The Federal Deposit Insurance Corporation, Board of Governors of
the Federal Reserve System, and the Office of the Comptroller of
the Currency (the “prudential banking regulators”)
issued a final rule regarding the Computer-Security Incident
Notification Requirement.
The final rule requires that a “banking
organization” notify its primary federal regulator of a
“computer-security incident” that meets the level of a
“notification incident.” The notification must be given
to the primary federal regulator as soon as possible, and no later
than 36 hours after its determined that a notification incident has
happened. The final rule also contains a requirement that a
“bank service provider,” defined as a “bank
service company or other person that performs [services covered
under the Bank Service Company Act],” notify a banking
organization “as soon as possible when the bank service
provider determines that it has experienced a computer-security
incident that has
