Computer-Security Incident Notification

A banking organization is required to notify its primary Federal banking regulator of any “computer-security incident” that rises to the level of a “notification incident,” as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. A bank service provider is required to notify each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident, that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.

The latest form for Computer-Security Incident Notification expires 2028-05-31 and can be found here.

Reporting Section 225.302

Federal Enterprise Architecture: Economic Development - Financial Sector Oversight