US Incident Notification Timeline Matrix (HIPAA, SEC, NYDFS and State Law)
Sets out, for the US duties, who must be notified, by when, with what content and on what trigger under HIPAA, the SEC, New York's financial services rules, State law and the FTC.
Available soon
- Format
- Excel
- Size
- 88 KB
- Length
- 13 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read the Timeline Matrix first. Each row is one US reporting duty from P09's Incident Classification, Severity & Escalation Matrix. The duties and their deadlines are P09's: this workbook adds what opens each one, where its clock starts, where the notice goes, what it contains and who sends it. The State rows are placeholders: read each State's law (CN-19). |
| 2 | Tailor it once, from your applicability profile (RN-01): replace the [[placeholders]] in the Recipient and Channel columns with your recipients and accounts. If a contract or a State sets a shorter time, record it as its own row in the P18-A07 US Notices sheet (Due entered) and keep the matrix as it is: changing a clock here changes it for every incident. Never change a clock to a longer one. |
| 3 | When an incident is declared, P09's screen decides within 4 hours which US regimes apply (P09 IM-06), using the Reportability Decision Model. For each regime decided Reportable, read its rows across: what opens each notice, when it is due, where it goes and who sends it. |
| 4 | Record the time of discovery as well as the time of declaration (P09 IM-13, RN-21). The HIPAA, FTC and State clocks run from discovery, which can be earlier. A registrant records the materiality determination (RN-19); a New York covered entity records the time it determined that a cybersecurity incident had occurred. |
| 5 | On the Clock Calculator sheet, enter the incident, the time of discovery and the answers. Each due time calculates. The Form 8-K deadline skips weekends and the days on the Holidays sheet: keep that sheet current. A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so its deadline is 5:30 p.m. Eastern time on the fourth business day. Enter the times for this duty in Eastern time. Copy every due time into the Regulatory Notification Log. |
| 6 | Draft every notice from one fact base (RN-11). The Report Content sheet lists what each notice must contain and which fact base fields supply it. Use the US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General) for the wording. No notice under one regime stands in for another (RN-22). |
| 7 | Review the matrix with the applicability profile at least once a year, and whenever P09's duties, a State's law or a recipient changes. Delete the EXAMPLE rows on the Clock Calculator sheet before approval. The Timeline Matrix, Report Content and Clock Rules sheets are the content itself: tailor them, do not delete them. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply the US tests to your own facts. It is not legal advice. States differ and rules change; the SEC, the Department of Health and Human Services, the New York Department of Financial Services and the Federal Trade Commission publish their own guidance, forms and portals. Confirm every duty, deadline and form with counsel and with the body itself before you rely on it. No notice under one regime stands in for a notice under another.
The US duties are for organisations that are subject to them: HIPAA covered entities and business associates, companies that file reports with the SEC, entities licensed by the New York Department of Financial Services, and organisations that hold personal information of State residents. State laws are shown as placeholders with California and New York as examples; every State has its own. This is not legal advice; ask counsel which duties apply.
The US clocks for HIPAA, the FTC's rules and State breach laws run from discovery, not from the declaration time that starts awareness. Record both times (IM-13). The SEC's clock runs from the materiality determination, New York's from the determination that a cybersecurity incident has occurred, and the extortion notices from the payment.
EXAMPLE: Example Health Group, Inc. (EXAMPLE), a US health services company that runs a health plan and a network of outpatient clinics, with about 2,800 staff and members in several States. It is a HIPAA covered entity, and for one service also a business associate of other covered entities. Its shares are listed on a US exchange, so the SEC's rules for current reports apply to it. A private company reads the SEC rows as not applying. It holds a licence under the New York Insurance Law, so the Department of Financial Services' cybersecurity regulation applies. An organisation with no such licence reads those rows as not applying. It has members who live in California and New York, so those two States' laws are the examples; every other State has its own law. It is not a financial institution under the FTC's jurisdiction, so the FTC Safeguards Rule is not part of the example. The EXAMPLE sheet shows its applicability profile, its decisions and its reports for INC-2026-021 to INC-2026-023.
Tailoring — business associate: RD-20 is your duty. The covered entity decides on notice to the individuals unless your agreement says otherwise. Check how long each agreement gives you; it is usually shorter than 60 days.
Tailoring — not a listed company, not licensed in New York, not a financial institution under the FTC: keep the rows and mark the regime Not applicable in the profile, with the reason (RN-01).
Tailoring — IT run by a service provider: the provider may detect the incident, but discovery is counted from what anyone in the workforce or any agent knew, and whether the provider is your agent is a question of federal common law (45 CFR 164.404(a)(2)): ask counsel and assume it may be.
Timeline Matrix
One row for each of P09's US reporting duties (RD-17 to RD-29). The clocks are P09's (D-65); the State rows are placeholders until you read each State's law.
This document helps you apply the US tests to your own facts. It is not legal advice. States differ and rules change; the SEC, the Department of Health and Human Services, the New York Department of Financial Services and the Federal Trade Commission publish their own guidance, forms and portals. Confirm every duty, deadline and form with counsel and with the body itself before you rely on it. No notice under one regime stands in for a notice under another.
| Duty ID | Regime | Report | Applies to | What opens it | Clock starts at | Deadline (P09's words) | Clock (hours) | Clock (calendar days, due by the end of the day) | Clock (business days; the Form 8-K is due by 17:30 Eastern time on the last) | Recipient | Channel | What it contains | Template (P18-A10) | Can be delayed by | Who drafts, approves and submits | Legal reference |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RD-17 | HIPAA | Notification to each individual affected | Covered entities, for a breach of unsecured protected health information | A breach of unsecured protected health information at a covered entity: an impermissible acquisition, access, use or disclosure, presumed to be a breach unless an exclusion applies or the four-factor assessment shows a low probability of compromise. | Discovery (CN-13) | Without unreasonable delay and in no case later than 60 calendar days after discovery | — | 60 | — | Each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed | [[first-class mail, or email where the individual agreed]] | 6 items: a brief description of what happened; the types of unsecured protected health information involved ; any steps individuals should take to protect themselves from potential harm… (see Report Content) | UT-01 | DL-01 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | HIPAA § 164.404 |
| RD-18 | HIPAA | Notice to prominent media outlets | Covered entities, for a breach involving more than 500 residents of a State or jurisdiction | As RD-17, where more than 500 residents of one State or jurisdiction are involved. | Discovery (CN-13) | Without unreasonable delay and in no case later than 60 calendar days after discovery, where more than 500 residents of one State or jurisdiction are involved | — | 60 | — | Prominent media outlets serving the State or jurisdiction | [[the media outlets' newsroom addresses]] | 1 item: the same content as the notice to individuals (see Report Content) | UT-02 | DL-01 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | HIPAA § 164.406 |
| RD-19 | HIPAA | Notice to the Secretary of Health and Human Services | Covered entities, for any breach of unsecured protected health information | As RD-17, for any breach: the Secretary is told with the individuals for 500 or more, or in the annual log for fewer. | Discovery; for fewer than 500, the end of the calendar year of discovery (CN-15) | 500 or more individuals: contemporaneously with the notice to individuals (no later than 60 calendar days after discovery); fewer than 500: log the breach and report it within 60 days after the end of the calendar year of discovery | — | 60 | — | Secretary of Health and Human Services (Office for Civil Rights) | [[the Department of Health and Human Services' breach reporting portal]] | 3 items: who we are and a contact who can answer the department; the number of individuals; the types of information (see Report Content) | UT-03 | DL-01 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | HIPAA § 164.408 |
| RD-20 | HIPAA | Notice by a business associate to the covered entity | Business associates, for a breach of unsecured protected health information | A breach of unsecured protected health information that we, a business associate, discover. | Discovery by the business associate (CN-13) | Without unreasonable delay and in no case later than 60 calendar days after discovery (the contract usually sets a shorter time) | — | 60 | — | [[the covered entity we serve]] | [[the route and contact set in the business associate agreement]] | 2 items: the identification of each individual whose unsecured protected health information has been; any other available information the covered entity must include in its notice to individuals (see Report Content) | UT-04 | DL-01 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | HIPAA § 164.410 |
| RD-21 | SEC | Current report on Form 8-K, Item 1.05 | Registrants, for a cybersecurity incident the registrant determines to be material | A cybersecurity incident that the registrant determines to be material. | The materiality determination (CN-16, CN-17) | Within four business days after the company determines the incident is material; missing information is filed by amendment within four business days after it is determined or becomes available; a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day, so the last safe time is 5:30 p.m. Eastern on the fourth business day | — | — | 4 | Securities and Exchange Commission | [[our EDGAR filing agent or in-house EDGAR access]] | 5 items: the material aspects of the nature; the material impact or reasonably likely material impact on the registrant; a statement of any information called for that is not yet determined or is unavailable; it follows by amendment within four business days of being determined or becoming available… (see Report Content) | UT-05, UT-06 | DL-02 | Drafts: Legal, with Finance. Approves: Executive incident lead, with Legal; for a Form 8-K, the person or committee that determines materiality. Submits: Notification signatory with EDGAR access. | SEC Form 8-K Item 1.05 |
| RD-22 | NYDFS | Notice of a cybersecurity incident | Covered entities: persons operating under a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law | A determination that a cybersecurity incident has occurred at a covered entity, its affiliates or a third-party service provider. | The determination that a cybersecurity incident has occurred (CN-18) | As promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred | 72 | — | — | New York Department of Financial Services | [[the Department's electronic reporting portal and our account for it]] | 3 items: who we are; what happened and when we determined that a cybersecurity incident had occurred; the information the superintendent requests (see Report Content) | UT-07 | — | Drafts: Incident manager. Approves: Executive incident lead, with Legal. Submits: Notification signatory. | NYDFS § 500.17(a) |
| RD-23 | NYDFS | Notice of an extortion payment | Covered entities that make an extortion payment in connection with a cybersecurity event | An extortion payment made in connection with a cybersecurity event. | The extortion payment (CN-18) | Within 24 hours of the extortion payment | 24 | — | — | New York Department of Financial Services | [[the Department's electronic reporting portal and our account for it]] | 1 item: that an extortion payment was made in connection with a cybersecurity event (see Report Content) | UT-08 | — | Drafts: Incident manager. Approves: Executive incident lead, with Legal. Submits: Notification signatory. | NYDFS § 500.17(c) |
| RD-24 | NYDFS | Written description of why the payment was necessary | Covered entities that make an extortion payment in connection with a cybersecurity event | As RD-23: the written description follows the payment. | The extortion payment (CN-18) | Within 30 days of the extortion payment | — | 30 | — | New York Department of Financial Services | [[the Department's electronic reporting portal and our account for it]] | 4 items: the reasons the payment was necessary; the alternatives to payment that were considered; the diligence performed to find alternatives to payment… (see Report Content) | UT-08 | — | Drafts: Incident manager. Approves: Executive incident lead, with Legal. Submits: Notification signatory. | NYDFS § 500.17(c) |
| RD-25 | State law | Notice to residents of the State | Any organisation holding personal information of a State's residents; each State sets its own definition of personal information and its own test for a breach | A breach of the security of personal information of a State's residents, as that State defines it. | Discovery, or as the State counts (CN-19) | [[the deadline of each State where affected residents live, for example 30 days]] | — | — | — | Residents of each State whose personal information was involved | [[the State's required form of notice to residents]] | 2 items: the State's own content; whether notice was delayed for law enforcement (see Report Content) | UT-01 | DL-04 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | State breach notification law (examples) California Civil Code § 1798.82 |
| RD-26 | State law | Notice to the State attorney general or regulator | Organisations notifying residents of a State that requires it | As RD-25, where the State requires notice to its attorney general or regulator, often above a number of residents. | As the State counts (CN-19) | [[whether, when and above what number of residents each State requires it]] | — | — | — | State attorneys general and regulators | [[the State's online form or address]] | 1 item: the State's own content (see Report Content) | UT-09 | DL-04 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | State breach notification law (examples) New York General Business Law § 899-aa |
| RD-27 | State law | Notice to consumer reporting agencies | Organisations notifying more residents than a State's threshold | As RD-25, where the State requires notice to consumer reporting agencies, often above a number of residents. | As the State counts (CN-19) | [[where a State requires it, with its threshold]] | — | — | — | [[the consumer reporting agencies a State names]] | [[the agencies' contact points]] | 1 item: the State's own content (see Report Content) | UT-09 | DL-04 | Drafts: Privacy officer. Approves: Executive incident lead, with the privacy lead and Legal. Submits: Notification signatory. | State breach notification law (examples) New York General Business Law § 899-aa |
| RD-28 | FTC Safeguards | Notice to the Federal Trade Commission | Financial institutions under the FTC's jurisdiction, for the acquisition without authorisation of unencrypted customer information of at least 500 consumers | A notification event at a financial institution under the FTC's jurisdiction involving the unencrypted information of at least 500 consumers. | Discovery (CN-13) | As soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers | — | 30 | — | Federal Trade Commission | [[the Commission's electronic notification form]] | 6 items: the name and contact information of the reporting financial institution; a description of the types of information involved in the notification event; if possible to determine… (see Report Content) | UT-10 | — | Drafts: Legal. Approves: Executive incident lead, with Legal. Submits: Notification signatory. | FTC § 314.4(j) |
| RD-29 | FTC Health Breach | Notices under the Health Breach Notification Rule | Vendors of personal health records and PHR related entities, for a breach of security of unsecured PHR identifiable health information; not HIPAA covered entities, nor business associates acting as such. A third-party service provider owes the vendor or related entity a notice within the same 60 calendar days instead (16 CFR 318.3(b)) | A breach of security of unsecured identifiable health information held by a vendor of personal health records or a related entity that HIPAA does not cover. A third-party service provider notifies the vendor or related entity instead. | Discovery (CN-13) | Without unreasonable delay and in no case later than 60 calendar days after discovery: individuals, and for 500 or more residents of a State the media; the FTC at the same time for 500 or more individuals, or in an annual log for fewer | — | 60 | — | Individuals; prominent media outlets; the Federal Trade Commission | [[first-class mail or email to individuals; the media; the Commission's form]] | 5 items: a brief description of what happened; the types of unsecured identifiable health information involved; steps individuals should take to protect themselves from potential harm… (see Report Content) | UT-11 | DL-03 | Drafts: Legal. Approves: Executive incident lead, with Legal. Submits: Notification signatory. | FTC § 318.4 |
Report Content
What each US notice must contain, and the fact base fields that supply it (RN-11). The recipient's own form, where it has one, is what you fill in; State rows are placeholders.
| Duty ID | Report | Item | What the notice must contain | Fact base fields | Reference |
|---|---|---|---|---|---|
| RD-17 | HIPAA: notification to each individual affected | RD-17.1 | A brief description of what happened, including the date of the breach and the date of its discovery, if known | FB-03 What happened; FB-04 Key times; FB-20 Discovery | HIPAA § 164.404 |
| RD-17 | HIPAA: notification to each individual affected | RD-17.2 | The types of unsecured protected health information involved (for example full name, Social Security number, date of birth, home address, account number, diagnosis, disability code) | FB-22 Types of information | HIPAA § 164.404 |
| RD-17 | HIPAA: notification to each individual affected | RD-17.3 | Any steps individuals should take to protect themselves from potential harm | FB-13 Notices to others; FB-17 Likely consequences | HIPAA § 164.404 |
| RD-17 | HIPAA: notification to each individual affected | RD-17.4 | A brief description of what we are doing to investigate the breach, to mitigate harm to individuals and to protect against further breaches | FB-12 Measures taken | HIPAA § 164.404 |
| RD-17 | HIPAA: notification to each individual affected | RD-17.5 | Contact procedures for individuals to ask questions: a toll-free telephone number, an email address, a website or a postal address | FB-02 Contact point | HIPAA § 164.404 |
| RD-17 | HIPAA: notification to each individual affected | RD-17.6 | Plain language throughout; sent by first-class mail, or by email if the individual agreed to electronic notice | Written for this notice | HIPAA § 164.404 |
| RD-18 | HIPAA: notice to prominent media outlets | RD-18.1 | The same content as the notice to individuals (RD-17) | FB-03 What happened; FB-20 Discovery; FB-22 Types of information; FB-12 Measures taken; FB-02 Contact point | HIPAA § 164.406 |
| RD-19 | HIPAA: notice to the Secretary of Health and Human Services | RD-19.1 | Who we are and a contact who can answer the Department, in the way the portal asks | FB-01 Entity identification; FB-02 Contact point | HIPAA § 164.408 |
| RD-19 | HIPAA: notice to the Secretary of Health and Human Services | RD-19.2 | The number of individuals, and the date of the breach and of its discovery | FB-15 People affected; FB-21 People affected, by State; FB-04 Key times; FB-20 Discovery | HIPAA § 164.408 |
| RD-19 | HIPAA: notice to the Secretary of Health and Human Services | RD-19.3 | The types of information, what happened, the steps taken and whether individuals have been notified: as the portal's form asks (confirm the current form) | FB-22 Types of information; FB-03 What happened; FB-12 Measures taken; FB-14 Report history | HIPAA § 164.408 |
| RD-20 | HIPAA: notice by a business associate to the covered entity | RD-20.1 | The identification of each individual whose unsecured protected health information has been, or is reasonably believed to have been, accessed, acquired, used or disclosed | FB-15 People affected; FB-21 People affected, by State | HIPAA § 164.410 |
| RD-20 | HIPAA: notice by a business associate to the covered entity | RD-20.2 | Any other available information the covered entity must include in its notice to individuals, at the time or promptly afterwards as it becomes available | FB-03 What happened; FB-20 Discovery; FB-22 Types of information; FB-12 Measures taken; FB-02 Contact point | HIPAA § 164.410 |
| RD-21 | SEC: current report on Form 8-K, Item 1.05 | RD-21.1 | The material aspects of the nature, scope and timing of the incident | FB-03 What happened; FB-04 Key times; FB-08 Systems and data affected; FB-20 Discovery | SEC Form 8-K Item 1.05 |
| RD-21 | SEC: current report on Form 8-K, Item 1.05 | RD-21.2 | The material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations | FB-23 Materiality; FB-19 Economic impact; FB-05 Services affected | SEC Form 8-K Item 1.05 |
| RD-21 | SEC: current report on Form 8-K, Item 1.05 | RD-21.3 | A statement of any information called for that is not yet determined or is unavailable; it follows by amendment within four business days of being determined or becoming available | FB-23 Materiality | SEC Form 8-K Item 1.05 |
| RD-21 | SEC: current report on Form 8-K, Item 1.05 | RD-21.4 | Nothing specific or technical about the planned response, systems, networks, devices or vulnerabilities in such detail as would impede the response or remediation | Written for this notice | SEC Form 8-K Item 1.05 |
| RD-21 | SEC: current report on Form 8-K, Item 1.05 | RD-21.5 | The information in an Interactive Data File (Inline XBRL), as the filing requires | Written for this notice | SEC Form 8-K Item 1.05 |
| RD-22 | NYDFS: notice of a cybersecurity incident | RD-22.1 | Who we are, the form of notice the Department directs, and a contact | FB-01 Entity identification; FB-02 Contact point | NYDFS § 500.17(a) |
| RD-22 | NYDFS: notice of a cybersecurity incident | RD-22.2 | What happened and when we determined that a cybersecurity incident had occurred, and which limb of the definition it meets | FB-03 What happened; FB-04 Key times; FB-24 Determination of a cybersecurity incident | NYDFS § 500.1 |
| RD-22 | NYDFS: notice of a cybersecurity incident | RD-22.3 | The information the Superintendent requests, and updates on material changes | FB-14 Report history; FB-12 Measures taken; FB-05 Services affected | NYDFS § 500.17(a) |
| RD-23 | NYDFS: notice of an extortion payment | RD-23.1 | That an extortion payment was made in connection with a cybersecurity event, and when | FB-25 Extortion payment | NYDFS § 500.17(c) |
| RD-24 | NYDFS: written description of why the payment was necessary | RD-24.1 | The reasons the payment was necessary | FB-25 Extortion payment | NYDFS § 500.17(c) |
| RD-24 | NYDFS: written description of why the payment was necessary | RD-24.2 | The alternatives to payment that were considered | FB-25 Extortion payment | NYDFS § 500.17(c) |
| RD-24 | NYDFS: written description of why the payment was necessary | RD-24.3 | The diligence performed to find alternatives to payment | FB-25 Extortion payment | NYDFS § 500.17(c) |
| RD-24 | NYDFS: written description of why the payment was necessary | RD-24.4 | The diligence performed to ensure compliance with applicable rules and regulations, including those of the Office of Foreign Assets Control | FB-25 Extortion payment | NYDFS § 500.17(c) |
| RD-25 | State law: notice to residents of the State | RD-25.1 | [[The content the State's law requires: typically what happened, the types of information, steps the person can take, our contact, and any State-specific items]] | FB-03 What happened; FB-20 Discovery; FB-22 Types of information; FB-12 Measures taken; FB-02 Contact point | State breach notification law (examples) New York General Business Law § 899-aa |
| RD-25 | State law: notice to residents of the State | RD-25.2 | Whether notice was delayed for law enforcement, and by whom (RN-20) | FB-26 Law-enforcement or Attorney General request | State breach notification law (examples) California Civil Code § 1798.82 |
| RD-26 | State law: notice to the State attorney general or regulator | RD-26.1 | [[The content the State asks for: often a sample copy of the notice sent to residents, the number of residents and the date notified]] | FB-21 People affected, by State; FB-14 Report history; FB-03 What happened | State breach notification law (examples) California Civil Code § 1798.82 |
| RD-27 | State law: notice to consumer reporting agencies | RD-27.1 | [[The content the State asks for: often the timing, distribution and number of notices]] | FB-21 People affected, by State; FB-14 Report history | State breach notification law (examples) New York General Business Law § 899-aa |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.1 | The name and contact information of the reporting financial institution | FB-01 Entity identification; FB-02 Contact point | FTC § 314.4(j) |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.2 | A description of the types of information involved in the notification event | FB-22 Types of information | FTC § 314.4(j) |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.3 | If possible to determine, the date or date range of the notification event | FB-04 Key times; FB-20 Discovery | FTC § 314.4(j) |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.4 | The number of consumers affected or potentially affected | FB-15 People affected; FB-21 People affected, by State | FTC § 314.4(j) |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.5 | A general description of the notification event | FB-03 What happened | FTC § 314.4(j) |
| RD-28 | FTC Safeguards: notice to the Federal Trade Commission | RD-28.6 | Whether a law enforcement official has determined in writing that public notice would impede a criminal investigation or harm national security, and a way for the Commission to contact that official | FB-26 Law-enforcement or Attorney General request | FTC § 314.4(j) |
| RD-29 | FTC Health Breach: notices under the Health Breach Notification Rule | RD-29.1 | A brief description of what happened, including the dates of the breach and of its discovery and any third parties that acquired the information, if known | FB-03 What happened; FB-04 Key times; FB-20 Discovery | FTC § 318.6 |
| RD-29 | FTC Health Breach: notices under the Health Breach Notification Rule | RD-29.2 | The types of unsecured identifiable health information involved | FB-22 Types of information | FTC § 318.6 |
| RD-29 | FTC Health Breach: notices under the Health Breach Notification Rule | RD-29.3 | Steps individuals should take to protect themselves from potential harm | FB-13 Notices to others; FB-17 Likely consequences | FTC § 318.6 |
| RD-29 | FTC Health Breach: notices under the Health Breach Notification Rule | RD-29.4 | What we are doing to investigate, mitigate harm, prevent further breaches and protect those affected | FB-12 Measures taken | FTC § 318.6 |
| RD-29 | FTC Health Breach: notices under the Health Breach Notification Rule | RD-29.5 | Contact procedures, with at least two of: a toll-free number, an email address, a website, an option within the application, a postal address | FB-02 Contact point | FTC § 318.6 |
The fact base: the one record every notice is drafted from (RN-11). FB-01 to FB-19 are the pack's; FB-20 to FB-26 are the US additions
| Field ID | Field | What to record | Content items using it (calc) | |
|---|---|---|---|---|
| FB-01 | Entity identification | Legal name, registration or identifier numbers each authority uses, sector and the services in scope. Kept ready in the applicability profile. | 3 | |
| FB-02 | Contact point | The person the authority or individuals can reach at any hour: name, role, telephone and email. For the GDPR, the Data Protection Officer. | 8 | |
| FB-03 | What happened | A plain description: what was seen, what was affected, what the attacker or fault did, as far as known. | 10 | |
| FB-04 | Key times | Occurrence (if known), detection, declaration (awareness), DORA classification where it applies, containment, recovery. | 6 | |
| FB-05 | Services affected | Which services, for whom, how badly and for how long: stopped, degraded, at risk. | 2 | |
| FB-06 | Severity and impact | P09 severity and the impact on each P05 area; for DORA, the duration and service downtime. | 0 | |
| FB-07 | Geography | Member States where services, customers or data are affected; whether there is or could be a cross-border impact. | 0 | |
| FB-08 | Systems and data affected | Systems, sites and data sets involved, and the security property affected (availability, integrity, confidentiality, authenticity). | 1 | |
| FB-09 | Suspected cause | Whether unlawful or malicious acts are suspected, and the type of threat (ransomware, account takeover, fault, supplier failure). | 0 | |
| FB-10 | Root cause | The cause established by the investigation, and the route in. Left as "under investigation" until known. | 0 | |
| FB-11 | Indicators of compromise | File hashes, addresses, domains, accounts and techniques seen, where they can be shared. | 0 | |
| FB-12 | Measures taken | Containment, eradication, recovery and mitigation done and planned, with times; whether continuity plans were activated. | 7 | |
| FB-13 | Notices to others | Customers, clients, individuals and suppliers told, when and how, and what we advised them to do. | 2 | |
| FB-14 | Report history | Each report made: regime, stage, time, channel and the authority's reference. | 4 | |
| FB-15 | People affected | Categories and approximate numbers of people (customers, staff, clients) affected. | 3 | |
| FB-16 | Personal data affected | Categories and approximate numbers of personal data records, with any special category or criminal offence data marked. | 0 | |
| FB-17 | Likely consequences | What could happen to the people affected (fraud, distress, loss of control of their data, discrimination) and how likely it is. | 2 | |
| FB-18 | Classification result | The DORA criteria and thresholds met, and the NIS2 indicators met, from the decision record. | 0 | |
| FB-19 | Economic impact | Direct and indirect costs and losses, gross and after recoveries, as far as known. | 1 | |
| FB-20 | Discovery | The time anyone first knew, or with reasonable diligence would have known, and who knew first (P09 IM-13). The date of the breach, if different, and the date of discovery are both stated in a HIPAA notice. | 8 | |
| FB-21 | People affected, by State | The number of individuals, and the number who live in each State or jurisdiction. HIPAA's media notice turns on more than 500 in one State; each State's law turns on its own residents. | 5 | |
| FB-22 | Types of information | Which identifiers and kinds of information were involved (name, Social Security number, date of birth, address, account or member number, diagnosis, treatment, claims, disability code), and whether each was encrypted and whether the key was reached. | 7 | |
| FB-23 | Materiality | For a registrant: the materiality determination (outcome, time, who made it and the reasons), the nature, scope and timing of the incident, and its material or reasonably likely material impact on financial condition and results of operations. | 2 | |
| FB-24 | Determination of a cybersecurity incident | For a New York covered entity: the time we determined that a cybersecurity incident had occurred, and which limb of the regulation's definition it meets. | 1 | |
| FB-25 | Extortion payment | Whether a payment was made, when, how much and to whom; the reasons it was necessary; the alternatives considered; the diligence done to find alternatives; the diligence done to ensure compliance with applicable rules, including sanctions checks; who decided. | 5 | |
| FB-26 | Law-enforcement or Attorney General request | Any request to delay a notice: who made it, when, in what form (written or oral) and for how long (P18 RN-20). | 2 | |
Clock Rules
How each US clock is counted (CN-13 to CN-20), the rules the US duties add (RN-19 to RN-22), and the facts that delay a notice (DL-01 to DL-04, P09's).
| ID | Rule or note | Duties |
|---|---|---|
| CN-13 | HIPAA and the FTC's Health Breach Notification Rule count from discovery, not from awareness: the first day the breach is known, or with reasonable diligence would have been known, to anyone in the workforce or any agent other than the person who committed it. The Safeguards Rule has no reasonable-diligence limb: its event is discovered on the first day it is known to the institution or to any employee, officer or agent other than the person committing the breach (16 CFR 314.4(j)(2)). State laws count as each State says (CN-19). The case log records the discovery time beside the declaration time (P09 IM-13), and these clocks run from the earlier. The test differs a little by rule: a business associate's own discovery is known to it or any of its employees, officers or agents (45 CFR 164.410(a)(2)). | |
| CN-14 | HIPAA's 60 calendar days (RD-17, RD-18, RD-19, RD-20) are the outer limit of "without unreasonable delay", not a target. A notice made on day 59 without a reason for the wait can still be late. | |
| CN-15 | HIPAA, the Secretary: for 500 or more individuals the notice goes with the notice to individuals; for fewer than 500 the breach is logged and reported within 60 days after the end of the calendar year in which it was discovered (RD-19). | |
| CN-16 | The SEC's four business days (RD-21) start at the materiality determination, not at discovery. Weekends and days the Commission is closed are not counted. If the determination is made on one, the four business day period begins to run on, and includes, the first business day thereafter (Form 8-K General Instruction B.1): a determination on a Saturday makes Monday day one, and Thursday day four, if none of those days is a holiday. A Form 8-K whose transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so the last safe time is 5:30 p.m. Eastern on the fourth business day. A report that leaves information out is amended within four business days of that information being determined or becoming available. | |
| CN-17 | The materiality determination has its own clock: it is made without unreasonable delay after discovery (Item 1.05, Instruction 1). A determination that is slow on purpose to postpone the filing can be treated as a failure to make it without unreasonable delay, and is not a way to gain days. The SEC Chairman asked for public comment on Regulation S-K on 13 January 2026, industry groups have asked the SEC to rescind Item 1.05, and no SEC proposal had been found on 20 October 2026: check sec.gov for its current status. | |
| CN-18 | New York's 72 hours (RD-22) run from determining that a cybersecurity incident has occurred, as the regulation defines one. An extortion payment starts two more clocks: notice within 24 hours (RD-23) and a written description within 30 days (RD-24). | |
| CN-19 | State laws (RD-25 to RD-27) are placeholders in this pack. Where residents of several States are affected each State's law is read separately, and the plan is made to the earliest deadline among them. | |
| CN-20 | Law-enforcement and Attorney General delays (DL-01 to DL-04 in P09) move a deadline only as the rule says, in the form it requires, and are recorded when they are stated. | |
| RN-19 | The materiality determination for a registrant must be made, and recorded with its time and reasons, without unreasonable delay after discovery, by the person or committee the applicability profile names. It must never be delayed to avoid or postpone the Form 8-K. While it is not made, each P09 update records why and when it will be made. | |
| RN-20 | A delay to a US notice for law enforcement or the Attorney General must be accepted only in the form the rule requires, and recorded in the log with who stated it, when, in what form and for how long. An oral request is documented at once and followed up for a written statement. | |
| RN-21 | The time of discovery must be recorded in the log for every incident (P09 IM-13), and the US clocks must be set from it. Where discovery came before declaration, the log says who knew first and what they knew. | |
| RN-22 | Each US duty must be decided, drafted, approved, submitted and logged on its own clock from the one fact base (RN-11). No notice under one regime is treated as satisfying another, and a notice to one body never waits for a notice to another. | |
| DL-01 | HIPAA: If a law enforcement official states that notice would impede a criminal investigation or damage national security: a written statement that names a period delays the notice for that period; an oral statement is documented, with the identity of the official, and delays the notice for no longer than 30 days from the date of the oral statement, unless a written statement arrives in that time. | RD-17, RD-18, RD-19, RD-20 |
| DL-02 | SEC: If the United States Attorney General determines that disclosure poses a substantial risk to national security or public safety and tells the Commission in writing: the company may delay for the period the Attorney General specifies, up to 30 days; for up to 30 more days if the Attorney General repeats the determination; and in extraordinary circumstances for up to 60 more, where the risk is to national security; any later delay only by Commission exemptive order. A registrant that is subject to the FCC's breach notification rule (47 CFR 64.2011) and is required to delay under it may delay for the period that rule applies, and no more than seven business days after its notice, if it tells the Commission by correspondence on EDGAR by the original due date (Item 1.05(d)). | RD-21 |
| DL-03 | FTC Health Breach: The Rule has its own law-enforcement exception to the 60 calendar days. | RD-29 |
| DL-04 | State law: [[Each State's law-enforcement delay and its other extensions, which each State sets for itself]] | RD-25, RD-26, RD-27 |
Holidays
Days the SEC is closed, besides Saturdays and Sundays. The Form 8-K clock (RD-21) counts business days and skips these. The EXAMPLE rows are US federal holidays from September 2026 to February 2027: check them against the SEC's calendar and add the later ones. A holiday that falls on a Saturday is observed on the Friday before and one on a Sunday on the Monday after: add the observed day, and any day the Commission closes by order. The calculators flag a determination dated after the last day listed.
| Day the SEC is closed | Name |
|---|---|
| 7 Sep 2026 | Labor Day |
| 12 Oct 2026 | Columbus Day |
| 11 Nov 2026 | Veterans Day |
| 26 Nov 2026 | Thanksgiving Day |
| 25 Dec 2026 | Christmas Day |
| 1 Jan 2027 | New Year's Day |
| 18 Jan 2027 | Birthday of Martin Luther King, Jr. |
| 15 Feb 2027 | Washington's Birthday |
Clock Calculator
One row per incident. Enter the yellow cells; every due time calculates from the clocks in the Timeline Matrix. A blank means that duty does not apply on the answers given. The Form 8-K deadline skips weekends and the Holidays sheet. A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so its deadline is 5:30 p.m. Eastern time on the fourth business day. Enter the times for this duty in Eastern time. A determination after the last day on the Holidays sheet is flagged in the Check column.
A calendar-day deadline falls due at the end of its last day, and the Form 8-K deadline at 17:30 Eastern time on its last business day (a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed the next business day, 17 CFR 232.13(a)(2)). For fewer than 500 individuals, the notice to the Secretary is due 60 days after the end of the calendar year of discovery (CN-15).
| Example | Case ID | Discovered at | HIPAA role | HIPAA: breach of unsecured protected health information? | Individuals affected (all States) | Residents of the State with the most | SEC: material incident? | SEC: materiality determined at | New York: cybersecurity incident determined? | New York: determined at | New York: extortion payment made at | FTC Safeguards Rule: 500 or more consumers? | FTC Health Breach Notification Rule applies? | State law: days allowed | RD-17 HIPAA: notification to each individual affected due | RD-18 HIPAA: notice to prominent media outlets due | RD-19 HIPAA: notice to the secretary of health and human services due | RD-20 HIPAA: notice by a business associate to the covered entity due | RD-21 SEC: current report on form 8-k, item 1.05 due | RD-22 NYDFS: notice of a cybersecurity incident due | RD-23 NYDFS: notice of an extortion payment due | RD-24 NYDFS: written description of why the payment was necessary due | RD-25 State law: notice to residents of the state due | RD-28 FTC Safeguards: notice to the federal trade commission due | RD-29 FTC Health Breach: notices under the health breach notification rule due | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-021 | 14 Sep 2026 | Covered entity | Yes | 3200 | 640 | Yes | 24 Sep 2026 | Yes | 15 Sep 2026 | No | No | 13 Nov 2026 | 13 Nov 2026 | 13 Nov 2026 | 30 Sep 2026 | 18 Sep 2026 | OK | ||||||||
| EXAMPLE | INC-2026-022 | 22 Sep 2026 | Business associate | Yes | 480 | 480 | No | No | No | No | 21 Nov 2026 | OK | ||||||||||||||
| EXAMPLE | INC-2026-023 | 26 Sep 2026 | Covered entity | No | No | Yes | 26 Sep 2026 | 26 Sep 2026 | No | No | 29 Sep 2026 | 27 Sep 2026 | 26 Oct 2026 | OK |
EXAMPLE
EXAMPLE: the US organisation's profile, decisions and reports
EXAMPLE: Example Health Group, Inc. (EXAMPLE), a US health services company that runs a health plan and a network of outpatient clinics, with about 2,800 staff and members in several States. Assumptions: It is a HIPAA covered entity, and for one service also a business associate of other covered entities. Its shares are listed on a US exchange, so the SEC's rules for current reports apply to it. A private company reads the SEC rows as not applying. It holds a licence under the New York Insurance Law, so the Department of Financial Services' cybersecurity regulation applies. An organisation with no such licence reads those rows as not applying. It has members who live in California and New York, so those two States' laws are the examples; every other State has its own law. It is not a financial institution under the FTC's jurisdiction, so the FTC Safeguards Rule is not part of the example.
Its applicability profile (RN-01): where each notice goes
| Regime | Applies? | Role | Authority | Channel | State law or shorter clock | Duties |
|---|---|---|---|---|---|---|
| HIPAA | Applies | Covered entity (a health plan and clinics); a business associate for its analytics service | Secretary of Health and Human Services (Office for Civil Rights) | [[the Department of Health and Human Services' breach reporting portal]] | — | RD-17, RD-18, RD-19, RD-20 |
| SEC | Applies | Registrant (shares listed on a US exchange); materiality determined by the disclosure committee | Securities and Exchange Commission | [[our EDGAR filing agent or in-house EDGAR access]] | — | RD-21 |
| NYDFS | Applies | Covered entity (licensed under the New York Insurance Law) | New York Department of Financial Services | [[the Department's electronic reporting portal and our account for it]] | — | RD-22, RD-23, RD-24 |
| State law | Applies | Members live in California and New York; other States are read when an incident reaches them | State attorneys general and regulators | [[the State's online form or address]] | California Civil Code 1798.82 and New York General Business Law 899-aa, read as examples | RD-25, RD-26, RD-27 |
| FTC | Does not apply | Not a financial institution under the FTC's jurisdiction and not a vendor of personal health records | — | — | — | RD-28, RD-29 |
INC-2026-021: one incident, several clocks
Patient portal database read through a stolen administrator credential. A security analyst saw unusual queries against the patient portal database on the afternoon of 14 September and logged an event. The incident manager declared an incident the next morning, when the queries were tied to a stolen administrator credential. 3,200 members' names, dates of birth, member numbers and claims details were read, 640 of them California residents.
| Duty | Report | Due | Made | Result | What happened | |||
|---|---|---|---|---|---|---|---|---|
| RD-22 | NYDFS notice of a cybersecurity incident | 18 Sep 2026, 09:10 | 17 Sep 2026, 15:30 | On time | Information Security Manager. Electronic notice to the Superintendent, 17 hours 25 minutes before the 72-hour limit (18 Sep, 09:10). | |||
| RD-17 | HIPAA notification to each individual affected | end of 13 Nov 2026 | 28 Sep 2026, 10:00 | On time | Privacy officer. First-class mail to 3,200 members; substitute notice for the 14 whose addresses were out of date. | |||
| RD-18 | HIPAA notice to prominent media outlets | end of 13 Nov 2026 | 28 Sep 2026, 10:00 | On time | Communications lead. Statement to prominent media in California, where 640 residents are involved. | |||
| RD-19 | HIPAA notice to the secretary of health and human services | end of 13 Nov 2026 | 28 Sep 2026, 10:30 | On time | Privacy officer. Contemporaneous with the notice to individuals: 500 or more. | |||
| RD-21 | SEC current report on form 8-k, item 1.05 | 5:30 p.m. Eastern on 30 Sep 2026 | 29 Sep 2026, 16:20 | On time | Legal, with EDGAR access. Filed one business day before the limit; amendment expected when the count of affected members is final. | |||
The HIPAA clocks ran from discovery on 14 Sep, a day before the incident was declared. The SEC clock ran from the materiality determination on 24 Sep; New York's 72 hours from the determination at declaration.
Its decisions on the three incidents (RN-02, RN-19)
| Decision | Incident and regime | Recorded | Outcome | Decided by | Revisit or replaces | Reasons and facts relied on | ||
|---|---|---|---|---|---|---|---|---|
| USD-2026-001 | INC-2026-021: HIPAA | 15 Sep 2026, 13:10 | Reportable | Executive incident lead | — | Names, dates of birth, member numbers and claims details of 3,200 members read through a stolen credential. Four factors: direct identifiers (HF-01); an attacker who is not bound by HIPAA (HF-02); queries show the data was actually read (HF-03); no mitigation is possible (HF-04). No exclusion applies. 640 residents of California, so the media notice is also due (RD-18). Discovery: 14 Sep, 16:40. | ||
| USD-2026-002 | INC-2026-021: SEC | 15 Sep 2026, 13:10 | Not settled | Executive incident lead | Revisit by 17 Sep 2026, 10:00 | Materiality cannot yet be assessed: the number of members, the cost of the response and any effect on operations are still being established. Revisit at each update; the disclosure committee meets on 17 Sep (RN-19). | ||
| USD-2026-003 | INC-2026-021: SEC | 24 Sep 2026, 14:00 | Reportable | Disclosure committee | Replaces USD-2026-002 | The disclosure committee determined the incident material: the claims details of 3,200 members, a regulatory investigation likely, and a response cost that a reasonable shareholder would consider important. Form 8-K Item 1.05 is due within four business days (RD-21). | ||
| USD-2026-004 | INC-2026-021: NYDFS | 15 Sep 2026, 12:30 | Reportable | Executive incident lead | — | A cybersecurity incident, determined at 09:10: it requires us to notify a government body, self-regulatory agency or any other supervisory body (the Secretary, RD-19), which meets the first limb of the definition. 72 hours run from 09:10 on 15 Sep (RD-22). No extortion payment. | ||
| USD-2026-005 | INC-2026-021: State law | 15 Sep 2026, 13:10 | Reportable | Executive incident lead | — | Members who live in California (640) and New York are involved and the data is personal information as both States define it. Each State is read separately: California and New York are the examples (RD-25, RD-26). | ||
| USD-2026-006 | INC-2026-021: FTC | 15 Sep 2026, 13:10 | Not applicable | Executive incident lead | — | Not a financial institution under the FTC's jurisdiction and not a vendor of personal health records (applicability profile). | ||
| USD-2026-007 | INC-2026-022: HIPAA | 22 Sep 2026, 13:30 | Reportable | Executive incident lead | — | We are the business associate. 480 individuals' records went to a second customer, who opened the file. No exclusion applies, and the recipient is not bound by the first customer's agreement. We tell the covered entity (RD-20); it decides on notice to the individuals. | ||
| USD-2026-008 | INC-2026-022: SEC | 22 Sep 2026, 14:00 | Not reportable | Disclosure committee | — | The disclosure committee determined the incident not material: 480 records, no effect on operations and one customer's contract. Revisited at the next update. | ||
| USD-2026-009 | INC-2026-022: NYDFS | 22 Sep 2026, 14:00 | Not reportable | Executive incident lead | — | No requirement for us to notify a government body, self-regulatory agency or other supervisory body arises (the covered-entity customer holds the HIPAA duty), no material harm to operations, no ransomware: not a cybersecurity incident as the regulation defines one. | ||
| USD-2026-010 | INC-2026-022: State law | 22 Sep 2026, 14:00 | Not settled | Executive incident lead | Revisit by 24 Sep 2026, 10:00 | The covered-entity customer is the data owner and may carry the State-law duty; check the agreement's allocation. Revisit by 24 Sep. | ||
| USD-2026-011 | INC-2026-022: FTC | 22 Sep 2026, 14:00 | Not applicable | Executive incident lead | — | Applicability profile. | ||
| USD-2026-012 | INC-2026-023: NYDFS | 26 Sep 2026, 10:00 | Reportable | Executive incident lead | — | Ransomware deployed within a material part of the information systems: a cybersecurity incident, determined at 09:00 (RD-22). If the board decides on a payment, after legal advice and a sanctions check, the payment opens RD-23 (24 hours) and RD-24 (30 days). | ||
| USD-2026-013 | INC-2026-023: HIPAA | 26 Sep 2026, 10:00 | Not applicable | Executive incident lead | — | The finance and payroll system holds no protected health information. | ||
Lists
| YesNo | UsRegime | HipaaRole |
|---|---|---|
| Yes | HIPAA | Covered entity |
| No | SEC | Business associate |
| NYDFS | Neither |
State law
FTC Safeguards
FTC Health Breach
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Discovery | The first day a breach is known, or with reasonable diligence would have been known, to anyone in the workforce or any agent other than the person who committed it (45 CFR 164.404(a)(2)). The HIPAA, FTC and State clocks run from it (CN-13). |
| Materiality determination | A registrant's decision, made without unreasonable delay after discovery, that an incident is material. The four business days of Form 8-K Item 1.05 run from it (RN-19). |
| Registrant | A company that files reports with the SEC under the Securities Exchange Act of 1934; in this pack, a listed company. |
| Covered entity, business associate | Under HIPAA: a health plan, a health care clearinghouse or most health care providers; and a person or organisation that handles protected health information for a covered entity or provides certain services to it. |
| Unsecured protected health information | Protected health information not made unusable, unreadable or indecipherable to unauthorised people by a method the Secretary of Health and Human Services specifies in guidance (45 CFR 164.402). |
| Business day | A day the SEC is open for business. If the event is on a Saturday, Sunday or a day the Commission is closed, the count begins on, and includes, the first business day after (Form 8-K, General Instruction B.1). |
| Cybersecurity incident (New York) | A cybersecurity event at the covered entity, its affiliates or a third-party service provider that impacts the covered entity and requires it to notify any government body, self-regulatory agency or any other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or results in ransomware being deployed within a material part of its information systems (23 NYCRR 500.1). |
| RD-17 to RD-29 | P09's US reporting duties, each with its deadline and recipient, from the Incident Classification, Severity & Escalation Matrix. |
| CN-13 to CN-20, RN-19 to RN-22 | The clock notes and rules on the Clock Rules sheet. |
| DL-01 to DL-04 | P09's delays: facts that move a US deadline, recorded when stated. |
| FB-01 to FB-26 | The fields of the fact base, on the Report Content sheet. |
| UT-01 to UT-11 | The templates in the US Notification Templates (HIPAA, SEC Form 8-K, NYDFS, State Attorney General). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: Example Health Group, Inc. (EXAMPLE), as at 2026-09-30. Delete before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.5 — Contact with authorities | Recipient and Channel columns, and the EXAMPLE profile: the authorities to contact, kept current |
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The matrix as a whole: each legal and regulatory reporting requirement, with its trigger, deadline and content |
| NIST CSF 2.0 | RS.CO-02 — “Internal and external stakeholders are notified of incidents” | Timeline Matrix and Clock Calculator: authorities, individuals and the market notified of incidents on time |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.402 — a breach is the acquisition, access, use or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises its security or privacy; it is presumed to be a breach unless a risk assessment of at least four factors (the information and the likelihood of re-identification, the person who used or received it, whether it was actually acquired or viewed, and how far the risk has been mitigated) shows a low probability that it has been compromised; three exclusions apply; unsecured protected health information is information not made unusable, unreadable or indecipherable by the Secretary's guidance | The HIPAA screen question and DS-12: the presumption of breach, the four factors and the exclusions |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.404 — a covered entity notifies each affected individual without unreasonable delay and no later than 60 calendar days after discovery; a breach is treated as discovered on the first day it is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who committed it; the notice says what happened, what information was involved, what individuals should do, what the entity is doing, and how to ask questions, in plain language | RD-17 row, content and calculator: 60 calendar days from discovery; the definition of discovery (CN-13) |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.406 — for a breach involving more than 500 residents of a State or jurisdiction, a covered entity notifies prominent media outlets serving that State or jurisdiction, within the same 60 calendar days and with the content of § 164.404(c) | RD-18 row and calculator: media notice above 500 residents of one State |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.408 — a covered entity notifies the Secretary of Health and Human Services: for 500 or more individuals contemporaneously with the notice to individuals; for fewer than 500, it keeps a log and notifies not later than 60 days after the end of each calendar year, for breaches discovered in the year before | RD-19 row and calculator: the Secretary, with the individuals for 500 or more, or by the 60th day after the calendar year for fewer (CN-15) |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.410 — a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery (a breach is treated as discovered when known to the business associate or to any employee, officer or other agent of it, § 164.410(a)(2)), identifying each individual affected and giving the information the covered entity needs for its own notices | RD-20 row and calculator: the business associate's notice to the covered entity |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.412 — if a law enforcement official states that notice would impede a criminal investigation or damage national security, the notice is delayed for the time a written statement specifies, or, for an oral statement that is documented, for no longer than 30 days unless a written statement follows | DL-01: the law-enforcement delay |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.414 — the covered entity applies the administrative requirements of § 164.530, which include keeping the documentation for six years from its creation or the date it last was in effect (§ 164.530(j)), and bears the burden of showing that all notifications were made or that the use or disclosure was not a breach | RN-20 and the documentation: the burden of showing that all notices were made |
| SEC — Regulation S-K and Form 8-K | Form 8-K Item 1.05 — a registrant that experiences a cybersecurity incident it determines to be material describes the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact, within four business days after the determination; the determination is made without unreasonable delay after discovery; information not yet determined is filed by amendment within four business days after it is determined or becomes available | RD-21 row, content and calculator: four business days from the materiality determination (CN-16, CN-17) |
| SEC — Regulation S-K and Form 8-K | Form 8-K Item 1.05(c) — the United States Attorney General may determine, in writing to the Commission, that disclosure poses a substantial risk to national security or public safety; the registrant may then delay for the period specified, up to 30 days, a further 30 days, and in extraordinary circumstances a final 60 days; further delay only by Commission exemptive order | DL-02: the Attorney General's delay |
| SEC — Regulation S-K and Form 8-K | Form 8-K General Instruction B.1 — a report is due within four business days after the event; if the event occurs on a Saturday, Sunday or a day the Commission is closed, the four business days begin on, and include, the first business day after | The calculator and the Holidays sheet: the business-day count |
| SEC — Regulation S-K and Form 8-K | Regulation S-K Item 106, reported in Form 10-K Item 1C — an annual description of how the registrant assesses, identifies and manages material risks from cybersecurity threats, the board's oversight of those risks and management's role | Instructions: Item 106 disclosure stays consistent with what the filing says |
| NYDFS — 23 NYCRR Part 500 | § 500.1 — a covered entity is any person operating under or required to operate under a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law; a cybersecurity incident is a cybersecurity event at the covered entity, its affiliates or a third-party service provider that impacts the covered entity and requires it to notify any government body, self-regulatory agency or any other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or results in ransomware being deployed within a material part of its information systems | RD-22 row and the New York screen question: who is covered and what a cybersecurity incident is |
| NYDFS — 23 NYCRR Part 500 | § 500.17(a) — notify the Superintendent electronically as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider, and provide requested information and updates promptly | RD-22 row and calculator: 72 hours from the determination (CN-18) |
| NYDFS — 23 NYCRR Part 500 | § 500.17(b) — each year, by 15 April, submit either a certification of material compliance for the previous calendar year or an acknowledgment of material noncompliance, signed by the highest-ranking executive and the chief information security officer | Instructions: the annual 15 April submission is outside the incident workbook |
| NYDFS — 23 NYCRR Part 500 | § 500.17(c) — notify the Superintendent within 24 hours of an extortion payment made in connection with a cybersecurity event, and within 30 days give a written description of the reasons the payment was necessary, the alternatives considered, the diligence performed to find alternatives, and the diligence performed to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control | RD-23 and RD-24 rows, content and calculator: 24 hours and 30 days from the extortion payment |
| FTC — Safeguards Rule, 16 CFR Part 314 | § 314.2 — a notification event is the acquisition of unencrypted customer information without the authorisation of the individual; unauthorised access is presumed to be acquisition unless there is reliable evidence that there was none; information is treated as unencrypted if the encryption key was accessed by an unauthorised person | RD-28: what a notification event is |
| FTC — Safeguards Rule, 16 CFR Part 314 | § 314.4(j) — notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers; the notice gives the institution's contact details, the types of information, the date or date range, the number of consumers, a general description, and whether a law enforcement official has determined that public notice would impede an investigation or harm national security | RD-28 row, content and calculator: 30 days from discovery, 500 or more consumers |
| FTC — Health Breach Notification Rule, 16 CFR Part 318 | § 318.3 — vendors of personal health records and PHR related entities notify each affected individual, the Federal Trade Commission, and for 500 or more residents of a State or jurisdiction prominent media outlets, following discovery of a breach of security; a breach is treated as discovered on the first day it is known, or reasonably should have been known, to the entity, counting what any employee, officer or agent other than the person who committed it knows | RD-29 row and content: who notifies whom, and discovery |
| FTC — Health Breach Notification Rule, 16 CFR Part 318 | § 318.4 — notices are sent without unreasonable delay and in no case later than 60 calendar days after discovery; notice to the Federal Trade Commission is contemporaneous for 500 or more individuals and may be sent annually, no later than 60 calendar days after the end of the calendar year, for fewer than 500; the Rule has a law-enforcement exception | RD-29 row and calculator: 60 calendar days; the annual log for fewer than 500 |
| FTC — Health Breach Notification Rule, 16 CFR Part 318 | § 318.5 — the methods of notice: written notice to individuals (email only if the individual chose it), substitute notice where contact details for ten or more individuals are out of date, notice to media for 500 or more residents of a State, and notice to the Commission in the way its website sets out | RD-29: the methods of notice |
| FTC — Health Breach Notification Rule, 16 CFR Part 318 | § 318.6 — what the notice says: what happened, with the dates of the breach and of its discovery and any third parties that acquired the information; the types of unsecured identifiable health information involved; the steps individuals should take; what the entity is doing; and contact procedures with at least two of a toll-free number, an email address, a website, an option within the application and a postal address | RD-29 content: what the notice says |
| State breach notification law (examples) | New York General Business Law § 899-aa — notice to affected New York residents within 30 days after the breach was discovered; the person or business also notifies the State attorney general, the department of state and the division of state police, and the department of financial services if it is a covered entity under 23 NYCRR 500.1; a HIPAA covered entity that notifies the Secretary of Health and Human Services also notifies the attorney general within five business days of doing so; where more than 5,000 New York residents are notified at one time, the consumer reporting agencies are notified too. This is one State's rule, given as an example; every other State has its own | RD-25 to RD-27 rows: one State's rule, as an example (CN-19) |
| State breach notification law (examples) | California Civil Code § 1798.82 — notice to affected California residents within 30 calendar days of discovery or notification of the breach, with extensions for law enforcement needs and to determine the scope of the breach; for a breach affecting more than 500 California residents, a sample copy of the notice to the Attorney General within 15 calendar days of notifying residents. Read on 20 October 2026 in the Legislature's chaptered text of SB 446 (Chapter 319, Statutes of 2025, approved 3 October 2025); this section as amended takes effect on 1 January 2026, as California statutes do unless they say otherwise. Confirm the current text. This is one State's rule, given as an example; every other State has its own | RD-25 and RD-26 rows: a second State's rule, as an example (CN-19) |
Editions referenced: 45 CFR Part 164 Subpart D (HIPAA breach notification); SEC Release 33-11216, Form 8-K Item 1.05 and Regulation S-K Item 106; 23 NYCRR Part 500 (NYDFS); 16 CFR Part 314 (FTC Safeguards Rule) and Part 318 (FTC Health Breach Notification Rule); State breach notification laws, with California Civil Code 1798.82 and New York General Business Law 899-aa as examples
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.