The Clocks Startat Materiality
When a cyber incident hits, most companies know how to contain it. Fewer know, in writing, who decides whether it is material, how fast, and which regulators then need to hear. That decision starts the clocks, and several of them are now measured in days or hours.
The clocks that may apply to you
| Who | What starts the clock | Deadline |
|---|---|---|
| Public companies (SEC) | Deciding the incident is material, which must happen without unreasonable delay | Form 8-K within 4 business days |
| NYDFS-regulated companies | Determining a reportable cybersecurity incident occurred | 72 hours |
| Defense contractors (DFARS 7012) | Discovering a cyber incident affecting covered defense information | 72 hours |
| Critical infrastructure (CIRCIA) | Reasonably believing a covered incident occurred; paying a ransom | 72 hours; 24 hours for a ransom payment, once the final rule takes effect |
| Healthcare (HIPAA) | Discovering a breach of unsecured protected health information | Notice to individuals without unreasonable delay, and within 60 days |
Many companies face more than one. A public health system, for example, may owe the SEC, HHS and, once the CIRCIA rule takes effect, CISA, each on a different clock and in a different format.
Where it usually goes wrong
- No owner for the materiality call. Security finds the incident, legal worries about disclosure, finance worries about the stock, and nobody is clearly in charge of deciding.
- No criteria written down. Without agreed factors (data affected, operational impact, customers, regulators, reputation), every incident becomes a debate.
- No record of the decision. Regulators look at when you knew and when you decided. A decision log written at the time is your best evidence.
- Templates written during the crisis. Drafting notices under pressure costs the hours you don't have.
Five steps to be ready
- Name the decision group: security, legal, finance and a business leader, with a named chair and a backup.
- Write the materiality criteria and review them with your board or audit committee.
- Map every clock that applies to your company, with the regulator, format and contact for each.
- Pre-approve notice templates for each regulator and for customers.
- Run a tabletop exercise at least once a year, and keep the record. It is evidence too.
Prodigium builds incident reporting playbooks that cover every clock you face, and tracks them in the Prodigium Platform. Book a free 30-minute exposure call.
Sources: SEC cyber disclosure rules status; CIRCIA final rule and deadlines; NYDFS Part 500. DFARS 252.204-7012 and the HIPAA Breach Notification Rule (45 CFR 164.404) are published by DoD and HHS.
This article is general information, not legal advice. Deadlines depend on your facts; confirm with counsel.