During a security event, an organization should notify external stakeholders and regulatory agencies as quickly as feasible, mainly if the incident includes sensitive data or substantially impacts the organization's operations. Specific notification procedures and timescales may differ depending on the industry, jurisdiction, and applicable rules.