Which two characteristics of the organisation does NIST say determine which incident notification laws apply? Choose two.

Answer: D. Its geographic locations
C. Its customers' locations

SP 800-61r3 recommends performing notifications in compliance with current notification laws and regulations pertaining to the organisation's sectors, geographic locations, customer locations and any other applicable characteristics.

Source: NIST SP 800-61 Rev. 3 (NIST) — Table 3 RS.CO-02.R3