β οΈ Global incident reporting deadlines are tightening!!!
Regulators in the UK, EU, and USA now require structured incident reporting within hours - not days. If your team can't detect, classify, and communicate an incident within these windows, you face regulatory penalties, reputational damage, and personal liability.
π¬π§ UK Β· FCA PS26/2
4 hrs
PSP reporting deadline
πͺπΊ EU Β· DORA
4 hrs
Major ICT incidents
πΊπΈ USA Β· CSIN
36 hrs
Banking organisations
π¬π§ UK - FCA PS26/2
In force March 2027. PSPs: 4-hour initial report. Other firms: 24 hours. No firm met full FCA expectations in 2025 review.
πͺπΊ EU - DORA
In force January 2025. 4-hour notification. 22,000+ entities. Penalties up to 10% of turnover. Only 6.5% passed dry-run.
πΊπΈ USA - CSIN / CIRCIA
CSIN: 36 hours (since 2022). CIRCIA: 72 hours for critical infra. SEC: 4 business days for public companies.
40% of 2025 cyber incidents involved a third party. Board members can be held personally liable under DORA.
The common requirement across every regulation: structured, fast, documented incident communication.
Can your team do this today?
3-minute assessment β find out before a regulator does.