Regulatory context
Where a vulnerability triggers a legal reporting or disclosure clock, by region. Our plain-language summary — verify against the linked source. Your region is highlighted; switch it in the header.
Last updated: 23 August 2026 00:24 UTC
🇺🇸 United States
SEC cyber-incident disclosure (Item 1.05)
Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within 4 business days of determining it is material.
CISA BOD 22-01 (federal KEV remediation)
US federal civilian agencies must remediate vulnerabilities in the CISA KEV catalog by the due date CISA assigns — a de-facto industry benchmark.
🇪🇺 European Union & UK
NIS2 incident reporting (active exploitation)
Active exploitation triggers mandatory incident-reporting obligations under NIS2 Article 23 for EU operators of essential and important entities (24-hour early warning, 72-hour update, 1-month final report). UK NIS Regulations 2018 impose equivalent timelines on designated operators of essential services.
EU Cyber Resilience Act — coordinated disclosure
Critical and high-severity vulnerabilities in products with digital elements may trigger coordinated-disclosure obligations under the EU Cyber Resilience Act (CRA, Regulation 2024/2847). Manufacturers placing products on the EU market must notify ENISA and the relevant CSIRTs without undue delay once active exploitation is known.
DORA — financial sector incident reporting
If this vulnerability affects ICT services supporting EU financial entities, the Digital Operational Resilience Act (DORA) requires major ICT-related incidents to be reported to the relevant competent authority on a harmonised timeline (initial notification within 4 hours of classification as major).
UK NIS Regulations 2018
Designated operators of essential services must report incidents to their competent authority under the UK NIS Regulations 2018, with NCSC as technical authority.
🌏 Asia-Pacific
🇯🇵 Japan — APPI (Act on the Protection of Personal Information)
Report qualifying personal-data breaches to the PPC promptly; sector incident guidance via METI and JPCERT/CC. Personal Information Protection Commission (PPC) →
🇦🇺 Australia — Security of Critical Infrastructure Act (SOCI)
Critical-infrastructure operators must report cyber incidents to ASD/ACSC — 12 hours for a significant impact, 72 hours for a relevant impact. Australian Signals Directorate / ACSC →
🇸🇬 Singapore — Cybersecurity Act 2018 + PDPA
Critical-information-infrastructure owners report incidents to CSA; PDPA requires notifiable data breaches be reported to the PDPC within 72 hours. Cyber Security Agency of Singapore (CSA) →
🇮🇳 India — CERT-In Directions (2022)
Report specified cyber incidents to CERT-In within 6 hours of detection; retain logs for 180 days. Indian Computer Emergency Response Team (CERT-In) →
🇰🇷 South Korea — PIPA / Network Act
Notify affected users and the PIPC/KISA of personal-data breaches without undue delay. Personal Information Protection Commission / KISA →