The last few months have seen a flurry of new federal cybersecurity incident reporting requirements and proposals impacting private entities in the financial sector. As the number and frequency of cyber attacks continue to grow, regulators have attempted to enhance cybersecurity protections via increased and more rigid incident reporting obligations, leading to a constantly shifting regulatory patchwork of varying disclosure and timing obligations. These tightened reporting obligations raise new challenges for financial institutions who must not only ensure that their own programs are aligned with the new requirements, but also be certain to pass along reporting obligations to service providers.

The abrupt shift in reporting obligations comes after an extended period of time when most financial institutions faced consistent reporting obligations. In 2005, the federal prudential regulators—including the Board of Governors of the Federal Reserve System (Federal Reserve), Federal Deposit Insurance Corporation (FDIC), and Office of the Comptroller of the Currency (OCC)—issued Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice. Rather than specifying the number of hours or days within which a financial institution must report, the guidance allowed covered financial institutions to notify their primary federal regulator and affected customers “as soon as possible” after the discovery of incidents involving unauthorized access to or use of sensitive customer information.

Contrast this with the final rule issued by the Federal Reserve, FDIC, and OCC last November, which requires covered banking organizations to report within 36 hours after determining the occurrence of certain significant computer-security incidents. The final rule also requires bank service providers to notify their banking organization customers as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has or is likely to materially disrupt or degrade covered services for four or more hours.

Additionally, on March 15, 2022, President Joe Biden signed into law the Cyber Incident Reporting for Critical Infrastructure Act, previously covered here, which requires entities in a critical infrastructure sector (which can include financial institutions) to report to the Cybersecurity and Infrastructure Security Agency (CISA) certain cyber incidents within 72 hours and ransomware payments within 24 hours of the payment. The Securities and Exchange Commission (SEC) recently published several proposed rules that would require various regulated entities to disclose certain cybersecurity-related incidents. The Federal Trade Commission (FTC) also tossed its hat into the ring and issued a proposal last December to require covered financial institutions to notify the FTC within 30 days after discovering a data breach affecting or reasonably likely to affect at least 1,000 consumers.

Below is a summary of the new reporting obligations proposed or soon to be effective for financial institutions:

Managing and meeting these new deadlines—and keeping track of the different content and submission requirements associated with each disclosure—can be challenging. Additionally, these requirements may trickle down even to companies not directly regulated by the above agencies, as many financial institutions may consider new default rules, such as requiring 24-36 hour reporting across the board for their service providers. As the cybersecurity regulatory landscape continues to evolve, companies should review their third-party service provider arrangements and incident response plans and stay on top of legislative and regulatory developments to ensure they are in a good position to meet increased expectations and accelerated reporting timelines.

[View source.]