There's no surprise there. Our witnesses yesterday weren't familiar with them either. I guess it's because it's recent.
I suggest you look at them, because it says:
Notification should occur as soon as possible following a breach. However, if you have contacted law enforcement authorities, you should determine from those authorities whether notification should be delayed in order not to impede a criminal investigation. The preferred method of notification is direct—by phone, letter or in person—to affected individuals.
That's direct notification to affected individuals whose names are known. That's pretty direct guidance.