Reporting obligations and their clocks

Seventy-two hours, and what it runs from

The defence clause requires rapid reporting within seventy-two hours of discovery. Two words in that sentence do work.

Discovery, not occurrence. The clock starts when you find out, which is frequently long after the event and is why the detection question matters commercially as well as technically.

Rapid is the standard; the seventy-two hours is the outer limit rather than the target.

You cannot report without a certificate

Submitting a report requires an approved medium assurance certificate. Obtaining one takes time, involves an external authority, and cannot be done during an incident.

This is the single most common way a supplier misses the deadline: not because they did not know about it, but because at hour six they discovered the submission required something they did not have.

Obtain it now, while nothing is happening, and check annually that it has not expired.

The other obligation in the same clause

Images and monitoring data covering the affected systems must be preserved for a period after the report, so that the government can request them.

Which means the instinct to rebuild the machine and get back to work is the instinct that destroys the thing you are required to keep. The entry on the first hour treats this properly.

Four more, running at the same time

Your customer's clause. A prime may require notification faster than the government does, and their clause is in your contract with them.

Data protection law. If personal data is involved, separate regimes with their own deadlines may apply, and in some jurisdictions those are also measured in hours.

Your insurer. Cyber policies commonly require prompt notification and can decline cover for late notice.

Any sector obligation you carry for other reasons.

These are not alternatives to each other. Work out which apply to you before you need to, and keep the list with the incident plan.

Six things, prepared in advance

The certificate. The list of clocks above. The template with the fields the report requires. The named person and deputy. The contact details for legal advice out of hours. And the paper copy, because a plan stored only on the affected network is not a plan.

Time a tabletop exercise

Run a scenario and measure how long it takes to reach a reporting decision and assemble the information the report needs. Most organisations doing this for the first time exceed the deadline in the exercise, which is the cheapest possible place to discover it.

The clocks that apply to you

Which obligations you carry depends on your contracts, your jurisdictions and the nature of the data. This entry describes the shape of the problem and nothing in it is legal advice; establish your own list with counsel and keep it current.

Elsewhere in when something happens

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.