Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers

Document 2021-25510 is a Final Rule published by the Federal Reserve System in the Federal Register on November 23, 2021, with an effective date of April 1, 2022. The OCC, Board, and FDIC are issuing a final rule that requires a banking organization to notify its primary Federal regulator of any ``computer-security incident'' that rises to the level of a ``notification incident,'' as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred. The final rule also requires a bank service provider to notify each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours. View the original at https://www.federalregister.gov/documents/2021/11/23/2021-25510/computer-security-incident-notification-requirements-for-banking-organizations-and-their-bank.

No. Document 2021-25510 is not classified as economically significant under Executive Order 12866. Economically significant rules require OIRA review and are estimated to have impacts of $100 million or more per year.