Computer Security Incident Notification Requirements

The Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve System (Board), and the Federal Deposit Insurance Corporation (FDIC) (collectively, the agencies) are issuing a notice of proposed rulemaking (the proposal or proposed rule) that would require a banking organization to notify its primary federal regulator upon the occurrence of a significant computer security incident. This notification requirement is intended to serve as an early alert to a banking organization’s primary federal regulator and is not intended to include an assessment of the incident. The proposed rule would allow a banking organization to authorize or contract with a bank service provider to allow the bank service provider to make the relevant notifications to the banking organization’s primary federal regulator on the banking organization’s behalf. Moreover, a bank service provider as defined herein and in accordance with the Bank Service Company Act (BSCA) would be required to notify affected banking organization customers within four hours of when it experiences a computer-security incident that it reasonably believes could disrupt, degrade, or impair services provided subject to the BSCA for four or more hours. “Bank service providers” would include both bank service companies and third-party service providers, under the BSCA.

The latest form for Computer Security Incident Notification Requirements expires 2028-02-29 and can be found here.

Notification Incident Reporting

Federal Enterprise Architecture: Economic Development - Financial Sector Oversight