Incident Classification, Severity & Escalation Matrix
Classifies events by impact criteria and maps each severity to escalation paths, notification triggers and response-time targets.
Available soon
- Format
- Excel
- Size
- 100 KB
- Length
- 13 sheets
- Version
- 1.3
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Tailor the Severity Matrix before you adopt it. Replace every [[placeholder]] with your own figures (the money thresholds should be the ones in your risk scale), and set who leads and who is told to fit your organisation. Keep four levels: the other documents in the pack refer to Severity 1 to 4. The Data row uses two phrases that need a number: “at scale” (Severity 1) and “limited numbers” (Severity 2). As the pack's default, read “at scale” as hundreds of people or more, or any special-category data, and “limited numbers” as fewer than that. Your own standard may set different figures: replace them here and tell the incident manager. |
| 2 | At declaration, the incident manager sets the category (Categories) and the severity (Severity Matrix), and records both in the case log (IM-03). Use the Classifier sheet if it helps: give a level for every impact area; the severity is the most severe of them. Severity is the highest level any impact area reaches, judged on what the incident has done or is capable of doing. When in doubt, choose the higher level. Severity is reviewed at every update and can be raised by anyone on the response team; it is lowered only by the incident manager, with the reason recorded in the case log. |
| 3 | Escalate as the Severity Matrix says for that severity (IM-05). The category chooses the playbook: IC-01 ransomware or destructive malware uses the Ransomware Response Playbook; IC-03 business email compromise and payment fraud uses the Business Email Compromise Response Playbook; IC-05 personal data breach uses the Personal Data Breach Response Playbook; IC-09 lost or stolen device uses the Personal Data Breach Response Playbook; every other category uses the Incident Response Plan (general response). |
| 4 | Within 4 hours of declaration, screen the incident against every reporting duty (IM-06): NIS2 — Are we an essential or important entity, and has this incident caused, or could it cause, severe operational disruption or financial loss to us, or considerable damage to others? GDPR — Is personal data affected (confidentiality, integrity or availability)? If so, is the breach unlikely to result in a risk to individuals, a risk, or a high risk? DORA — Are we a financial entity, and does the incident affect critical services and meet the thresholds of Delegated Regulation (EU) 2024/1772 Articles 8 and 9? Where the US duties apply, ask the US questions too: HIPAA — Are we a covered entity or a business associate, and was protected health information acquired, accessed, used or disclosed in a way the Privacy Rule does not permit? That is presumed to be a breach unless a risk assessment of the four factors shows a low probability of compromise. If it is a breach: how many individuals, and how many residents of any one State? SEC — Are we a registrant, and has the incident been determined to be material, or could it be? Who is making that determination, and by when? NYDFS — Do we operate under a licence or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law, and have we determined that a cybersecurity incident has occurred? Has an extortion payment been made? State law — Are residents of any State affected, and is the data personal information as that State defines it? FTC — Are we a financial institution under the FTC's jurisdiction and were 500 or more consumers' unencrypted records acquired, or are we a vendor of personal health records or a related entity that HIPAA does not cover? (A third-party service provider tells its customer instead.) The Categories sheet says which duties are most likely for each category; the Reporting Clocks sheet lists every duty, its clock and its legal reference. |
| 5 | On the Clock Calculator sheet, enter the case ID, the time of awareness and the three screen answers; for the US duties, also the time of discovery (IM-13), your HIPAA role and the number of individuals, the SEC and New York answers with the time each determination was made, and the time of any extortion payment. The deadlines calculate. Keep the Holidays sheet up to date: the Form 8-K deadline skips those days. A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so its deadline is 5:30 p.m. Eastern time on the fourth business day. Enter the times for this duty in Eastern time. Enter every time on this sheet in one time zone: for a case with a Form 8-K duty, US Eastern time throughout. Add the NIS2 incident notification time when it is made (the final report runs one month from it), and for DORA the time the incident was classified as major and the later report times. |
| 6 | Review the matrix after every Severity 1 incident and at least once a year (IM-12). Change the reporting clocks only when the law or your competent authority changes them; the clocks on the Reporting Clocks sheet feed the calculator. |
| 7 | Delete the EXAMPLE rows on the Clock Calculator and Classifier sheets before the matrix is approved. The Severity Matrix, Categories and Reporting Clocks sheets are the content itself: tailor them, do not delete them. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, an important entity under NIS2 in its Member State; not a financial entity, so DORA's reporting duties do not apply. Its five incidents of Q3 2026 are on the Classifier sheet with the level it judged for each impact area; the mailbox takeover (INC-2026-017) has a second row showing the levels at declaration, before the audit log let the incident manager lower it (IM-04). The ransomware incident (INC-2026-014) was a NIS2 significant incident, and the order spreadsheet sent to the wrong customer (INC-2026-016) was notified under GDPR; the Clock Calculator sheet shows their deadlines, all met.
Tailoring — small organisation: the incident manager may also run IT, the executive incident lead may be the managing director, and the crisis team may be the leadership team. Keep the four levels and the clocks; shorten the lead and escalation columns to the people you have, each with a deputy.
Tailoring — regulated financial entity: DORA replaces NIS2's reporting for financial entities. Use RD-10, RD-11, RD-12, RD-13 instead of RD-01 to RD-05, answer the DORA question with the classification criteria of Delegated Regulation (EU) 2024/1772 Articles 8 and 9, and record the time the incident was classified as major: the initial notification is due within 4 hours of it and no later than 24 hours after awareness. Add the regulation's classification criteria (clients, duration, geographical spread, data losses, critical services, economic impact) to the Legal and regulatory row of the Severity Matrix.
Tailoring — IT run by a managed service provider: the provider usually detects, triages and contains, but the severity, the reporting screen and every report stay yours. Give the provider this matrix, agree that it escalates to your incident manager within the times shown, and name its on-call contact in the lead column for Severity 3 and 4.
Tailoring — US organisation: The US duties are for organisations that are subject to them: HIPAA covered entities and business associates, companies that file reports with the SEC, entities licensed by the New York Department of Financial Services, and organisations that hold personal information of State residents. State laws are shown as placeholders with California and New York as examples; every State has its own. This is not legal advice; ask counsel which duties apply. The US clocks for HIPAA, the FTC's rules and State breach laws run from discovery, not from the declaration time that starts awareness. Record both times (IM-13). The SEC's clock runs from the materiality determination, New York's from the determination that a cybersecurity incident has occurred, and the extortion notices from the payment. EXAMPLE (US): Example Health Group, Inc. (EXAMPLE), a US health services company that runs a health plan and a network of outpatient clinics, with about 2,800 staff and members in several States. It is a HIPAA covered entity, and for one service also a business associate of other covered entities. Its shares are listed on a US exchange, so the SEC's rules for current reports apply to it. A private company reads the SEC rows as not applying. It holds a licence under the New York Insurance Law, so the Department of Financial Services' cybersecurity regulation applies. An organisation with no such licence reads those rows as not applying. It has members who live in California and New York, so those two States' laws are the examples; every other State has its own law. It is not a financial institution under the FTC's jurisdiction, so the FTC Safeguards Rule is not part of the example. Its three EXAMPLE rows on the Clock Calculator sheet (INC-2026-021 to INC-2026-023) show a breach discovered the afternoon before it was declared, a business associate's notice, and the clocks an extortion payment opens.
The NIS2 clocks run from awareness of a significant incident; the GDPR clock from awareness of a personal data breach. In this pack awareness is the declaration time recorded in the case log, unless the record shows reasonable certainty earlier. The pack chooses this on purpose. The legal tests turn on reasonable certainty, so a late declaration does not postpone a clock the law starts earlier. National transposition may add detail: check your authority's guidance and put its name in the [[placeholders]].
Severity Matrix
Set severity on the worst impact area (IM-04). Minutes and hours run from declaration. Yellow cells are yours to tailor.
Severity is the highest level any impact area reaches, judged on what the incident has done or is capable of doing. When in doubt, choose the higher level. Severity is reviewed at every update and can be raised by anyone on the response team; it is lowered only by the incident manager, with the reason recorded in the case log.
| Level | Severity | Label | Judged against (risk scale impact) | Service | Data | Spread | Financial | Legal and regulatory | Reputation | Who leads | Who is told, and how fast (IM-05) | Updates | Working pattern |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Severity 1 | Critical | Severe | A core customer service stopped, or likely to stop, for more than [[4 hours]] | Personal or customer data at scale taken or exposed, or likely to be | Malware or an attacker spreading, or administrator-level access to core systems | Loss likely above [[€1,000,000]] | Likely a significant incident (NIS2), a major ICT-related incident (DORA), or a breach that individuals must be told of | National press, or loss of a major customer, likely | Incident manager, with the executive incident lead deciding | Incident manager at once; executive incident lead within 30 minutes; crisis team convened within 1 hour; board chair, or equivalent, within 4 hours | Every 2 hours | Round the clock until contained |
| 2 | Severity 2 | High | Major | A core customer service degraded, or an internal critical service stopped | Personal data of individuals exposed, lost or altered, in limited numbers | One system or account compromised with elevated rights, and contained | Loss likely between [[€250,000]] and [[€1,000,000]] | Possibly notifiable to a supervisory authority or under a contract | Customers or local press aware | Incident manager | Incident manager at once; executive incident lead within 2 hours | Every 4 hours | Extended hours as needed |
| 3 | Severity 3 | Medium | Moderate | One system or group of users affected; no customer effect | Internal non-personal data, or personal data that was protected (for example encrypted) or recovered before it could be misused | One user account or device compromised; attacker stopped before harm | Loss likely between [[€50,000]] and [[€250,000]] | Not notifiable | Not noticed outside the organisation | Incident manager, or the IT service desk under their direction | Incident manager at once; Head of Information Security the same working day | Every 24 hours | Working hours |
| 4 | Severity 4 | Low | Minor | No service affected | No data affected | Attack stopped by an existing control, with response work still needed | Loss likely below [[€50,000]] | Not notifiable | None | IT service desk | IT service desk logs and handles it; Head of Information Security in the weekly summary | No scheduled updates | Working hours; closed within [[5]] working days |
Categories
The category chooses the playbook; severity is set separately. Add your own categories on the blank rows, with a new ID.
| Category ID | Category | Examples | Playbook | Reporting questions most likely to apply (the full screen is always asked, IM-06) |
|---|---|---|---|---|
| IC-01 | Ransomware or destructive malware | Files encrypted; ransom note; systems wiped | Ransomware Response Playbook | NIS2 significant incident (RD-01 to RD-04) is likely; GDPR breach of availability, and of confidentiality if data was taken (RD-06, RD-08); DORA major incident for a financial entity (RD-10 to RD-12); insurer (RD-15) and crime report (RD-16). US: NYDFS 72-hour notice (RD-22) for a licensed entity, with the extortion-payment notices (RD-23, RD-24) if a payment is made; SEC Form 8-K (RD-21) if the incident is determined to be material; HIPAA (RD-17 to RD-20) and State law (RD-25) if protected health or personal information was taken. |
| IC-02 | Other malware | Malware found and blocked or removed, no encryption | Incident Response Plan (general response) | Usually none beyond the case log. Ask the GDPR question if the malware could read personal data (RD-08), and NIS2 if services were disrupted. US: Usually none. Ask the HIPAA and State law questions if the malware could read protected health or personal information. |
| IC-03 | Business email compromise and payment fraud | A mailbox taken over; a request to change bank details; a fake invoice | Business Email Compromise Response Playbook | Crime report (RD-16) whenever money was lost or asked for; insurer (RD-15) when money was lost, or when the policy asks to be told of attempts too; GDPR if a mailbox holding personal data was read (RD-06, RD-08); contract notices where a customer was deceived (RD-14). US: State law (RD-25) and HIPAA (RD-17 to RD-20) if a mailbox holding protected health or personal information was read; NYDFS (RD-22) for a licensed entity. |
| IC-04 | Account compromise | A user or administrator account used by someone else | Incident Response Plan (general response) | GDPR: check the audit log for personal data read or sent (RD-06, RD-08); NIS2 if the account had administrator rights over a core service. US: HIPAA (RD-17 to RD-20) and State law (RD-25): check the audit log for protected health or personal information read or sent; NYDFS (RD-22) if the incident meets its definition. |
| IC-05 | Personal data breach | Personal data sent to the wrong person, lost, stolen, altered or made unavailable | Personal Data Breach Response Playbook | GDPR always: breach record (RD-08), authority within 72 hours unless unlikely to result in a risk (RD-06), individuals if a high risk (RD-07); controller notice where we are a processor (RD-09). US: HIPAA always for protected health information: the presumption of breach and the four-factor assessment (RD-17 to RD-20); State law for each State where residents live (RD-25 to RD-27); the FTC's rules where they apply (RD-28, RD-29). |
| IC-06 | Exploited vulnerability | A weakness in an internet-facing system used to get in | Incident Response Plan (general response) | NIS2 if a service was disrupted or could have been (RD-01, RD-02); GDPR if the system holds personal data (RD-06, RD-08). US: NYDFS (RD-22) for a licensed entity; SEC (RD-21) if material; HIPAA and State law if the system holds protected health or personal information. |
| IC-07 | Denial of service | A service made unavailable by traffic or requests | Incident Response Plan (general response) | NIS2 significant incident when a core service is stopped for long (RD-01 to RD-05); DORA for a financial entity's critical services (RD-10); customer contract notices (RD-14). US: SEC (RD-21) if material; NYDFS (RD-22) if the incident meets its definition. |
| IC-08 | Insider misuse | An employee or contractor misusing access | Incident Response Plan (general response) | GDPR if personal data was misused (RD-06 to RD-08); crime report where the misuse is criminal (RD-16); take legal and HR advice before speaking to the person. US: HIPAA (RD-17 to RD-20) and State law (RD-25) if protected health or personal information was misused. |
| IC-09 | Lost or stolen device | A laptop, phone or removable drive | Personal Data Breach Response Playbook | GDPR always needs a breach record (RD-08), and a notification to the authority (RD-06) unless the device was encrypted and the key is safe, so the breach is unlikely to result in a risk; individuals only for a high risk (RD-07, with Article 34(3)). Crime report for a theft (RD-16). US: HIPAA: a lost device holding unsecured protected health information is presumed a breach; encryption that meets the Secretary's guidance may make the information secured (RD-17 to RD-20). State law has its own rules on encryption (RD-25). |
| IC-10 | Supplier incident | An incident at a supplier that affects our data or services | Incident Response Plan (general response) | The supplier's notice to us starts our own screen: NIS2 (RD-01) if our service is disrupted; GDPR where the supplier processes our personal data (RD-06, RD-08); for a financial entity, DORA (RD-10), which the financial entity files itself. Where we are an ICT provider to financial entities, we do not file under DORA: we give our customers what their own reports need, as our contracts require (RD-14). US: A business associate's own discovery may count as ours if it acts as our agent under federal common law (45 CFR 164.404(a)(2)): ask counsel (RD-17 to RD-20). A supplier's incident can also open RD-21 and RD-22 for us. |
Reporting Clocks
Every external reporting duty the screen asks about (IM-06): RD-01 to RD-16 from EU law, contracts, insurance and the police, RD-17 to RD-29 from US law. The Clock Calculator reads the hours, months, days and business days columns. Recipients are [[placeholders]] until you name your authorities. The US clocks run from discovery, the materiality determination, the New York determination or the extortion payment (IM-13).
| Duty ID | Regime | Report | Deadline | Clock (hours) | Clock (months, due by the end of the day) | DORA: hours after classifying as major | Clock (calendar days, due by the end of the day) | Clock (business days; the Form 8-K is due by 17:30 Eastern time on the last) | Clock starts at | Starts from report | Recipient | Applies to | Legal reference |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RD-01 | NIS2 | Early warning | Within 24 hours of awareness | 24 | — | — | — | — | Awareness | — | [[CSIRT or competent authority]] | Essential and important entities, for a significant incident | NIS2 — Directive (EU) 2022/2555 — Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) |
| RD-02 | NIS2 | Incident notification | Within 72 hours of awareness | 72 | — | — | — | — | Awareness | — | [[CSIRT or competent authority]] | Essential and important entities, for a significant incident | NIS2 — Directive (EU) 2022/2555 — Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) |
| RD-03 | NIS2 | Intermediate report | When the authority asks | — | — | — | — | — | — | — | [[CSIRT or competent authority]] | Essential and important entities, for a significant incident | NIS2 — Directive (EU) 2022/2555 — Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) |
| RD-04 | NIS2 | Final report | Within one month of the incident notification (a progress report then, and the final report within one month of handling, if still ongoing) | — | 1 | — | — | — | Notification | RD-02 | [[CSIRT or competent authority]] | Essential and important entities, for a significant incident | NIS2 — Directive (EU) 2022/2555 — Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) |
| RD-05 | NIS2 | Notice to recipients of our services | Without undue delay, where appropriate | — | — | — | — | — | Awareness | — | Customers whose service is likely to be adversely affected | Essential and important entities, for a significant incident | NIS2 — Directive (EU) 2022/2555 — Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services |
| RD-06 | GDPR | Notification to the supervisory authority | Without undue delay and, where feasible, within 72 hours of awareness; later only with reasons for the delay | 72 | — | — | — | — | Awareness | — | [[lead supervisory authority]] | Controllers, unless the breach is unlikely to result in a risk to individuals | GDPR — Regulation (EU) 2016/679 — Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay |
| RD-07 | GDPR | Communication to the individuals affected | Without undue delay | — | — | — | — | — | Awareness | — | The data subjects | Controllers, where the breach is likely to result in a high risk to individuals, unless an Article 34(3) condition is met | GDPR — Regulation (EU) 2016/679 — Article 34(1) — where a breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate it to the data subjects without undue delay |
| RD-08 | GDPR | Breach record | For every personal data breach, notified or not | — | — | — | — | — | — | — | Kept by us; shown to the authority on request | Controllers | GDPR — Regulation (EU) 2016/679 — Article 33(5) — the controller documents every personal data breach: the facts, its effects and the remedial action taken |
| RD-09 | GDPR | Notice to the controller | Without undue delay | — | — | — | — | — | Awareness | — | The controller whose data we process | Where we act as a processor | GDPR — Regulation (EU) 2016/679 — Article 33(2) — “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.” |
| RD-10 | DORA | Initial notification | Within 4 hours of classifying the incident as major, and no later than 24 hours after awareness; where it is classified as major only after those 24 hours, within 4 hours of that classification | 24 | — | 4 | — | — | Awareness | — | [[financial competent authority]] | Financial entities, for a major ICT-related incident | DORA — Delegated Regulation (EU) 2025/301 — Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report |
| RD-11 | DORA | Intermediate report | Within 72 hours of the initial notification, and again when regular activities are recovered | 72 | — | — | — | — | Initial notification | RD-10 | [[financial competent authority]] | Financial entities, for a major ICT-related incident | DORA — Delegated Regulation (EU) 2025/301 — Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report |
| RD-12 | DORA | Final report | No later than one month after the latest intermediate report | — | 1 | — | — | — | Latest intermediate report | RD-11 | [[financial competent authority]] | Financial entities, for a major ICT-related incident | DORA — Delegated Regulation (EU) 2025/301 — Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report |
| RD-13 | DORA | Notice to clients | Without undue delay | — | — | — | — | — | Awareness | — | Clients whose financial interests are affected | Financial entities, for a major ICT-related incident | DORA — Regulation (EU) 2022/2554 — Article 19(3) — where a major ICT-related incident has an impact on the financial interests of clients, inform them without undue delay of the incident and of the measures taken |
| RD-14 | Contract | Notice to customers under contract | [[as each contract requires]] | — | — | — | — | — | Awareness | — | [[customers with a notification clause]] | Where a contract requires it | No legal clock: set by the contract, the policy or the police |
| RD-15 | Insurance | Notice to the cyber insurer | [[as the policy requires, often within 48 hours]] | — | — | — | — | — | Awareness | — | [[insurer or broker incident line]] | Where a cyber policy is held | No legal clock: set by the contract, the policy or the police |
| RD-16 | Law enforcement | Crime report | [[as soon as practical for suspected crime]] | — | — | — | — | — | Awareness | — | [[national cybercrime reporting service]] | Suspected criminal acts, including ransomware and fraud | No legal clock: set by the contract, the policy or the police |
| RD-17 | HIPAA | Notification to each individual affected | Without unreasonable delay and in no case later than 60 calendar days after discovery | — | — | — | 60 | — | Discovery | — | Each individual whose unsecured protected health information was, or is reasonably believed to have been, accessed, acquired, used or disclosed | Covered entities, for a breach of unsecured protected health information | HIPAA — 45 CFR Part 164, Subpart D (breach notification) — § 164.404 — a covered entity notifies each affected individual without unreasonable delay and no later than 60 calendar days after discovery; a breach is treated as discovered on the first day it is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who committed it; the notice says what happened, what information was involved, what individuals should do, what the entity is doing, and how to ask questions, in plain language |
| RD-18 | HIPAA | Notice to prominent media outlets | Without unreasonable delay and in no case later than 60 calendar days after discovery, where more than 500 residents of one State or jurisdiction are involved | — | — | — | 60 | — | Discovery | — | Prominent media outlets serving the State or jurisdiction | Covered entities, for a breach involving more than 500 residents of a State or jurisdiction | HIPAA — 45 CFR Part 164, Subpart D (breach notification) — § 164.406 — for a breach involving more than 500 residents of a State or jurisdiction, a covered entity notifies prominent media outlets serving that State or jurisdiction, within the same 60 calendar days and with the content of § 164.404(c) |
| RD-19 | HIPAA | Notice to the Secretary of Health and Human Services | 500 or more individuals: contemporaneously with the notice to individuals (no later than 60 calendar days after discovery); fewer than 500: log the breach and report it within 60 days after the end of the calendar year of discovery | — | — | — | 60 | — | Discovery | — | The Secretary of Health and Human Services, through the Office for Civil Rights breach portal | Covered entities, for any breach of unsecured protected health information | HIPAA — 45 CFR Part 164, Subpart D (breach notification) — § 164.408 — a covered entity notifies the Secretary of Health and Human Services: for 500 or more individuals contemporaneously with the notice to individuals; for fewer than 500, it keeps a log and notifies not later than 60 days after the end of each calendar year, for breaches discovered in the year before |
| RD-20 | HIPAA | Notice by a business associate to the covered entity | Without unreasonable delay and in no case later than 60 calendar days after discovery (the contract usually sets a shorter time) | — | — | — | 60 | — | Discovery | — | [[the covered entity we serve]] | Business associates, for a breach of unsecured protected health information | HIPAA — 45 CFR Part 164, Subpart D (breach notification) — § 164.410 — a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery (a breach is treated as discovered when known to the business associate or to any employee, officer or other agent of it, § 164.410(a)(2)), identifying each individual affected and giving the information the covered entity needs for its own notices |
| RD-21 | SEC | Current report on Form 8-K, Item 1.05 | Within four business days after the company determines the incident is material; missing information is filed by amendment within four business days after it is determined or becomes available; a filing whose transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day, so the last safe time is 5:30 p.m. Eastern on the fourth business day | — | — | — | — | 4 | Materiality determination | — | The Securities and Exchange Commission, filed on EDGAR | Registrants, for a cybersecurity incident the registrant determines to be material | SEC — Regulation S-K and Form 8-K — Form 8-K Item 1.05 — a registrant that experiences a cybersecurity incident it determines to be material describes the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact, within four business days after the determination; the determination is made without unreasonable delay after discovery; information not yet determined is filed by amendment within four business days after it is determined or becomes available |
| RD-22 | NYDFS | Notice of a cybersecurity incident | As promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred | 72 | — | — | — | — | Determination | — | The Superintendent of Financial Services, electronically | Covered entities: persons operating under a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law | NYDFS — 23 NYCRR Part 500 — § 500.17(a) — notify the Superintendent electronically as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider, and provide requested information and updates promptly |
| RD-23 | NYDFS | Notice of an extortion payment | Within 24 hours of the extortion payment | 24 | — | — | — | — | Payment | — | The Superintendent of Financial Services, electronically | Covered entities that make an extortion payment in connection with a cybersecurity event | NYDFS — 23 NYCRR Part 500 — § 500.17(c) — notify the Superintendent within 24 hours of an extortion payment made in connection with a cybersecurity event, and within 30 days give a written description of the reasons the payment was necessary, the alternatives considered, the diligence performed to find alternatives, and the diligence performed to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control |
| RD-24 | NYDFS | Written description of why the payment was necessary | Within 30 days of the extortion payment | — | — | — | 30 | — | Payment | — | The Superintendent of Financial Services, electronically | Covered entities that make an extortion payment in connection with a cybersecurity event | NYDFS — 23 NYCRR Part 500 — § 500.17(c) — notify the Superintendent within 24 hours of an extortion payment made in connection with a cybersecurity event, and within 30 days give a written description of the reasons the payment was necessary, the alternatives considered, the diligence performed to find alternatives, and the diligence performed to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control |
| RD-25 | State law | Notice to residents of the State | [[the deadline of each State where affected residents live, for example 30 days]] | — | — | — | — | — | Discovery | — | Residents of each State whose personal information was involved | Any organisation holding personal information of a State's residents; each State sets its own definition of personal information and its own test for a breach | State breach notification law (examples) — California Civil Code § 1798.82 — notice to affected California residents within 30 calendar days of discovery or notification of the breach, with extensions for law enforcement needs and to determine the scope of the breach; for a breach affecting more than 500 California residents, a sample copy of the notice to the Attorney General within 15 calendar days of notifying residents. Read on 20 October 2026 in the Legislature's chaptered text of SB 446 (Chapter 319, Statutes of 2025, approved 3 October 2025); this section as amended takes effect on 1 January 2026, as California statutes do unless they say otherwise. Confirm the current text. This is one State's rule, given as an example; every other State has its own |
| RD-26 | State law | Notice to the State attorney general or regulator | [[whether, when and above what number of residents each State requires it]] | — | — | — | — | — | Discovery | — | [[the attorney general, or the regulator the State names, for each State]] | Organisations notifying residents of a State that requires it | State breach notification law (examples) — New York General Business Law § 899-aa — notice to affected New York residents within 30 days after the breach was discovered; the person or business also notifies the State attorney general, the department of state and the division of state police, and the department of financial services if it is a covered entity under 23 NYCRR 500.1; a HIPAA covered entity that notifies the Secretary of Health and Human Services also notifies the attorney general within five business days of doing so; where more than 5,000 New York residents are notified at one time, the consumer reporting agencies are notified too. This is one State's rule, given as an example; every other State has its own |
| RD-27 | State law | Notice to consumer reporting agencies | [[where a State requires it, with its threshold]] | — | — | — | — | — | Discovery | — | [[the consumer reporting agencies a State names]] | Organisations notifying more residents than a State's threshold | State breach notification law (examples) — New York General Business Law § 899-aa — notice to affected New York residents within 30 days after the breach was discovered; the person or business also notifies the State attorney general, the department of state and the division of state police, and the department of financial services if it is a covered entity under 23 NYCRR 500.1; a HIPAA covered entity that notifies the Secretary of Health and Human Services also notifies the attorney general within five business days of doing so; where more than 5,000 New York residents are notified at one time, the consumer reporting agencies are notified too. This is one State's rule, given as an example; every other State has its own |
| RD-28 | FTC Safeguards | Notice to the Federal Trade Commission | As soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers | — | — | — | 30 | — | Discovery | — | The Federal Trade Commission, electronically on its form | Financial institutions under the FTC's jurisdiction, for the acquisition without authorisation of unencrypted customer information of at least 500 consumers | FTC — Safeguards Rule, 16 CFR Part 314 — § 314.4(j) — notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers; the notice gives the institution's contact details, the types of information, the date or date range, the number of consumers, a general description, and whether a law enforcement official has determined that public notice would impede an investigation or harm national security |
| RD-29 | FTC Health Breach | Notices under the Health Breach Notification Rule | Without unreasonable delay and in no case later than 60 calendar days after discovery: individuals, and for 500 or more residents of a State the media; the FTC at the same time for 500 or more individuals, or in an annual log for fewer | — | — | — | 60 | — | Discovery | — | Individuals; prominent media outlets; the Federal Trade Commission | Vendors of personal health records and PHR related entities, for a breach of security of unsecured PHR identifiable health information; not HIPAA covered entities, nor business associates acting as such. A third-party service provider owes the vendor or related entity a notice within the same 60 calendar days instead (16 CFR 318.3(b)) | FTC — Health Breach Notification Rule, 16 CFR Part 318 — § 318.4 — notices are sent without unreasonable delay and in no case later than 60 calendar days after discovery; notice to the Federal Trade Commission is contemporaneous for 500 or more individuals and may be sent annually, no later than 60 calendar days after the end of the calendar year, for fewer than 500; the Rule has a law-enforcement exception |
Holidays
Days the SEC is closed, besides Saturdays and Sundays. The Form 8-K clock (RD-21) counts business days and skips these. The EXAMPLE rows are US federal holidays from September 2026 to February 2027: check them against the SEC's calendar and add the later ones. A holiday that falls on a Saturday is observed on the Friday before and one on a Sunday on the Monday after: add the observed day, and any day the Commission closes by order. The calculators flag a determination dated after the last day listed before you rely on the calculator.
| Day the SEC is closed | Name |
|---|---|
| 7 Sep 2026 | Labor Day |
| 12 Oct 2026 | Columbus Day |
| 11 Nov 2026 | Veterans Day |
| 26 Nov 2026 | Thanksgiving Day |
| 25 Dec 2026 | Christmas Day |
| 1 Jan 2027 | New Year's Day |
| 18 Jan 2027 | Birthday of Martin Luther King, Jr. |
| 15 Feb 2027 | Washington's Birthday |
Clock Calculator
One row per incident. Enter the yellow cells; every deadline calculates from the Reporting Clocks sheet. A blank deadline means that duty does not apply on the answers given. The US clocks start at discovery, at the materiality determination, at the New York determination or at the extortion payment, not at awareness (IM-13). The Form 8-K deadline skips weekends and the days on the Holidays sheet. A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so its deadline is 5:30 p.m. Eastern time on the fourth business day. Enter the times for this duty in Eastern time. A determination after the last day on the Holidays sheet is flagged in the Check column.
| Example | Case ID | Aware at (declared) | NIS2 significant incident? | GDPR: notify the supervisory authority? | DORA major incident? | DORA: classified as major at | NIS2 incident notification made at | DORA initial notification made at | DORA latest intermediate report made at | Discovered at (HIPAA, FTC, State law) | HIPAA role | HIPAA: breach of unsecured protected health information? | Individuals affected (all States) | Residents of the State with the most | SEC: material incident? | SEC: materiality determined at | New York: cybersecurity incident determined? | New York: determined at | New York: extortion payment made at | FTC Safeguards Rule: 500 or more consumers? | FTC Health Breach Notification Rule applies? | State law: days allowed | RD-01 NIS2 early warning due | RD-02 NIS2 incident notification due | RD-04 NIS2 final report due | RD-06 GDPR notification to the supervisory authority due | RD-10 DORA initial notification due | RD-11 DORA intermediate report due | RD-12 DORA final report due | RD-17 HIPAA notification to each individual affected due | RD-18 HIPAA notice to prominent media outlets due | RD-19 HIPAA notice to the secretary of health and human services due | RD-20 HIPAA notice by a business associate to the covered entity due | RD-21 SEC current report on form 8-k, item 1.05 due | RD-22 NYDFS notice of a cybersecurity incident due | RD-23 NYDFS notice of an extortion payment due | RD-24 NYDFS written description of why the payment was necessary due | RD-25 State law notice to residents of the state due | RD-28 FTC Safeguards notice to the federal trade commission due | RD-29 FTC Health Breach notices under the health breach notification rule due | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | 12 Aug 2026 | Yes | No | No | 14 Aug 2026 | 13 Aug 2026 | 15 Aug 2026 | 14 Sep 2026 | OK | |||||||||||||||||||||||||||||||
| EXAMPLE | INC-2026-016 | 9 Sep 2026 | No | Yes | No | 12 Sep 2026 | OK | ||||||||||||||||||||||||||||||||||
| EXAMPLE | INC-2026-021 | 15 Sep 2026 | No | No | No | 14 Sep 2026 | Covered entity | Yes | 3200 | 640 | Yes | 24 Sep 2026 | Yes | 15 Sep 2026 | No | No | 13 Nov 2026 | 13 Nov 2026 | 13 Nov 2026 | 30 Sep 2026 | 18 Sep 2026 | OK | |||||||||||||||||||
| EXAMPLE | INC-2026-022 | 22 Sep 2026 | No | No | No | 22 Sep 2026 | Business associate | Yes | 480 | 480 | No | No | No | No | 21 Nov 2026 | OK | |||||||||||||||||||||||||
| EXAMPLE | INC-2026-023 | 26 Sep 2026 | No | No | No | 26 Sep 2026 | Covered entity | No | No | Yes | 26 Sep 2026 | 26 Sep 2026 | No | No | 29 Sep 2026 | 27 Sep 2026 | 26 Oct 2026 | OK |
Classifier
For each impact area, the level (1 to 4) the incident has reached or is capable of reaching, from the Severity Matrix. Severity is the most severe of them (IM-04). When in doubt, choose the higher level.
| Example | Case ID | Title | Category ID | Category | Service (1–4) | Data (1–4) | Spread (1–4) | Financial (1–4) | Legal and regulatory (1–4) | Reputation (1–4) | Severity level | Severity | Label | Set by | Who leads | Who is told, and how fast | Updates | Playbook | Check |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | INC-2026-014 | Ransomware on 14 office PCs at Warehouse 2 | IC-01 | Ransomware or destructive malware | 2 | 2 | 1 | 3 | 1 | 3 | 1 | Severity 1 | Critical | Spread; Legal and regulatory | Incident manager, with the executive incident lead deciding | Incident manager at once; executive incident lead within 30 minutes; crisis team convened within 1 hour; board chair, or equivalent, within 4 hours | Every 2 hours | Ransomware Response Playbook | OK |
| EXAMPLE | INC-2026-015 | Request to change a supplier's bank details from its compromised mailbox | IC-03 | Business email compromise and payment fraud | 4 | 4 | 4 | 3 | 4 | 4 | 3 | Severity 3 | Medium | Financial | Incident manager, or the IT service desk under their direction | Incident manager at once; Head of Information Security the same working day | Every 24 hours | Business Email Compromise Response Playbook | OK |
| EXAMPLE | INC-2026-016 | Customer order spreadsheet sent to the wrong business customer | IC-05 | Personal data breach | 4 | 2 | 4 | 4 | 2 | 3 | 2 | Severity 2 | High | Data; Legal and regulatory | Incident manager | Incident manager at once; executive incident lead within 2 hours | Every 4 hours | Personal Data Breach Response Playbook | OK |
| EXAMPLE | INC-2026-017 | Staff mailbox taken over after a phishing email — at declaration, 14:25 (lowered to Severity 3 at 15:20) | IC-04 | Account compromise | 4 | 2 | 3 | 4 | 2 | 4 | 2 | Severity 2 | High | Data; Legal and regulatory | Incident manager | Incident manager at once; executive incident lead within 2 hours | Every 4 hours | Incident Response Plan (general response) | OK |
| EXAMPLE | INC-2026-017 | Staff mailbox taken over after a phishing email — lowered to Severity 3 at 15:20: The mailbox audit log showed no mail had been forwarded or read by the attacker, so no personal data had gone | IC-04 | Account compromise | 4 | 4 | 3 | 4 | 4 | 4 | 3 | Severity 3 | Medium | Spread | Incident manager, or the IT service desk under their direction | Incident manager at once; Head of Information Security the same working day | Every 24 hours | Incident Response Plan (general response) | OK |
| EXAMPLE | INC-2026-018 | Blocked attempts to exploit a published weakness on the ordering platform | IC-06 | Exploited vulnerability | 4 | 4 | 4 | 4 | 4 | 4 | 4 | Severity 4 | Low | Service; Data; Spread; Financial; Legal and regulatory; Reputation | IT service desk | IT service desk logs and handles it; Head of Information Security in the weekly summary | No scheduled updates | Incident Response Plan (general response) | OK |
Lists
| SeverityLevel | ImpactLevel | YesNo | Regime | HipaaRole |
|---|---|---|---|---|
| 1 | Minor | Yes | NIS2 | Covered entity |
| 2 | Moderate | No | GDPR | Business associate |
| 3 | Major | DORA | Neither | |
| 4 | Severe | Contract |
Insurance
Law enforcement
HIPAA
SEC
NYDFS
State law
FTC Safeguards
FTC Health Breach
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Event | Something observed or reported that might affect the security of our information or services. Most events are not incidents. |
| Incident | An event, declared by the incident manager, that has compromised, or threatens to compromise, the availability, authenticity, integrity or confidentiality of our data or services, and needs a managed response. |
| Near miss | An event that could have compromised our data or services but was prevented or did not happen, and needs nothing beyond logging. Logged, never declared. An attack that was stopped but still needs response work, such as warning a supplier, confirming a patch or watching for a repeat, is declared, usually at Severity 4. |
| Significant incident (NIS2) | NIS2's term: an incident that has caused or could cause severe operational disruption or financial loss to us, or considerable damage to others. Reported to the authority on NIS2's clock. |
| Major ICT-related incident (DORA) | DORA's term, for financial entities only: an ICT-related incident with a high adverse impact on systems that support critical or important functions, as tested by Delegated Regulation (EU) 2024/1772. |
| Personal data breach (GDPR) | GDPR's term: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. |
| Awareness | The moment the reporting clocks start: the time the incident is declared, as recorded in the case log, unless the record shows we had reasonable certainty earlier, in which case the earlier time. The pack chooses this deliberately. The legal tests turn on what we knew: the EDPB's Guidelines 9/2022 treat a controller as aware once it has a reasonable degree of certainty that a breach occurred, and NIS2 counts from becoming aware of a significant incident, judged on an initial assessment. A late declaration therefore does not postpone a clock the law starts earlier. |
| Containment | The incident can no longer spread or cause new harm, even though systems may not yet be restored. |
| Closure | Recovery criteria met, the monitoring period passed without recurrence, and the case log complete. |
| Discovery (HIPAA, FTC, State law) | The day a breach is first known to us or, by exercising reasonable diligence, would have been known to us, counting what any member of the workforce or any agent knows, other than the person who committed the breach. HIPAA defines it this way (45 CFR 164.404(a)(2)) and the FTC's Health Breach Notification Rule follows it; the Safeguards Rule counts only what is known to the institution (16 CFR 314.4(j)(2)); State laws use the word too, each with its own test. It can be earlier than awareness, the declaration time, so it is recorded separately (IM-13). |
| Materiality determination (SEC) | A listed company's decision, made without unreasonable delay after it discovers a cybersecurity incident, that the incident is material. It starts the four business days for the Form 8-K report (RD-21). Until it is made, the reason it has not been made is recorded. |
| Registrant (SEC) | A company that files reports with the Securities and Exchange Commission under the Securities Exchange Act of 1934; in this pack, a listed company. The SEC's rules call it a registrant. |
| Unsecured protected health information (HIPAA) | Protected health information that has not been made unusable, unreadable or indecipherable to unauthorised people by a technology or method the Secretary of Health and Human Services specifies in guidance (45 CFR 164.402). Whether a given encryption meets that guidance is a question for your privacy officer and counsel. |
| Determination of a cybersecurity incident (NYDFS) | The New York Department of Financial Services' clock runs from determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider. 23 NYCRR 500.1 defines a cybersecurity incident as a cybersecurity event that impacts the covered entity and requires it to notify any government body, self-regulatory agency or any other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or results in ransomware being deployed within a material part of its information systems. |
| Business day (SEC) | A day on which the Securities and Exchange Commission is open for business. If the event falls on a Saturday, Sunday or a day the Commission is closed, the four business days begin on, and include, the first business day after (Form 8-K, General Instruction B.1). A Form 8-K whose direct transmission begins after 5:30 p.m. Eastern time is deemed filed on the next business day (17 CFR 232.13(a)(2)), so the last safe time is 5:30 p.m. Eastern on the fourth business day. |
| Severity | How fast we respond, from Severity 1 (Critical) to Severity 4 (Low). Severity is the highest level any impact area reaches, judged on what the incident has done or is capable of doing. When in doubt, choose the higher level. Severity is reviewed at every update and can be raised by anyone on the response team; it is lowered only by the incident manager, with the reason recorded in the case log. Severity is ours; it is not any of the legal tests, which are screened separately (IM-06). |
| Impact area | One of the 6 things severity is judged on: service, data, spread, financial, legal and regulatory, reputation. The money thresholds are those of the risk scale, so an incident and a risk are judged on the same consequences. |
| Category | What kind of incident it is (IC-01 to IC-10). It chooses the playbook; it does not set severity. |
| Reporting duty | An external report the law, a contract or a policy may require (RD-01 to RD-29), each with its recipient and clock. |
| Reporting screen | Every incident must be screened against every reporting duty (NIS2, GDPR, DORA where it applies, contracts and insurance) within 4 hours of declaration, and the decision and its reasons recorded whether or not a report is made. |
| Executive incident lead | [[e.g. Chief Operating Officer, with a named deputy]]. Decides on stopping a customer-facing service and on reports to authorities. |
| Incident manager | [[e.g. Information Security Manager, with a named deputy]]. Runs the response from declaration to closure. |
| NIS2 | Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, as transposed in your Member State. Applies to essential and important entities. |
| GDPR | The General Data Protection Regulation, Regulation (EU) 2016/679. Applies whenever personal data is affected. |
| DORA | The Digital Operational Resilience Act, Regulation (EU) 2022/2554, with its Delegated Regulations (EU) 2024/1772 and 2025/301. Applies to financial entities only; for them its reporting replaces NIS2's. |
| CSIRT | Computer security incident response team: the national team (or the competent authority) that receives NIS2 reports. |
| HIPAA | The Health Insurance Portability and Accountability Act of 1996 and its rules. Subpart D of 45 CFR Part 164 is the breach notification rule for covered entities (health plans, health care clearinghouses and most health care providers) and, through them, their business associates. |
| Business associate | A person or organisation that creates, receives, maintains or transmits protected health information for a covered entity, or provides certain services to it. The business associate tells the covered entity (RD-20); the covered entity tells the individuals. |
| SEC | The United States Securities and Exchange Commission. Form 8-K is the current report listed companies file; Item 1.05 is the item for a material cybersecurity incident. |
| NYDFS | The New York State Department of Financial Services. Its cybersecurity regulation is 23 NYCRR Part 500; it applies to entities licensed or authorised under the New York Banking Law, Insurance Law or Financial Services Law. |
| FTC | The United States Federal Trade Commission. Its Safeguards Rule (16 CFR Part 314) covers non-bank financial institutions; its Health Breach Notification Rule (16 CFR Part 318) covers vendors of personal health records and related entities that HIPAA does not. |
| State breach notification law | Each State, the District of Columbia and the territories have their own law on telling residents (and often an attorney general) about a breach of personal information. California Civil Code 1798.82 and New York General Business Law 899-aa are the examples in this pack. |
| IM-nn, IC-nn, RD-nn | Rule, category and reporting duty numbers used across the pack; the rules are in the Security Incident Management Policy. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, Q3 2026. Delete the EXAMPLE rows before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.25 — Assessment and decision on information security events | Severity Matrix and Classifier: each event assessed and a decision made whether it is an incident, and how severe |
| ISO/IEC 27001:2022 | Annex A 5.26 — Response to information security incidents | Who leads, who is told and how fast, and the playbook each category uses |
| ISO/IEC 27001:2022 | Annex A 5.5 — Contact with authorities | Reporting Clocks: the authorities to be told, when, and by whom |
| NIST CSF 2.0 | RS.MA-03 — “Incidents are categorized and prioritized” | Categories and Severity Matrix: incidents categorised and prioritised |
| NIST CSF 2.0 | RS.MA-04 — “Incidents are escalated or elevated as needed” | Who is told, and how fast: escalation by severity |
| NIST CSF 2.0 | DE.AE-08 — “Incidents are declared when adverse events meet the defined incident criteria” | Declaration: an event becomes an incident when the incident manager declares it against these criteria |
| NIST CSF 2.0 | RS.AN-08 — “An incident's magnitude is estimated and validated” | Classifier: the magnitude judged on every impact area, reviewed at each update |
| NIS2 — Directive (EU) 2022/2555 | Article 23(3) — an incident is significant if it “has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned”, or has affected or is capable of affecting others “by causing considerable material or non-material damage” | The NIS2 screen question and the Legal and regulatory row: when an incident is significant |
| NIS2 — Directive (EU) 2022/2555 | Article 23(4) — an early warning within 24 hours of becoming aware of a significant incident; an incident notification within 72 hours; an intermediate report on request; a final report not later than one month after the incident notification (or a progress report, then a final report within one month of handling, if still ongoing) | RD-01 to RD-04 and their deadlines in the Clock Calculator |
| GDPR — Regulation (EU) 2016/679 | Article 33(1) — notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; a later notification gives reasons for the delay | RD-06 and its 72-hour deadline in the Clock Calculator |
| GDPR — Regulation (EU) 2016/679 | Article 34(1) — where a breach is likely to result in a high risk to the rights and freedoms of natural persons, communicate it to the data subjects without undue delay | RD-07: communication to the individuals affected |
| DORA — Regulation (EU) 2022/2554 | Article 18(1) — classify ICT-related incidents by clients and transactions affected, reputational impact, duration and downtime, geographical spread, data losses, criticality of services affected and economic impact | Tailoring for financial entities: classification criteria added to the Legal and regulatory row |
| DORA — Delegated Regulation (EU) 2024/1772 | Article 8 — an incident is major where it affects critical services and either meets the data-loss threshold in Article 9(5)(b) or meets two or more of the other materiality thresholds | The DORA screen question: when an incident is major |
| DORA — Delegated Regulation (EU) 2024/1772 | Article 9 — materiality thresholds, among them more than 10% of clients of the service, duration over 24 hours or downtime over 2 hours for services supporting critical or important functions, two or more Member States, and costs above €100,000 | The DORA screen question: the materiality thresholds |
| DORA — Delegated Regulation (EU) 2025/301 | Article 5 — initial notification within 4 hours of classifying the incident as major and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report no later than one month after the latest intermediate report | RD-10 to RD-12 and their deadlines in the Clock Calculator |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.402 — a breach is the acquisition, access, use or disclosure of protected health information in a manner not permitted by the Privacy Rule that compromises its security or privacy; it is presumed to be a breach unless a risk assessment of at least four factors (the information and the likelihood of re-identification, the person who used or received it, whether it was actually acquired or viewed, and how far the risk has been mitigated) shows a low probability that it has been compromised; three exclusions apply; unsecured protected health information is information not made unusable, unreadable or indecipherable by the Secretary's guidance | The HIPAA screen question: the presumption of breach and the four factors |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.404 — a covered entity notifies each affected individual without unreasonable delay and no later than 60 calendar days after discovery; a breach is treated as discovered on the first day it is known, or by reasonable diligence would have been known, to any workforce member or agent other than the person who committed it; the notice says what happened, what information was involved, what individuals should do, what the entity is doing, and how to ask questions, in plain language | RD-17 and its 60-day deadline, from discovery, in the Clock Calculator |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.406 — for a breach involving more than 500 residents of a State or jurisdiction, a covered entity notifies prominent media outlets serving that State or jurisdiction, within the same 60 calendar days and with the content of § 164.404(c) | RD-18: media notice above 500 residents of one State |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.408 — a covered entity notifies the Secretary of Health and Human Services: for 500 or more individuals contemporaneously with the notice to individuals; for fewer than 500, it keeps a log and notifies not later than 60 days after the end of each calendar year, for breaches discovered in the year before | RD-19: the Secretary, with the individuals for 500 or more, or by the 60th day after the calendar year for fewer |
| HIPAA — 45 CFR Part 164, Subpart D (breach notification) | § 164.410 — a business associate notifies the covered entity without unreasonable delay and no later than 60 calendar days after discovery (a breach is treated as discovered when known to the business associate or to any employee, officer or other agent of it, § 164.410(a)(2)), identifying each individual affected and giving the information the covered entity needs for its own notices | RD-20: the business associate's deadline |
| SEC — Regulation S-K and Form 8-K | Form 8-K Item 1.05 — a registrant that experiences a cybersecurity incident it determines to be material describes the material aspects of its nature, scope and timing and its material impact or reasonably likely material impact, within four business days after the determination; the determination is made without unreasonable delay after discovery; information not yet determined is filed by amendment within four business days after it is determined or becomes available | RD-21 and its four business days in the Clock Calculator |
| SEC — Regulation S-K and Form 8-K | Form 8-K General Instruction B.1 — a report is due within four business days after the event; if the event occurs on a Saturday, Sunday or a day the Commission is closed, the four business days begin on, and include, the first business day after | The Holidays sheet and the business-day count: weekends and days the Commission is closed are skipped |
| NYDFS — 23 NYCRR Part 500 | § 500.1 — a covered entity is any person operating under or required to operate under a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law; a cybersecurity incident is a cybersecurity event at the covered entity, its affiliates or a third-party service provider that impacts the covered entity and requires it to notify any government body, self-regulatory agency or any other supervisory body, has a reasonable likelihood of materially harming a material part of normal operations, or results in ransomware being deployed within a material part of its information systems | The New York screen question: who is a covered entity and what a cybersecurity incident is |
| NYDFS — 23 NYCRR Part 500 | § 500.17(a) — notify the Superintendent electronically as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider, and provide requested information and updates promptly | RD-22 and its 72 hours in the Clock Calculator |
| NYDFS — 23 NYCRR Part 500 | § 500.17(c) — notify the Superintendent within 24 hours of an extortion payment made in connection with a cybersecurity event, and within 30 days give a written description of the reasons the payment was necessary, the alternatives considered, the diligence performed to find alternatives, and the diligence performed to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control | RD-23 and RD-24: 24 hours and 30 days from the extortion payment |
| FTC — Safeguards Rule, 16 CFR Part 314 | § 314.4(j) — notify the Federal Trade Commission as soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers; the notice gives the institution's contact details, the types of information, the date or date range, the number of consumers, a general description, and whether a law enforcement official has determined that public notice would impede an investigation or harm national security | RD-28: 30 days from discovery, 500 or more consumers |
| FTC — Health Breach Notification Rule, 16 CFR Part 318 | § 318.4 — notices are sent without unreasonable delay and in no case later than 60 calendar days after discovery; notice to the Federal Trade Commission is contemporaneous for 500 or more individuals and may be sent annually, no later than 60 calendar days after the end of the calendar year, for fewer than 500; the Rule has a law-enforcement exception | RD-29: 60 calendar days from discovery |
| State breach notification law (examples) | New York General Business Law § 899-aa — notice to affected New York residents within 30 days after the breach was discovered; the person or business also notifies the State attorney general, the department of state and the division of state police, and the department of financial services if it is a covered entity under 23 NYCRR 500.1; a HIPAA covered entity that notifies the Secretary of Health and Human Services also notifies the attorney general within five business days of doing so; where more than 5,000 New York residents are notified at one time, the consumer reporting agencies are notified too. This is one State's rule, given as an example; every other State has its own | RD-25 to RD-27: one State's rule, as an example |
| State breach notification law (examples) | California Civil Code § 1798.82 — notice to affected California residents within 30 calendar days of discovery or notification of the breach, with extensions for law enforcement needs and to determine the scope of the breach; for a breach affecting more than 500 California residents, a sample copy of the notice to the Attorney General within 15 calendar days of notifying residents. Read on 20 October 2026 in the Legislature's chaptered text of SB 446 (Chapter 319, Statutes of 2025, approved 3 October 2025); this section as amended takes effect on 1 January 2026, as California statutes do unless they say otherwise. Confirm the current text. This is one State's rule, given as an example; every other State has its own | RD-25 and RD-26: a second State's rule, as an example |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2016/679 (GDPR); Regulation (EU) 2022/2554 (DORA), Delegated Regulations (EU) 2024/1772 and 2025/301, Implementing Regulation (EU) 2025/302