Federal Bank Regulators Approve New Cybersecurity Incident Notification Rule

Last month, the FDIC, Federal Reserve Board, and the OCC announced a final rule to improve information sharing about cyber incidents that may affect the U.S. banking system. Among other things, the final rule requires banking organizations to inform their primary federal regulator no later than 36 hours after a determination that a "computer-security incident" has reached the level of a "notification incident." The final rule notes that notification is required for incidents that have affected, in certain circumstances:

• the viability of a banking organization's operations;
• its ability to deliver banking products and services; or
• the stability of the financial sector.

In addition, the rule requires a bank service provider to notify banking organization customers as soon as possible when a computer-security incident occurs that "has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours." The final rule