Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we have to notify a US regulator or the people affected, and under which law?

8 decision pointsThe pack behind this answer: Regulatory Incident Notification & Reporting

Add to board memo

The short answer

Recommendation
Screen every declared incident against each US regime in your profile within 4 hours of declaration, the pack's default, and record the time of discovery as well as the declaration time, because the US clocks start from different events.
Reasoning
Each US regime has its own test and its own start. HIPAA and the FTC's Health Breach Notification Rule count from discovery, the first day anyone in the workforce or any agent knew or with reasonable diligence would have known; the Safeguards Rule counts the first day the event is known to you or an employee, officer or agent, and State laws as each State says. Discovery can be a day or more before the incident is declared. The SEC counts four business days from the decision that the incident is material, and New York counts 72 hours from determining that a cybersecurity incident has occurred. Counting every clock from declaration makes some of them late before anyone has decided anything.
Considerations
  • HIPAA's 60 calendar days are the outer limit of without unreasonable delay, not a target, and a breach is presumed unless the four-factor assessment shows a low probability of compromise.
  • State laws are placeholders in the pack, with California and New York as examples: every State has its own definition and its own deadline.
  • No notice under one regime stands in for a notice under another, and a notice to one body never waits for a notice to another.
  • The 4-hour screen is the pack's default, which your own policy may change as long as it leaves enough of each legal clock.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn incident has been declaredStepRecord when anyone first knewStepStart from your US applicability profileStepScreen every US duty within 4 hoursDecisionHIPAA: was protected health information reached?DecisionIs it a breach: not excluded, not shown low risk?StepHIPAA: notify within 60 calendar days of discoveryDecisionSEC: are we listed, and could it be material?StepSEC: determine materiality, then file in four business daysDecisionNew York: are we licensed there, and is it an incident?StepNew York: notify within 72 hours of determining itDecisionState law: do affected people live in a State with a notice law?StepRead each State's law and notify on its clockDecisionFTC: a financial institution, or a health app outside HIPAA?StepFTC: notify within the Rule's own daysStepCheck contracts, the insurer and a crime reportStepRecord one of four outcomes for each regimeDecisionIs any decision Not settled?StepSettle it, or treat it as ReportableDecisionIs any notice due?OutcomeNotify each body on its own clock, with what is knownOutcomeNo notice due: keep the decisions and their reasons

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 22 steps.

  1. Start

    An incident has been declared

    The EU clocks run from awareness, the declaration. Several US clocks do not. HIPAA and the FTC's rules count from discovery, and State laws as each State says, the first day anyone in the workforce or any agent knew, which can be earlier than the declaration. A security analyst who logged an odd event on Monday and an incident declared on Tuesday can mean discovery was on Monday: treat the first alert as discovery unless counsel advises that the breach was not yet known or knowable. Record both times at once.

    In the pack

  2. Step

    Record when anyone first knew

    Record the earliest time anyone in the organisation, or any agent, knew or with reasonable diligence would have known, and who knew first. HIPAA defines discovery this way and the Health Breach Notification Rule follows it; the Safeguards Rule counts only what is known to you (no reasonable-diligence limb), and State laws use their own tests. Whether a vendor's discovery counts as yours depends on whether it acts as your agent: ask counsel, and assume it may.

    In the pack

  3. Step

    Start from your US applicability profile

    Make the profile before any incident. It records which of HIPAA, the SEC, New York's rule, State law and the FTC's rules can apply to you, in which role, to which recipient, and which States your customers or members live in. A regime it rules out is recorded as Not applicable, with the profile as the reason. Executive management approves it and it is reviewed at least once a year.

    In the pack

  4. Step

    Screen every US duty within 4 hours

    Ask the five US questions every time the profile says a regime can apply, then the contract, insurance and law-enforcement questions. The 4 hours is the pack's default; never set a screen time that leaves too little of a legal clock. Decide on what is known and mark each unknown with who is finding it out.

    In the pack

  5. Decision

    HIPAA: was protected health information reached?

    HIPAA applies to a covered entity, such as a health plan or most health care providers, and to a business associate that handles protected health information for one. Ask whether information the Privacy Rule protects was acquired, accessed, used or disclosed in a way it does not permit. If you are not a covered entity or business associate, record Not applicable.

    In the pack

  6. Decision

    Is it a breach: not excluded, not shown low risk?

    An impermissible use or disclosure is presumed to be a breach unless one of three exclusions applies or a risk assessment of four factors shows a low probability that the information has been compromised: the information and re-identification, the person who received it, whether it was actually acquired or viewed, and the mitigation. The burden of showing there was no breach is yours. Record each factor and what was found.

    In the pack

  7. Step

    HIPAA: notify within 60 calendar days of discovery

    A covered entity notifies each individual without unreasonable delay and no later than 60 calendar days after discovery, the Secretary with them for 500 or more individuals, and the media where more than 500 residents of one State are involved. A business associate tells the covered entity instead, within the agreement's time, which is usually shorter. A law-enforcement request can delay notice only in the form the rule requires. Where misuse looks imminent, you may also telephone or use other means in addition to the written notice.

    In the pack

  8. Decision

    SEC: are we listed, and could it be material?

    A company that files reports with the SEC files Form 8-K Item 1.05 for a cybersecurity incident it determines to be material, within four business days of that determination. If you are not such a company, record Not applicable. If you are, name who determines materiality and by when; do not wait until the incident is contained.

    In the pack

  9. Step

    SEC: determine materiality, then file in four business days

    The determination is made without unreasonable delay after discovery and recorded with its time and reasons. Four business days then run from it, skipping weekends and days the SEC is closed. What is not yet determined is stated in the filing and added by amendment within four business days of being determined or becoming available. “When do we have to disclose a cyber incident to the SEC as a listed company?” takes this step by step.

    In the pack

    See also

  10. Decision

    New York: are we licensed there, and is it an incident?

    New York's cybersecurity regulation covers a person operating under a licence or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law. A cybersecurity incident is one that requires you to notify any government body, self-regulatory agency or other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or deploys ransomware within a material part of your systems. Record the time you determined it.

    In the pack

  11. Step

    New York: notify within 72 hours of determining it

    Notify the Superintendent electronically as promptly as possible and within 72 hours of determining that a cybersecurity incident has occurred, at you, an affiliate or a third-party service provider. An extortion payment starts two more clocks: notice within 24 hours of the payment, and a written description within 30 days of why it was necessary, the alternatives and the sanctions diligence.

    In the pack

  12. Decision

    State law: do affected people live in a State with a notice law?

    Every State has its own definition of personal information, its own deadline and often a notice to its attorney general above a number of residents. The pack gives California and New York as examples and leaves the rest as placeholders: read each State involved. Where residents of several States are affected, plan to the earliest deadline.

    In the pack

  13. Step

    Read each State's law and notify on its clock

    Read the current text of each State's statute, not a summary. Note what counts as personal information, whether encryption is an exception, the deadline and whether it counts from discovery or notification, and whom else to tell. Give each State its own decision line.

    In the pack

  14. Decision

    FTC: a financial institution, or a health app outside HIPAA?

    The Safeguards Rule covers non-bank financial institutions under the FTC's jurisdiction: notify within 30 days of discovering a notification event involving at least 500 consumers' unencrypted information. The Health Breach Notification Rule covers vendors of personal health records and related entities (a third-party service provider tells its customer instead) that HIPAA does not: notices within 60 calendar days of discovery.

    In the pack

  15. Step

    FTC: notify within the Rule's own days

    Use the Commission's form for a Safeguards Rule notice and the Health Breach Notification Rule's notices to individuals, the media and the Commission. Both count from discovery.

    In the pack

  16. Step

    Check contracts, the insurer and a crime report

    Contracts, your cyber insurer and the police may need notices on their own terms, with no legal clock. A customer contract can require notice faster than any law, so list those times beside the legal ones.

    In the pack

  17. Step

    Record one of four outcomes for each regime

    For each regime and incident record Reportable, Not reportable, Not applicable or Not settled, with the facts relied on, who decided and when. A Not settled decision carries the time it will be revisited, and the SEC question is never left to wait for containment.

    In the pack

  18. Decision

    Is any decision Not settled?

    A decision can be Not settled only while a fact the test needs is unknown. Give it a revisit time before the first deadline it could affect, and revisit every decision short of Reportable at each update and at once when a fact changes.

    In the pack

  19. Step

    Settle it, or treat it as Reportable

    Revisit at the time set. For a clock close to expiry, notify on the facts known and say the assessment continues: a notice can be updated, a missed deadline cannot be undone. For the SEC, record why the determination is not yet made and when it will be.

    In the pack

  20. Decision

    Is any notice due?

    A notice is due when any decision is Reportable, or treated as Reportable. Enter every due time in the log and in the calendars of whoever drafts and submits each notice.

    In the pack

  21. Outcome

    Notify each body on its own clock, with what is known

    Draft every notice from the one fact base so that they agree, send each through its own channel by its own deadline, log the time and the reference, and set the next due time. No notice stands in for another.

    In the pack

  22. Outcome

    No notice due: keep the decisions and their reasons

    Keep the profile, the decision lines and the facts relied on. Under HIPAA the burden of showing there was no breach is yours, and the record is how you meet it.

    In the pack

Practical checklist

  1. Start from the US applicability profile: HIPAA role, SEC registrant, New York licence, States where affected people live, FTC status.
  2. Record the time of discovery as well as the time of declaration, and who knew first.
  3. For each regime in the profile, record Reportable, Not reportable, Not applicable or Not settled, with the facts relied on.
  4. Set each due time from its own start: discovery, the materiality determination, New York's determination or an extortion payment.
  5. Revisit every decision short of Reportable at each update, and name who determines materiality if you are a listed company.

Evidence to have ready

  • The US applicability profile in force on the day.
  • The case log showing both the discovery time and the declaration time.
  • One decision line per regime and incident: outcome, facts relied on, who decided and when.
  • The due times entered in the log and in the calendars of whoever drafts and submits each notice.

Assumptions

  • You are subject to at least one US regime in the pack's list and have named your recipients: the Department of Health and Human Services portal, EDGAR access, the New York portal and the States' offices. The pack leaves State rows as placeholders.
  • The 4-hour screen is the pack's default, and your own policy may set another, as long as it leaves enough of each legal clock. The legal deadlines are the ones the pack's US matrix states, as read on 18 October 2026. This is not legal advice.
  • Sector rules outside the pack's list can add their own duties, for example DFARS, and CIRCIA once its final rule is published (it had not been on 18 October 2026: check its status). The pack names them and does not work them through. Other regimes the pack does not work through include the bank regulators' computer-security incident rules (36 hours from determining a notification incident, for example 12 CFR 53.3, 225.302 and 304.23), the credit union rule (72 hours, 12 CFR 748.1) and your state insurance regulator's rules. Check your regulator.

Not covered here