A communication protocol is in place to ensure the reporting is targeted to the level of management (and where required regulatory authorities), with a timeframe based on the severity of the incident.