hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A company's incident response plan includes a…
A company's incident response plan includes a requirement to notify law enforcement within 24 hours of certain security incidents. Which regulation most likely mandates this requirement?
⚠ Common exam trap
Watch out — candidates often confuse the 24-hour law enforcement notification requirement with GDPR's 72-hour breach notification to the supervisory authority, or assume HIPAA's 60-day rule applies to all healthcare data incidents, when PCI DSS is the only standard with a specific 24-hour law enforcement notification mandate for payment card breaches.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PCI DSS
PCI DSS Requirement 12.10.1 mandates that the incident response plan includes specific procedures to notify law enforcement within 24 hours of detecting a breach involving cardholder data. This is because PCI DSS is a contractual security standard for entities that handle payment card information, and timely law enforcement notification is critical for forensic investigation and legal compliance in payment card fraud cases.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SOX
Why it's wrong here
SOX does not have specific breach notification timelines.
- ✓
PCI DSS
Why this is correct
PCI DSS Section 12.10.2 requires notification to law enforcement within 24 hours of a suspected breach.
- ✗
GDPR
Why it's wrong here
GDPR requires notification within 72 hours, not 24.
- ✗
HIPAA
Why it's wrong here
HIPAA requires notification within 60 days for breaches involving unsecured PHI.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.