Joint Release/Agencies Propose Requirement for Computer Security Incident Notification — 2020-12-18

Board of Governors of the Federal Reserve System Joint Release Federal Deposit Insurance Corporation Office of the Comptroller of the Currency Agencies Propose Requirement for Computer Security Incident Notification Federal financial regulatory agencies today announced a proposal that would require supervised banking organizations to promptly notify their primary federal regulator in the event of a computer security incident. In particular, alerts would be required for incidents that could result in a banking organization’s inability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of a banking organization, or impact the stability of the financial sector. The proposed rule is intended to provide the agencies with an early warning of significant computer security incidents and would require notification as soon as possible and no later than 36 hours after a banking organization determines that an incident has occurred.