Mandatory Cyber Incident Reporting Timelines: What Organizations Need to Know

A cyberattack can unfold in minutes, but missing a reporting deadline can create consequences long after the threat has been contained.

For organizations handling sensitive information or operating in regulated industries, incident response involves more than identifying and stopping an attack. It also requires knowing when an incident must be reported, who must be notified, and what information must be provided.

The challenge is that reporting deadlines can begin before an investigation is complete. Understanding these requirements and establishing clear notification procedures is essential to maintaining compliance.

What is mandatory cyber incident reporting?

Mandatory cyber incident reporting is the legal, regulatory, or contractual obligation to notify designated authorities or affected parties when a cybersecurity incident meets specific criteria.

Not every security alert requires notification, and reporting obligations generally depend on factors such as unauthorized access, compromised information, operational disruption, or the effect on critical systems.

Three factors determine how an organization must respond:

• Reporting trigger: The discovery or determination that starts the reporting clock.
• Reporting deadline: The time allowed to submit the required notification.
• Reporting recipient: The regulator, government agency, or affected party that must receive the report.

Some deadlines begin upon discovery, while others begin only after an organization determines that an incident meets a regulatory threshold.

Cyber incident reporting timelines by regulation

Several major U.S. regulations and international requirements establish different reporting deadlines.

These requirements may overlap, meaning one incident can trigger multiple reporting obligations.

Defense contractors: DFARS 252.204-7012

Under DFARS 252.204-7012, covered Department of Defense contractors must report qualifying cyber incidents within 72 hours of discovery.

The requirement applies to incidents involving covered contractor information systems, covered defense information, or the contractor's ability to provide operationally critical support. Contractors must submit reports through the DoD's designated reporting portal and maintain a DoD-approved medium assurance certificate for reporting access.

The clause also requires contractors to review affected systems, preserve relevant system images and monitoring data for at least 90 days after reporting, and support additional DoD investigation requests.

For defense contractors pursuing CMMC compliance, these reporting obligations remain distinct from CMMC assessment requirements.

Financial institutions: The 36-hour rule

Certain federally regulated banking organizations must notify their primary federal regulator as soon as possible, and no later than 36 hours after determining that a notification incident has occurred.

A notification incident involves a computer-security event that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, certain banking operations, business lines, or financial stability. For example, a ransomware attack that significantly disrupts customers' access to banking services may meet this threshold.

The rule also requires covered bank service providers to notify designated banking contacts as soon as possible when a qualifying incident causes, or is reasonably likely to cause, a material service disruption lasting four or more hours.

Public companies: SEC cybersecurity disclosures

Public companies subject to SEC reporting requirements generally must disclose material cybersecurity incidents within four business days after determining that the incident is material.

Materiality is assessed based on whether a reasonable investor would consider the incident important, taking into account factors such as financial losses, operational disruption, and reputational consequences.

The SEC requires organizations to make materiality determinations without unreasonable delay after discovery. Companies cannot indefinitely postpone that decision while completing an investigation.

Required disclosures generally address the incident's material nature, scope, timing, and actual or reasonably likely impact. Limited disclosure delays may be permitted when the U.S. Attorney General determines that immediate reporting would pose a substantial risk to national security or public safety.

Healthcare organizations: HIPAA breach notifications

Under HIPAA's Breach Notification Rule, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach of unsecured Protected Health Information (PHI).

Notification requirements vary depending on the number of individuals affected:

• 500 or more individuals: Notify HHS without unreasonable delay and within 60 calendar days of discovery.
• Fewer than 500 individuals: Maintain a breach log and report to HHS within 60 days after the end of the calendar year.
• Business associates: Notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, unless a shorter contractual deadline applies.

Breaches affecting more than 500 residents of a state or jurisdiction may also require media notification.

HIPAA's discovery standard includes breaches that an organization reasonably should have known about through appropriate diligence, making timely detection and escalation particularly important.

International operations: GDPR reporting

Under Article 33 of the General Data Protection Regulation (GDPR), organizations acting as data controllers generally must notify the appropriate supervisory authority within 72 hours after becoming aware of a personal data breach, where feasible, unless the breach is unlikely to create a risk to individuals' rights and freedoms.

A reportable personal data breach may involve unauthorized access, disclosure, alteration, loss, or destruction of personal information.

When a breach is likely to create a high risk to affected individuals, Article 34 generally requires notification to those individuals without undue delay, subject to specified exceptions.

Organizations reporting after the 72-hour window must provide reasons for the delay.

Critical infrastructure: CIRCIA reporting requirements

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) establishes a federal reporting framework for significant cybersecurity incidents affecting covered critical infrastructure entities.

Under the statutory framework, covered organizations will be required to report:

• Covered cyber incidents: Within 72 hours after reasonably believing a covered incident occurred.
• Qualifying ransom payments: Within 24 hours after making the payment.

As of October 2026, CIRCIA's mandatory reporting requirements are not yet in effect. Implementation depends on CISA's final rule, which will establish covered entities, reporting thresholds, and submission procedures.

Organizations in critical infrastructure sectors should monitor the rule's implementation and assess how it may interact with existing reporting obligations.

Building an incident reporting playbook

Meeting regulatory deadlines requires more than knowing the rules. Organizations need documented procedures that connect security investigations with compliance decisions and external notifications.

An effective reporting playbook should establish five steps:

1. Identify and document the incident. Record when suspicious activity was detected, which systems may be affected, and when the incident was escalated. Distinguish between detection, discovery, and regulatory determination timestamps.
2. Determine reporting obligations. Evaluate the incident against applicable regulatory and contractual thresholds, including the type of information affected, operational impact, and relevant reporting triggers.
3. Assign notification responsibilities. Identify who prepares, approves, and submits reports, including backup contacts for weekends and after-hours incidents.
4. Submit the required notification. Provide available information about affected systems, suspected attack methods, compromised data, operational impact, and containment actions, as required by the applicable rule.
5. Preserve evidence and manage follow-up. Retain relevant logs, system images, reporting confirmations, and communications. Track supplemental reports and additional information requests.

The playbook should also specify where notifications must be submitted, whether through a government portal, regulatory contact, or contractual reporting channel.

Organizations should not wait until an investigation is complete to begin evaluating reporting obligations. Early coordination between security, legal, and compliance teams helps prevent delays when the reporting clock is already running.

Metrics and documentation for reporting compliance

Accurate documentation allows organizations to demonstrate that reporting obligations were evaluated and completed within the required timeframe.

Incident records should capture the sequence of events from detection through notification, including the reasoning behind reportability decisions.

Organizations should also retain incident investigation notes, applicable regulatory assessments, copies of notifications, submission receipts, and follow-up correspondence.

Documenting decisions not to report can be equally important. If an incident is later reviewed by regulators or contracting authorities, the organization should be able to explain why it did not meet the applicable reporting threshold.

Retention periods should follow relevant contractual and regulatory requirements rather than a single organization-wide assumption.

Strengthen incident response before an incident occurs

Mandatory cyber incident reporting is an important part of an organization's broader incident response strategy. Understanding applicable deadlines, maintaining accurate documentation, and establishing clear notification procedures can reduce compliance risks when a security incident occurs.

At RADICL, we help organizations strengthen their security operations through continuous monitoring, threat detection, and incident response support. Our approach helps teams identify suspicious activity earlier, investigate threats, and respond effectively when incidents occur.

Learn how RADICL can help your organization strengthen incident response capabilities and prepare for evolving cybersecurity threats.