Regulators Approve Cybersecurity Incident Reporting Notification Rule ("CIRN") For Banks

A Final Rule requiring banks to report certain cybersecurity incidents within 36 hours was approved by the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (Board), and the Office of the Comptroller of the Currency (OCC). April 1, 2022, is the Rule's effective date. According to the agencies, the new rule will "promote early awareness of emerging threats to banking organizations and the broader financial system," as well as "help the agencies react to these threats before they become systemic."

CIRN Rule Objectives

The Computer-Security Incident Notification Final Rule establishes computer-security incident notification requirements for banking organizations and their bank service providers. In support of the rule, the regulators note that computer-security incidents have become more common, particularly as cyberattacks targeting the financial services industry have increased in frequency and severity in recent