US regulators have approved a new rule requiring banks to report any “significant” computer security incidents within 36 hours of discovery.
Banks must notify their primary federal regulator if the incident materially affects— or is likely to materially affect— the viability of their operations, their ability to deliver products and services, or the stability of the financial sector.
Additionally, banks are obligated to inform customers as soon as possible if the incident has, or is likely to, materially impact them for four or more hours.
Compliance with the rule— which has been approved by the Federal Reserve, FDIC, and OCC— is required by May 1, 2022.