Primary and secondary points of contact (with phone numbers and email) - Escalation path for emergencies - Frequency and format of status updates - Incident notification requirements (e.g., "Critical vulnerabilities must be reported within 4 hours of discovery") - Secure communication channel specif