If you stay off their radar.... I found that a bit bizarre, but I guess that is just their system.
Is that only for mandatory breach notification? Let's drill in, because you said we should start with that at a minimum. What levels should there be? What would be the maximum?