On December 18, 2020, the Office of the Comptroller of the Current (OCC), Federal Reserve Board (FRB), and Federal Deposit Insurance Corporation (FDIC) announced an interagency notice of proposed rulemaking that would require supervised banking organizations to provide notification of significant computer security incidents to their primary federal regulator. Under the proposed rule, for incidents that could result in a banking organization’s inability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of a banking organization, or impact the stability of the financial sector, the banking organization must notify its primary federal regulator no later than 36 hours after determining an incident has occurred. Additionally, service providers to banking organizations would be required to notify at least two individuals at affected banking organization customers immediately after the bank service provider experiences a computer-security incident that it believes in good faith could disrupt, degrade, or impair services provided for four or more hours.
By requiring notice of these computer security incidents, the proposed rule broadens the type of reportable events that banking organizations and their service providers are required to report to federal agencies. The agencies stated that, “current reporting requirements related to cyber incidents are neither designed nor intended to provide timely information to regulators regarding such incidents.” Specifically, the agencies noted that the filing of Suspicious Activity Reports under the Bank Secrecy Act do not provide the agencies with sufficiently timely information about every notification incident, and notices under the Gramm-Leach-Bliley Act focus on incidents that result in the compromise of sensitive customer information and do not include the reporting of incidents that disrupt operations.
Comments on the proposal must be received within 90 days of publication in the Federal Register.