Draft incident customer notice guidance from incident severity, affected data, regulator need, customer impact, and remediation status