27.3 Customer Incident Notices and Regulatory Notification Clocks

Definition of Sensitive Customer Information

Sensitive customer information is defined under Supplement A as a customer's name, address, or telephone number in conjunction with any one or more of the following:

• Social Security Number (SSN);
• Driver's license number or state identification card number;
• Account number, credit card number, or debit card number;
• Personal Identification Number (PIN) or security access code; or
• Password or credentials that would permit access to the customer's account.

It also includes any combination of components of customer information that would allow someone to log onto or access the customer's account (such as user identification and security question answers).

Notice Delivery Timing and Law Enforcement Delay

• Delivery Timing: Notice must be delivered in a clear and conspicuous manner as soon as possible after the institution concludes its investigation to determine the likelihood of misuse and has taken necessary containment measures.
• Law Enforcement Delay Exception: Delivery of customer notice may be delayed only if an appropriate law enforcement agency determines in writing that notification will impede a criminal investigation and formally requests a temporary delay.

A customer notice should be clear and conspicuous, describe the incident and the types of information involved, and give a telephone number for assistance. Explain protective measures and steps the consumer can take. Depending on circumstances, include additional information on reports, fraud alerts and FTC assistance. The guidance permits delivery methods designed to ensure actual receipt, including mail, telephone or electronic means for customers with valid addresses who agreed to electronic communications; it does not prescribe one universal five-item format.

---

4. Computer-Security Incident Notification Rule (12 CFR Part 53 / Part 225 / Part 304)

Promulgated jointly by the OCC, Federal Reserve Board, and FDIC (effective May 1, 2022), this regulation establishes separate, rapid operational notification mandates designed to maintain supervisory situational awareness of systemic cyber threats.

Banking Organization 36-Hour Notification Mandate

A banking organization must notify its primary federal banking regulator of any "computer-security incident" that rises to the level of a "notification incident" as soon as possible and no later than 36 hours after the bank determines that a notification incident has occurred.

Definition of Notification Incident

A computer-security incident constitutes a notification incident if it has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's:

1. Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base;
2. Business lines that, upon failure, would result in a material loss of revenue, profit, or franchise value; or
3. Operations, the failure of which would pose a threat to the financial stability of the United States.

Examples of Notification Incidents: Large-scale ransomware attacks encrypting core banking servers; massive distributed denial of service (DDoS) attacks disabling consumer online and mobile banking for extended durations; or system-wide mainframe hardware failures halting check clearing or wire processing.

Bank Service Provider 4-Hour Notification Mandate

A bank service provider that provides covered operational or IT services to a banking organization must notify each affected bank customer as soon as possible when the service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for 4 or more hours.

---

5. Comparison: GLBA Supplement A vs. Computer-Security Incident Notification Rule

Investigate unauthorized access to sensitive customer information. When the bank determines misuse has occurred or is reasonably possible, notify affected customers as soon as possible. A properly authorized law-enforcement delay may apply when notice would impede an investigation. Unauthorized access is an important trigger for investigation but does not automatically make every incident subject to customer notice. The separate 36-hour regulator-notification rule starts when the bank determines a notification incident occurred, not necessarily at the first alert. Service providers have a separate prompt notification obligation for qualifying service disruption or degradation lasting, or reasonably likely to last, four or more hours.