{
 "name": "Federal incident notification deadlines",
 "description": "21 federal, regulator and contract notice obligations: who each applies to, what starts the clock, the deadline and the citation.",
 "page": "https://risktemplate.com/reference/incident-notification-deadlines/",
 "csv": "https://risktemplate.com/reference/data/incident-notification-deadlines.csv",
 "creator": "RiskTemplates (risktemplate.com)",
 "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
 "last_verified": "2026-09-30",
 "row_count": 21,
 "built_from": [
  "scripts/templates/build_incident_response_kit.py (FEDERAL)"
 ],
 "disclaimer": "Reference summary, not legal advice. Confirm obligations against the cited statute or rule and with counsel.",
 "rows": [
  {
   "id": 1,
   "name": "Bank regulator 36-hour notice (banking organization)",
   "who": "Banking organizations supervised by the OCC, Federal Reserve or FDIC (not a non-bank fintech; its partner bank files this).",
   "trigger": "Determination that a notification incident occurred (a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, the bank's operations, business lines or services).",
   "deadline": "No later than 36 hours after determination",
   "rule": "Primary federal regulator must receive notice as soon as possible and no later than 36 hours after the determination.",
   "clock_type": "hours",
   "clock_type_label": "Hours after trigger",
   "amount": 36,
   "citation": "12 CFR 53.3; 12 CFR 225.302; 12 CFR 304.23 (Computer-Security Incident Notification rule)",
   "url": "https://www.ecfr.gov/current/title-12/chapter-I/part-53",
   "notes": "Compliance date May 1, 2022 (86 FR 66424, Nov 23, 2021). Often called the \"36-hour rule\".",
   "status": "In effect",
   "timeline_bucket": "36 hours",
   "last_verified": "2026-09-30"
  },
  {
   "id": 2,
   "name": "Bank service provider notice to bank customers",
   "who": "Bank service providers performing covered services (Bank Service Company Act) for a banking organization.",
   "trigger": "Determination that a computer-security incident has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for 4 or more hours.",
   "deadline": "As soon as possible once 4+ hours of disruption is determined or reasonably likely",
   "rule": "Notify at least one bank-designated point of contact at each affected bank as soon as possible. No designated contact: notify the CEO and CIO (or two individuals of comparable responsibility).",
   "clock_type": "asap",
   "clock_type_label": "As soon as possible - no fixed clock",
   "amount": null,
   "citation": "12 CFR 53.4; 12 CFR 225.303; 12 CFR 304.24",
   "url": "https://www.ecfr.gov/current/title-12/chapter-I/part-53",
   "notes": "Does not apply to scheduled maintenance, testing or software updates previously communicated to the bank.",
   "status": "In effect",
   "timeline_bucket": "As soon as possible (no fixed clock)",
   "last_verified": "2026-09-30"
  },
  {
   "id": 3,
   "name": "SEC Form 8-K Item 1.05 (material cybersecurity incident)",
   "who": "Public companies that file reports with the SEC.",
   "trigger": "Determination that the cybersecurity incident is material.",
   "deadline": "4 business days after the materiality determination",
   "rule": "File Form 8-K within 4 business days after the materiality determination (the U.S. Attorney General can authorize a national-security delay).",
   "clock_type": "business_days",
   "clock_type_label": "Business days after trigger (federal holidays excluded)",
   "amount": 4,
   "citation": "Form 8-K Item 1.05; 17 CFR 229.106 (annual Form 10-K disclosure)",
   "url": "https://www.sec.gov/newsroom/press-releases/2023-139",
   "notes": "Adopted Jul 26, 2023; effective Sep 5, 2023; Item 1.05 compliance began Dec 18, 2023 (smaller reporting companies 180 days later). A 2025 petition to rescind Item 1.05 (SEC file 4-856) is pending; the Federal Register shows no SEC proposal to amend or rescind it through Sep 30, 2026, so the rule is in force. Business days skip weekends and federal holidays.",
   "status": "In effect",
   "timeline_bucket": "4 business days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 4,
   "name": "SEC Regulation S-P customer notice",
   "who": "Broker-dealers, investment companies, and investment advisers and transfer agents registered with the SEC (covered institutions).",
   "trigger": "Becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.",
   "deadline": "No later than 30 days after becoming aware",
   "rule": "Notify affected individuals as soon as practicable, but not later than 30 days. Not required if a reasonable investigation determines sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 30,
   "citation": "17 CFR 248.30 (Regulation S-P, as amended 2024)",
   "url": "https://www.federalregister.gov/d/2024-11116",
   "notes": "Compliance dates: larger entities Dec 3, 2025; smaller entities Jun 3, 2026 (89 FR 47688).",
   "status": "In effect",
   "timeline_bucket": "30 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 5,
   "name": "Regulation S-P service provider 72-hour notice (contract term)",
   "who": "Service providers to SEC covered institutions.",
   "trigger": "Becoming aware of a breach in security resulting in unauthorized access to a customer information system the service provider maintains.",
   "deadline": "No later than 72 hours after becoming aware (contract term)",
   "rule": "Notify the covered institution as soon as possible, no later than 72 hours. The rule makes the covered institution require this of its providers (policies and contracts); it is not imposed on the provider directly.",
   "clock_type": "hours",
   "clock_type_label": "Hours after trigger",
   "amount": 72,
   "citation": "17 CFR 248.30 (service provider oversight)",
   "url": "https://www.federalregister.gov/d/2024-11116",
   "notes": "Check your contract with the covered institution for the exact term.",
   "status": "In effect",
   "timeline_bucket": "72 hours",
   "last_verified": "2026-09-30"
  },
  {
   "id": 6,
   "name": "FTC Safeguards Rule notice to the FTC",
   "who": "Non-bank financial institutions under FTC jurisdiction (for example lenders, money transmitters, payment apps).",
   "trigger": "Discovery of a notification event (unauthorized acquisition of unencrypted customer information) involving at least 500 consumers.",
   "deadline": "No later than 30 days after discovery (500+ consumers)",
   "rule": "Notify the FTC electronically as soon as possible, and no later than 30 days after discovery.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 30,
   "citation": "16 CFR 314.4(j); 16 CFR 314.2 (notification event)",
   "url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314",
   "notes": "Effective May 13, 2024 (88 FR 77499). A written incident response plan is a separate requirement (314.4(h), from the 2021 amendment, 86 FR 70272).",
   "status": "In effect",
   "timeline_bucket": "30 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 7,
   "name": "NYDFS 72-hour cybersecurity incident notice",
   "who": "Entities licensed or regulated by the New York State Department of Financial Services (23 NYCRR 500 covered entities).",
   "trigger": "Determination that a cybersecurity incident occurred at the entity, an affiliate or a third-party service provider.",
   "deadline": "No later than 72 hours after determination",
   "rule": "Notify DFS as promptly as possible, no later than 72 hours after the determination. A cybersecurity incident (500.1(g)) is a cybersecurity event that (1) impacts the covered entity and requires it to notify a government body, self-regulatory agency or other supervisory body (for example a state attorney general or regulator, or the FTC; a notice to consumers alone does not count), (2) is reasonably likely to materially harm a material part of normal operations, or (3) deploys ransomware in a material part of information systems.",
   "clock_type": "hours",
   "clock_type_label": "Hours after trigger",
   "amount": 72,
   "citation": "23 NYCRR 500.17(a) (as amended Nov 1, 2023)",
   "url": "https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "72 hours",
   "last_verified": "2026-09-30"
  },
  {
   "id": 8,
   "name": "NYDFS extortion payment notice (24 hours)",
   "who": "NYDFS covered entities.",
   "trigger": "An extortion payment made in connection with a cybersecurity event.",
   "deadline": "Within 24 hours of the payment",
   "rule": "Notify DFS of the payment within 24 hours of the payment.",
   "clock_type": "hours",
   "clock_type_label": "Hours after trigger",
   "amount": 24,
   "citation": "23 NYCRR 500.17(c)(1)",
   "url": "https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "24 hours",
   "last_verified": "2026-09-30"
  },
  {
   "id": 9,
   "name": "NYDFS extortion payment written explanation (30 days)",
   "who": "NYDFS covered entities.",
   "trigger": "An extortion payment made in connection with a cybersecurity event.",
   "deadline": "Within 30 days of the payment",
   "rule": "Within 30 days of the payment, file a written description of why payment was necessary, alternatives considered, diligence to find alternatives, and diligence to ensure compliance with applicable rules, including OFAC (Office of Foreign Assets Control) rules.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 30,
   "citation": "23 NYCRR 500.17(c)(2)",
   "url": "https://www.dfs.ny.gov/system/files/documents/2023/12/rf23_nycrr_part_500_amend02_20231101.pdf",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "30 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 10,
   "name": "HIPAA business associate notice to covered entity",
   "who": "HIPAA business associates (for example a fintech processing health-plan payments for a covered entity).",
   "trigger": "Discovery of a breach of unsecured protected health information.",
   "deadline": "No later than 60 calendar days after discovery",
   "rule": "Notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 60,
   "citation": "45 CFR 164.410",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "60 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 11,
   "name": "HIPAA covered entity notice to individuals",
   "who": "HIPAA covered entities.",
   "trigger": "Discovery of a breach of unsecured protected health information.",
   "deadline": "No later than 60 calendar days after discovery",
   "rule": "Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 60,
   "citation": "45 CFR 164.404",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "60 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 12,
   "name": "HIPAA notice to HHS (500 or more individuals)",
   "who": "HIPAA covered entities.",
   "trigger": "Discovery of a breach of unsecured protected health information.",
   "deadline": "With individual notice (no later than 60 days after discovery)",
   "rule": "Notify the Department of Health and Human Services (HHS) contemporaneously with individual notice (so no later than 60 calendar days after discovery).",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 60,
   "citation": "45 CFR 164.408(b)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
   "notes": "HIPAA does not require you to involve law enforcement; 164.412 only allows a delay when law enforcement asks for one.",
   "status": "In effect",
   "timeline_bucket": "60 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 13,
   "name": "HIPAA notice to HHS (fewer than 500, annual log)",
   "who": "HIPAA covered entities.",
   "trigger": "Discovery of a breach of unsecured protected health information.",
   "deadline": "60 days after the end of the calendar year",
   "rule": "Log the breach and report it to HHS no later than 60 days after the end of the calendar year of discovery.",
   "clock_type": "yearend60",
   "clock_type_label": "60 days after the end of the calendar year",
   "amount": 60,
   "citation": "45 CFR 164.408(c)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "60 days after year-end",
   "last_verified": "2026-09-30"
  },
  {
   "id": 14,
   "name": "HIPAA media notice (more than 500 residents of a state)",
   "who": "HIPAA covered entities.",
   "trigger": "Discovery of a breach involving more than 500 residents of a state or jurisdiction.",
   "deadline": "No later than 60 calendar days after discovery",
   "rule": "Notify prominent media outlets serving the state no later than 60 calendar days after discovery.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 60,
   "citation": "45 CFR 164.406",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D",
   "notes": "",
   "status": "In effect",
   "timeline_bucket": "60 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 15,
   "name": "FTC Health Breach Notification Rule notice to the FTC (500 or more)",
   "who": "Vendors of personal health records and related entities not covered by HIPAA.",
   "trigger": "Discovery of a breach of security of unsecured personal health record information.",
   "deadline": "With individual notice (no later than 60 calendar days)",
   "rule": "Notify the FTC contemporaneously with individual notice, which is due without unreasonable delay and within 60 calendar days. Fewer than 500: log and report within 60 calendar days after year-end.",
   "clock_type": "days",
   "clock_type_label": "Calendar days after trigger",
   "amount": 60,
   "citation": "16 CFR 318.4 (amended; effective July 29, 2024)",
   "url": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-318",
   "notes": "The older 10-business-day FTC notice is from the 2009 version and no longer applies.",
   "status": "In effect",
   "timeline_bucket": "60 days",
   "last_verified": "2026-09-30"
  },
  {
   "id": 16,
   "name": "Interagency Guidance notice to primary federal regulator",
   "who": "Banks and other institutions subject to the 2005 Interagency Guidance on Response Programs.",
   "trigger": "Becoming aware of an incident of unauthorized access to sensitive customer information.",
   "deadline": "As soon as possible - no fixed clock",
   "rule": "Notify the primary federal regulator as soon as possible (no fixed clock). Notify affected customers as soon as possible if misuse has occurred or is reasonably possible; a written law-enforcement request can delay customer notice.",
   "clock_type": "asap",
   "clock_type_label": "As soon as possible - no fixed clock",
   "amount": null,
   "citation": "12 CFR Part 30, App. B, Supplement A (Interagency Guidance on Response Programs, 2005)",
   "url": "https://www.ecfr.gov/current/title-12/chapter-I/part-30/appendix-Appendix%20B%20to%20Part%2030",
   "notes": "Service-provider contracts should require notice to the institution as soon as possible.",
   "status": "In effect",
   "timeline_bucket": "As soon as possible (no fixed clock)",
   "last_verified": "2026-09-30"
  },
  {
   "id": 17,
   "name": "CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act)",
   "who": "Covered entities to be defined in the final rule from the Cybersecurity and Infrastructure Security Agency (CISA).",
   "trigger": "None yet.",
   "deadline": "Proposed rule - not in effect",
   "rule": "Proposed rule only (published Apr 4, 2024, 89 FR 23644). No final rule as of September 30, 2026, so no reporting clock is in effect. Information only.",
   "clock_type": "info",
   "clock_type_label": "Information only",
   "amount": null,
   "citation": "89 FR 23644 (proposed rule)",
   "url": "https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia",
   "notes": "CISA held further town halls in 2026 (91 FR 6794; 91 FR 30498) and gives no final-rule date.",
   "status": "Proposed rule - not in effect",
   "timeline_bucket": "Not in effect",
   "last_verified": "2026-09-30"
  },
  {
   "id": 18,
   "name": "Card brands / acquirer notice (contract)",
   "who": "Merchants and service providers that store, process or transmit payment card data.",
   "trigger": "As defined in card-brand rules and your acquirer or processor agreement.",
   "deadline": "Contract hours",
   "rule": "Per contract and card-brand rules; use the hours set in your contract. PCI DSS v4.0.1 itself sets no hour deadline.",
   "clock_type": "contract_hours",
   "clock_type_label": "Contract or policy hours",
   "amount": null,
   "citation": "Card-brand rules and acquirer/processor agreement; PCI DSS v4.0.1",
   "url": "https://blog.pcisecuritystandards.org/just-published-pci-dss-v4-0-1",
   "notes": "PCI DSS v4.0.1 (published Jun 11, 2024) is the only active version.",
   "status": "Contract or policy term",
   "timeline_bucket": "Set by contract or policy",
   "last_verified": "2026-09-30"
  },
  {
   "id": 19,
   "name": "Bank partner notice (program agreement)",
   "who": "Fintechs in bank partnership and banking-as-a-service (BaaS) programs.",
   "trigger": "As defined in the program agreement (often detection or confirmation of an incident).",
   "deadline": "Program agreement hours",
   "rule": "Notice within the hours set in your program agreement. Track follow-up deliverables such as a root-cause report separately.",
   "clock_type": "contract_hours",
   "clock_type_label": "Contract or policy hours",
   "amount": null,
   "citation": "Your bank partner program agreement",
   "url": "",
   "notes": "",
   "status": "Contract or policy term",
   "timeline_bucket": "Set by contract or policy",
   "last_verified": "2026-09-30"
  },
  {
   "id": 20,
   "name": "Cyber insurance notice (policy)",
   "who": "Policyholders.",
   "trigger": "As defined in the policy.",
   "deadline": "Policy notice hours",
   "rule": "Notice within the policy's notice period. Check whether the policy requires panel vendors or insurer consent before you engage forensics or counsel.",
   "clock_type": "contract_hours",
   "clock_type_label": "Contract or policy hours",
   "amount": null,
   "citation": "Your cyber insurance policy",
   "url": "",
   "notes": "",
   "status": "Contract or policy term",
   "timeline_bucket": "Set by contract or policy",
   "last_verified": "2026-09-30"
  },
  {
   "id": 21,
   "name": "OFAC sanctions check before any ransom payment",
   "who": "Anyone considering, making or facilitating a ransomware payment.",
   "trigger": "Before any payment is made or facilitated.",
   "deadline": "Checklist item before any payment",
   "rule": "Checklist item, not a clock: screen the recipient for sanctions exposure and document the decision. OFAC treats proactive steps, including reporting to and cooperating with law enforcement, as mitigating factors.",
   "clock_type": "check",
   "clock_type_label": "Checklist item",
   "amount": null,
   "citation": "OFAC Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sep 21, 2021)",
   "url": "https://ofac.treasury.gov/recent-actions/20210921",
   "notes": "Record when the check was completed.",
   "status": "Checklist item (no clock)",
   "timeline_bucket": "Before any ransom payment",
   "last_verified": "2026-09-30"
  }
 ]
}