Guidance · Situation
We may have to tell a regulator
An incident is open and a reporting clock may be running.
Why this moment is hard
The deadline can start before you know what happened. Several regimes may apply at once, each with its own clock, its own authority and its own idea of serious. Waiting for certainty is itself a decision. In the United States the clocks start from different events: discovery (including when you should reasonably have known), a determination that the incident is material, or a determination that a cybersecurity incident has occurred.
8 Guidance questions5 pack documentsAbout 5 h 30 min of reading in all
This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.
First, the decisions
Guidance · Incidents and regulatory notification
If we can't tell whether an incident is reportable and the deadline is close, then what?Why here If you cannot tell yet and the deadline is close, start here.
Guidance · Incidents and regulatory notification
When do we have to notify a regulator, and under which regime?Why here Which regimes apply, and when each one requires notice.
Guidance · Incidents and regulatory notification
How do we decide whether an incident is significant under NIS2?Why here The NIS2 test for a significant incident.
Guidance · Incidents and regulatory notification
When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?Why here When NIS2, DORA and the GDPR are all triggered, which clock runs first.
Guidance · Incidents and regulatory notification
When do we have to notify a US regulator or the people affected, and under which law?Why here In the United States, which regulators and which people are told, by when, and under which law.
Guidance · Incidents and regulatory notification
When do we have to disclose a cyber incident to the SEC as a listed company?Why here If you are a listed company, when a cyber incident is material and the four business-day Form 8-K clock starts.
Guidance · Incidents and regulatory notification
When one incident triggers HIPAA, State law and a customer contract, which clock runs first?Why here When one incident triggers HIPAA, State law and a customer contract, which clock runs first.
Guidance · Incidents and regulatory notification
Who approves and submits a regulatory notification, including out of hours?Why here Who approves and submits the notice, including out of hours.
Then, the documents
Framework / Methodology · P18-A03
Reportability Decision ModelWhy here Record the reportability decision and the reasoning behind it.
Matrix / Catalogue · P18-A02
EU Incident Notification Timeline Matrix (NIS2, DORA, GDPR)Why here Who must be told, by when and with what, regime by regime.
Matrix / Catalogue · P18-A09
US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)Why here The US duties side by side: HIPAA, the SEC, New York, State law and the FTC.
Template / Form · P18-A05
NIS2 Early Warning, Notification & Final Report TemplatesWhy here Drafting templates for each NIS2 reporting stage.
Template / Form · P18-A10
US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General)Why here Drafting templates for the US notices.
There is no CISO Times tool for this situation yet, so the path ends with the documents.
Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.