Before the 36-hour clock: deciding which bank incidents count

The week

On January 12, 2021, the OCC, the Federal Reserve and the FDIC published in the Federal Register a joint proposed rule on computer-security incident notification. The agencies had approved it in December 2020, in the same weeks that the SolarWinds compromise was disclosed.

The proposal would require a banking organization to notify its primary federal regulator within 36 hours of believing in good faith that a significant computer-security incident had occurred. Bank service providers would have to notify their bank customers promptly about incidents that could materially disrupt services. The agencies finalized the rule in November 2021. They kept the 36-hour window, measured from the bank’s determination that a notification incident has occurred, and set a compliance date of May 1, 2022.

Banks were not new to incident reporting. Suspicious activity reports, state breach laws and, for New York-regulated institutions, the state cybersecurity regulation’s 72-hour notice already applied. The federal proposal was different in two ways. It focused on operational disruption, not data exposure, and it reached into the vendor relationship. That created three separate problems for banks: classifying the event, hearing from vendors in time, and reconciling the federal clock with every other one.

Classifying the event

The final rule defines a notification incident by its effect. It is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to, a bank’s ability to operate or deliver services to a material portion of its customers. Disruption to business lines or operations whose failure would matter more widely also qualifies. The 36 hours run from the bank’s determination, not from the first alert.

That design avoids a flood of notices about routine events. It also puts weight on a decision many banks had never formalized. Who makes the determination? On what criteria? How is the timing recorded, so an examiner can later see it was not delayed to manage the clock?

Banks that handled the rule well wrote down the answers in advance:

• A named decision-maker and deputy, usually in operational risk or the chief information security officer’s office, with authority to decide without convening a committee.
• Criteria tied to critical services. The bank defines which services matter, such as payments, deposit access, lending and online banking, and what level of outage for each counts as material.
• A decision log. The incident record captures when the determination was made, by whom, on what facts, and why earlier facts did not meet the threshold.

The criteria force a question that predates the rule: which services are critical, and what counts as a material portion of customers? Institutions that had mapped critical business services for operational resilience could answer quickly. Others found the notification rule required that mapping anyway.

The trade-off runs both ways. A bank that sets thresholds low will notify often, which costs little because the notice is short and informal. A bank that sets them high risks being asked why it waited. Most found that erring toward early notice was the cheaper mistake, because regulators had made clear the first notice was meant to be brief.

Hearing from vendors in time

The second requirement applies to service providers covered by the Bank Service Company Act. Under the final rule, a provider must notify each affected bank customer as soon as possible after it determines that an incident has materially disrupted or degraded covered services, or is reasonably likely to, for four or more hours.

This mattered because so much bank technology runs at core processors, digital banking providers, payment processors and cloud platforms. A bank cannot classify an incident it does not know about. The rule gave banks a regulatory basis for a demand that had been hard to enforce through contracts alone: tell us promptly, through a channel we will actually see.

The work fell to vendor management, and it was more detailed than adding a clause. Banks had to identify which providers were covered and confirm who at each would send notices. The notices then had to reach the people making the classification decision, not a shared mailbox read the next morning. A useful test is to ask each critical provider to send a test notice, then measure how long it takes to reach the decision-maker. Contract renewals are the moment to align notice terms with the rule and to require that contacts be tested, not only listed.

Vendor notices also change the classification problem. A four-hour outage at a core processor may hit dozens of banks at once. Each bank must make its own determination, and each may reach a different answer depending on its customers and alternatives. A bank that has thought through its vendor outage scenarios in advance decides faster.

Reconciling the clocks

The federal rule did not replace other obligations. One incident at a New York state-chartered bank could trigger the federal 36-hour notice and the state’s 72-hour notice. It could also require state breach notices if personal data were involved, card network reporting and suspicious activity reporting. Later, listed banks also had to consider the SEC’s 2023 requirement to disclose material cybersecurity incidents within four business days of a materiality determination.

Each regime has its own definitions, triggers and recipients. Treating each as a separate procedure invites a missed notice in the confusion of a live incident. A single incident record with a decision matrix works better. It lists every potential obligation, its trigger, its deadline and its owner, and the team reviews it at set points during the response. Organizations should check with counsel on how the triggers interact for their charter and listing status.

With hindsight

The rule took effect in 2022 without significant disruption. Because the 36-hour notice is short and informal by design, it signals that something is wrong without requiring a full report, which has kept it workable in severe events.

The vendor provision mattered in the incidents that followed. Ransomware and outages at technology providers serving many community banks and credit unions disrupted several institutions at once. Credit unions are not covered by this rule; the NCUA adopted its own 72-hour reporting requirement, effective in September 2023. The SEC’s disclosure rule followed in December 2023, and CISA’s rule under the 2022 critical infrastructure reporting law was still pending as of this writing.

Across finance and beyond, regulators have converged on fast, early notice of disruption, separate from slower breach and disclosure processes. Institutions that run notification as one capability with one incident record handle the overlap best.