U.S. Keeps 36-Hour Cyber Incident Rule

U.S. federal rules require certain banking organizations to report cybersecurity incidents to regulators as soon as possible, and no later than 36 hours after determining that a reportable incident occurred. The requirement also applies to bank service providers when a material disruption or degradation of covered services lasts four hours or more, according to the Electronic Code of Federal Regulations.

Who is covered by the incident notification rule?

The rule covers bank holding companies, state member banks, Edge and agreement corporations, and the U.S. operations of foreign banking organizations under Federal Reserve jurisdiction. In parallel, the OCC regulation applies to national banks, federal savings associations, and federal branches and agencies of foreign banks.

Under the Federal Reserve framework, the notification duty appears in 12 CFR Part 225 Subpart N, while the OCC addresses it in 12 CFR Part 53. In both cases, notice must be sent as soon as possible, and no later than 36 hours after determining that a reportable incident occurred.

What do the interagency security guidelines require?

U.S. interagency information security guidelines set administrative, technical, and physical standards to protect the security, confidentiality, and integrity of customer information. Those guidelines were issued under the Gramm-Leach-Bliley Act and appear in Appendix F to Part 225.

The available material does not show any recent change to those rules, but it does place them within the framework that sets safeguards for customer information at entities covered by federal banking rules.

What did Banking Dive say about examiners?

According to Banking Dive, a change to the definition of unsafe or unsound practices would limit bank examiners' intervention in cybersecurity vulnerabilities to situations where material financial harm is likely, rather than possible or plausible. That version was presented in the context of criticism from Senator Elizabeth Warren.

That point does not appear to be confirmed in the regulatory documentation included in the research material, so it should be read as a reference attributed to the news coverage, not as a verified regulatory change.