Regulatory context
Where a vulnerability triggers a legal reporting or disclosure clock, by region. Our plain-language summary — verify against the linked source. Your region is highlighted; switch it in the header.
Last updated: 16 October 2026 10:19 UTC
Where a Clock is shown it comes from our deadline register, which is the one place we write a reporting deadline down. An entry with no clock line means we hold no register row for it — not that it carries no deadline.
🇺🇸 United States
SEC cyber-incident disclosure (Item 1.05)
Public companies must disclose a material cybersecurity incident on Form 8-K Item 1.05 within 4 business days of determining it is material.
Clock: 4 business days from materiality determination
CISA BOD 22-01 (federal KEV remediation)
US federal civilian agencies must remediate vulnerabilities in the CISA KEV catalog by the due date CISA assigns — a de-facto industry benchmark.
A remediation deadline per KEV entry, not a reporting clock; CISA sets the date on each catalog entry.
🇪🇺 European Union & UK
NIS2 incident reporting (active exploitation)
Active exploitation triggers mandatory incident-reporting obligations under NIS2 Article 23 for EU operators of essential and important entities (24-hour early warning, 72-hour update, 1-month final report). UK NIS Regulations 2018 impose equivalent timelines on designated operators of essential services.
Clock: 24h early warning; 72h notification; 1-month final (per national law)
EU Cyber Resilience Act — coordinated disclosure
Critical and high-severity vulnerabilities in products with digital elements may trigger coordinated-disclosure obligations under the EU Cyber Resilience Act (CRA, Regulation 2024/2847). Manufacturers placing products on the EU market must notify ENISA and the relevant CSIRTs once active exploitation is known, on a staged deadline that commenced 11 September 2026.
Clock: 24h early warning; 72h notification; 14-day final (from 2026-09-11)
DORA — financial sector incident reporting
If this vulnerability affects ICT services supporting EU financial entities, the Digital Operational Resilience Act (DORA) requires major ICT-related incidents to be reported to the relevant competent authority on a harmonised timeline (initial notification within 4 hours of classification as major).
Clock: 4h/24h initial; 72h intermediate; 1-month final
UK NIS Regulations 2018
Designated operators of essential services must report incidents to their competent authority under the UK NIS Regulations 2018, with NCSC as technical authority.
Clock: without undue delay and no later than 72h after awareness, to the competent authority (reg 11(3))
🌏 Asia-Pacific
🇯🇵 Japan — APPI (Act on the Protection of Personal Information)
Report qualifying personal-data breaches to the PPC promptly; sector incident guidance via METI and JPCERT/CC. Personal Information Protection Commission (PPC) →
Clock: preliminary report to PPC promptly (PPC guideline: within 3-5 days); final report 30 days (60 days where the cause is malicious) (in force since 2022-04-01)
🇦🇺 Australia — Security of Critical Infrastructure Act (SOCI)
Critical-infrastructure operators must report cyber incidents to ASD/ACSC — 12 hours for a significant impact, 72 hours for a relevant impact. Australian Signals Directorate / ACSC →
Clock: 12h significant impact (written follow-up 84h); 72h relevant impact; to ASD/ACSC
🇸🇬 Singapore — Cybersecurity Act 2018 + PDPA
Critical-information-infrastructure owners report incidents to CSA; PDPA requires notifiable data breaches be reported to the PDPC within 72 hours. Cyber Security Agency of Singapore (CSA) →
Clock: 2h for essential-service disruption (amended Act)
🇮🇳 India — CERT-In Directions (2022)
Report specified cyber incidents to CERT-In within 6 hours of detection; retain logs for 180 days. Indian Computer Emergency Response Team (CERT-In) →
Clock: 6h (in force since 2022)
🇰🇷 South Korea — PIPA / Network Act
Notify affected users and report to the PIPC/KISA on a statutory deadline; a 2026 amendment effective 11 September widened the trigger to the possibility of a breach. Personal Information Protection Commission / KISA →
Clock: 72h to notify data subjects and report to PIPC (1,000+ subjects, sensitive data, or external unauthorised access); trigger widened to 'possibility of a breach' by the 2026 amendment (in force; amendment effective 2026-09-11)