[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is the Computer-Security Incident Notification Rule?](/blog/computer-security-incident-notification-rule) Publish date November 19, 2024 {x} minute read # What is the Computer-Security Incident Notification Rule? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Kyle Chin](/team/kyle-chin) Cybersecurity Writer Kyle's work has been featured in law publications, academic institutions, and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) The Computer-Security Incident Notification Rule requires US federal banking organizations and banking service providers to notify the [Office of the Comptroller of the Currency (OCC)](https://www.occ.gov/news-issuances/bulletins/2021/bulletin-2021-55.html) that a cybersecurity incident has occurred. The bank must ensure that the OCC receives this as soon as possible and no more than 36 hours after the incident has occurred. In the context of increasing [cyber attacks in the financial industry](https://www.upguard.com/blog/biggest-cyber-threats-for-financial-services) and a growing trend of using [third-party service providers](https://www.upguard.com/blog/third-party-risk-cyber-gaps), the Computer-Security Incident Notification Rule helps provide early awareness for the OCC so it can respond promptly to emerging threats to the broader financial system and ensure the financial stability of the United States. This post aims to help financial services organizations understand Computer-Security Incident Notification Rule requirements and how financial organizations can comply. ## What is Considered a Computer-Security Incident? The rule defines a **computer-security incident** as an occurrence harming the availability, integrity, or confidentiality of an information system or any information that the system processes, transmits, and stores. Any computer-security incident that is likely to significantly disrupt the bank’s operations, bank customers being unable to access their funds, or impact the stability of the broader financial sector falls under this category. This can include [cyber attacks](https://www.upguard.com/blog/cyber-attack), such as [DDoS](https://www.upguard.com/blog/what-is-a-ddos-attack) or [ransomware attacks](https://www.upguard.com/blog/ransomware), system failures, or [third-party security breaches](https://www.upguard.com/blog/what-is-third-party-risk). While similar notifications were required under the [Bank Secrecy Act](https://www.occ.treas.gov/topics/supervision-and-examination/bsa/index-bsa.html) and the [Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice](https://www.federalregister.gov/documents/2005/03/29/05-5980/interagency-guidance-on-response-programs-for-unauthorized-access-to-customer-information-and), they did not cover all computer-security incidents that the regulatory agencies must be informed about. ## What is Defined as a Banking Organization? Under the new rule, banking organizations have a few different classifications under various regulatory agencies. **According to the **[**OCC**](https://www.occ.gov/news-issuances/bulletins/2022/bulletin-2022-8.html#:~:text=A%20bank%20must%20notify%20the,hours%20after%20the%20bank's%20determination.)**, banking organizations include:** * National banks * Federal savings associations * Federal branches and agencies of foreign banks [Learn how to comply with the OCC's TPRM requirements >](https://www.upguard.com/blog/meeting-occ-tprm-requirements) **For the **[**Board of Governors of the Federal Reserve System (FRB)**](https://www.federalreserve.gov/supervisionreg/srletters/SR2204.htm#:~:text=The%20final%20rule%20defines%20a,deliver%20banking%20products%20and%20services)**, banking organizations include the following:** * State member banks * Any US operations of foreign banking organizations * US bank holding companies * Savings and loan-holding companies * Edge and agreement corporations **The **[**Federal Deposit Insurance Corporation (FDIC)**](https://www.fdic.gov/news/financial-institution-letters/2022/fil22012.html#:~:text=Bank%20service%20providers%20must%20notify,materially%20disrupt%20or%20degrade%2C%20services)** deems banking organizations as:** * Insured state nonmember banks * Insured state-licensed branches of foreign banking organizations * Insured state savings associations These definitions are consistent with the three agencies’ supervisory authorities. Banking organizations also include ALL third-party service providers, whether they are businesses or individuals, if they perform services covered by the Bank Service Company Act (BSCA), a regulation establishing rules about how financial institutions interact with some third-party service providers. See [USC Chapter 18](https://uscode.house.gov/view.xhtml?path=/prelim@title12/chapter18\&edition=prelim) for more information. Financial technology companies should check with their banking partners to determine whether or not they have been identified as bank service providers to a banking regulator and whether they are subject to the BSCA. ## What is a Notification Incident? A **notification incident** must be a significant computer-security incident that will or is likely to: 1. Last four hours or more 2. Disrupt a banking organization’s operations 3. Damage revenue, profit, or franchise value of any banking organization business lines, including support, services, and associated operations 4. Prevent customers from accessing accounts 5. Disrupt the stability of the financial sector A qualifying incident - an incident that has reached the level of a notification incident - might be a cybersecurity event like a [ransomware](https://www.upguard.com/blog/ransomware-examples) attack, a [distributed denial of service attack](https://www.upguard.com/blog/what-is-a-ddos-attack), or a major computer-system failure. A relevant cyber incident may be caused by hardware and software failure or human error. Therefore, if the bank is the victim of a [cyber attack](https://www.upguard.com/blog/cyber-attack), but the attack does not cause actual harm, does not significantly disrupt the ordinary course of business, and is unlikely to worsen or last for an extended period, the bank may not need to report to its regulatory body. If the banking organization deems a security incident has risen to the level of a notification incident, it must report it within **36 hours** of that determination. So, the countdown does not begin when the data breach starts; it begins when the bank considers the threat level is sufficient. ## Computer-Security Incident Notification Requirements Various OCC points of contact exist for banking organizations. They can communicate a notification incident to their primary Federal regulator, contact their supervisory office, or visit BankNet.gov. If the bank is unsure whether it is experiencing a notification incident, it should contact its supervisory office in the first instance. Banking organizations must also report a computer-security incident to **at least one bank-designated point of contact at each bank affected by the incident**. If the bank does not already have a designated point of contact, it should use any reasonable means to notify the bank’s Chief Executive Officer (CEO) and Chief Information Officer (CIO) or individuals of comparable responsibilities, such as a Chief Information Security Officer (CISO) and a Cybersecurity Director. For this reason, US banking organizations should ensure that the relevant contact information is up-to-date and easily accessible within the organization’s security policies and incident response plans. Lastly, the final rule states that bank service providers **must notify every one of their affected banking organization customers** following a notification-level incident. Designated financial market utilities, however, need not report under the Computer-System Incident Notification rule because they are regulated separately by the Federal Reserve. ## How UpGuard Can Help Banking Organizations Comply with the Computer-Security Incident Notification Rule UpGuard can help banking organizations and their third-party service providers comply with the Computer-Security Incident Notification Rule to quickly detect, monitor, mitigate, and remediate cyber threats and provide instant notifications should a notification-level threat arise. In addition, UpGuard also provides end-to-end risk management to help organizations lower their chances of a potential risk occurring and even monitor third parties to ensure they are meeting compliance standards and minimum security requirements. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)