CII / Essential Entity Notification Guide
Minimal notification framework for regulated and critical digital service incidents.
SEVERITY
WHO SHOULD USE THIS
CII and essential service operators, regulated entities, and institutions with national continuity obligations.
High impact incident
ACTIVE SEVERITY: HIGH
1. Provide operational impact on essential service delivery.
2. Include evidence of spread/degradation risk.
3. Provide update cadence for next 24 hours.
Sensitive data sharing
1. Classify sensitive intelligence before sharing (TLP style handling).
2. Use secure/encrypted channels for forensic artifacts.
3. Share minimum necessary information for triage and response.
Minimum notification packet
Include incident start time, affected critical services, business/public impact, active containment actions, dependency impact, and accountable technical and executive contacts.
SECTOR PLAYBOOKS
16 critical-sector notification playbooks
Use the sector lens to add operational context to the minimum notification packet. Each sector should still report severity, impact, containment status, and accountable contacts.
SECTOR 01
Telecommunications and Digital Infrastructure
Voice, data, internet exchange, hosting, domain, IP, cloud, and connectivity infrastructure.
- Preserve traffic and routing evidence.
- Report service degradation and affected regions.
- Coordinate restoration with upstream providers.
SECTOR 02
Government and Public Administration
National and county government platforms, revenue, procurement, citizen service, and administrative systems.
- Confirm affected public services.
- Protect citizen records and access credentials.
- Escalate continuity impact to accountable officers.
SECTOR 03
Defence and National Security
Defence, intelligence, policing, emergency coordination, and national security support systems.
- Classify all shared indicators before release.
- Use secure reporting channels only.
- Preserve chain of custody for operational evidence.
SECTOR 04
Banking and Financial Services
Banking, payment, settlement, capital markets, savings, transaction switching, and financial market systems.
- Quantify transaction and settlement impact.
- Report fraud exposure and account compromise signals.
- Coordinate with regulator and payment ecosystem contacts.
SECTOR 05
Energy and Petroleum
Electricity generation, transmission, distribution, petroleum, fuel logistics, and energy control systems.
- Separate IT and OT incident details.
- Report safety and service continuity impact.
- Preserve control-system telemetry and access logs.
SECTOR 06
Transport and Logistics
Aviation, rail, maritime, road transport management, logistics, and transport safety systems.
- Report passenger, cargo, and safety impact.
- Identify affected transport corridors or facilities.
- Coordinate manual fallback and service continuity updates.
SECTOR 07
Health Services
Hospitals, health records, clinical systems, public health platforms, laboratories, and medical service systems.
- Declare patient-safety impact immediately.
- Protect clinical records and identity data.
- Report downtime procedures and restoration priorities.
SECTOR 08
Water and Sanitation
Water treatment, distribution, sewerage, sanitation control, monitoring, and public water service systems.
- Report service disruption by area.
- Identify control-system or telemetry compromise.
- Escalate public health and safety impact.
SECTOR 09
Food and Agriculture
Food supply, agriculture platforms, food safety, distribution, production support, and market continuity systems.
- Report supply chain disruption risk.
- Protect production and logistics records.
- Coordinate with affected producers and distributors.
SECTOR 10
Education and Research
Education management, examination, research, learning, student data, and institutional digital systems.
- Protect student and research data.
- Report examination or learning continuity impact.
- Preserve identity and access logs.
SECTOR 11
Electoral Systems
Voter registration, election management, results transmission, electoral logistics, and public election information systems.
- Preserve integrity evidence before containment changes.
- Report public trust and availability impact.
- Coordinate communications through approved channels.
SECTOR 12
Judiciary and Justice
Courts, prosecution, case management, legal records, evidence systems, and justice administration platforms.
- Protect case records and digital evidence.
- Report hearing, filing, or custody-process disruption.
- Preserve audit trails for legal accountability.
SECTOR 13
Immigration and Civil Registration
Identity, immigration, border, passport, civil registration, and population records systems.
- Report identity-service availability impact.
- Protect biometric and personal records.
- Flag suspected identity fraud or data exfiltration.
SECTOR 14
Land Administration
Land records, cadastral systems, registry services, mapping platforms, and property transaction systems.
- Preserve transaction and registry audit trails.
- Report data integrity risk immediately.
- Suspend suspicious changes pending verification.
SECTOR 15
Industry, Manufacturing and Trade
Industrial operations, manufacturing systems, trade facilitation, standards, supply-chain, and production platforms.
- Assess production and supply-chain impact.
- Separate business-system and industrial-control impact.
- Report safety, export, or market continuity risk.
SECTOR 16
Public Safety and Environmental Management
Public safety, disaster response, environmental monitoring, warning systems, and emergency service platforms.
- Escalate life-safety and environmental risk.
- Protect emergency communications and sensor data.
- Maintain frequent status updates until stabilization.