After a breach, management asks who can approve external notifications. What should define the answer?

1. The attacker, through the ransom note
2. Whichever analyst first saw the alert
3. Documented roles coordinated with legal and regulatory obligations
4. The monitoring vendor without organizational involvement