Every US reporting deadline depends on early detection.
Sourced guidance on CISA, SEC, banking and card-brand deadlines, and a managed detection service built to meet them.
The reporting clocks, side by side
Each clock has its own trigger: awareness, determination or payment.
- 0h Detection Everything downstream depends on how early this happens.
- 24h Ransom payment report CIRCIA, after payment. EU CRA early warning for exploited product flaws.
- 36h Bank regulator notice OCC, FDIC, Fed, after determining a notification incident.
- 72h Substantial incident report CIRCIA to CISA, after reasonable belief an incident occurred.
- 4business days Form 8-K Item 1.05 SEC, four business days after materiality is determined.
Three regulatory fronts. One detection problem.
Each guide states what the rule requires, when the clock starts, what evidence a regulator or auditor will expect, and where detection and response decide whether you meet it.
- 01
Federal & critical infrastructure incident reporting
CIRCIA, CISA and the 72-hour reporting window for substantial cyber incidents in critical infrastructure.
- CIRCIA (72h / 24h ransom payment)
- CISA reporting
- EU CRA early warning (24h)
- 02
SEC & banking cyber disclosure
Form 8-K Item 1.05, Regulation S-K Item 106 and the 36-hour banking notification rule.
- Form 8-K Item 1.05
- Regulation S-K Item 106 (10-K)
- OCC / FDIC / Fed 36-hour rule
- 03
Data privacy & payment security
PCI DSS 4.0.1, the HIPAA Security Rule and California privacy law: logging, MFA and audit-ready evidence.
- PCI DSS 4.0.1 Req. 8, 10, 11
- HIPAA Security Rule
- CCPA / CPRA & Delete Act
The deadline is legal. The delay is operational.
Reporting rules give you a fixed number of hours or business days. In practice, most of that time disappears before anyone in the boardroom knows there is a decision to make: alerts wait in a queue, scope is unclear, logs are missing or sit with a vendor.
MDR Detect works on the front of that timeline, so counsel, the CFO and the board get facts while the clock still has room.
- DetectAnalysts watch your environment 24/7 and triage alerts before they age.
- ScopeAffected systems, data and business processes are established from raw logs, not summaries.
- DecideLegal and executive teams receive a fact pattern they can use for materiality and "substantial incident" decisions.
- ReportTimeline, indicators and impact are ready for the CISA report, the 8-K or the bank regulator notice.
- ProveEvery action is logged and kept in your own storage, ready for auditors, QSAs and examiners.
Detection that holds up under regulatory scrutiny.
A regulator, an auditor or a plaintiff's lawyer may read your incident record one day. We run detection and response with that reader in mind.
Your logs stay yours
Telemetry and evidence remain in your environment and retention policy. No lock-in, and nothing to recover from a vendor during an investigation.
Named analysts
Every incident has an owner, a timeline and a sign-off. Your CISO talks to the person doing the work.
Evidence by default
Detection, triage and containment steps are recorded as they happen, in a form counsel and auditors can use.
Fits your stack
Works with the security tooling you already run across IT, OT and cloud. No rip-and-replace.
Know where your hours go before a regulator asks.
A 30-minute briefing with a senior analyst. We walk through your detection and escalation path against the deadlines that apply to you. No slide deck, no obligation.