attacks?