NIST CSF 2.0, RespondRS.CO-02

Report a cybersecurity incident immediately to your immediate superior and to the Cuban Computer Incident Response Team (CuCERT), inside the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI), using the incident-report form the Reglamento's Annex III sets out.

If you hold a private data network, ensure that a cybersecurity event or incident affecting it is recorded, classified and reported to CuCERT.

Notify the Digital Security Authority without undue delay, and in any event within six (6) hours of becoming aware of a significant incident, with an early warning stating, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it may have a cross-border impact.

Follow with an incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact, including any indicators of compromise where available.

If you are in the higher-obligations regime, notify NÚKIB no later than 24 hours after detecting a qualifying cybersecurity incident, with an initial report giving your identifying details, basic incident data, and whether you believe the incident was caused by an unlawful intervention or could have a cross-border impact.

If you are in the lower-obligations regime, notify the Národní CERT on the same 24-hour clock instead, for a qualifying incident with significant impact on your service's provision.

Inform ARTCI immediately of any attack, intrusion or other disruption likely to impede your information system's proper functioning.

Notify the Autorité Nationale de Certification Électronique, and where applicable other bodies concerned, within twenty four hours of becoming aware of it, of every breach of security or loss of integrity having a significant impact on the trust service provided or on the personal data it stores.

Where the breach or loss of integrity is liable to harm a user of the service, notify that user as well, within twenty four hours.

Inform the Agence Nationale de Cybersécurité of every attack, intrusion or other penetration liable to impair the operation of another information system or network, so as to let the Agency take the measures necessary to address it, including isolating the affected system.

Notify your competent authority and Denmark's CSIRT of every significant incident, one that has caused or can cause serious operational disruption or financial loss for you, or has affected or can affect another person through significant physical or non-physical harm.

Send an early warning without undue delay, and no later than 24 hours after becoming aware of the significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.

Report a serious information-system security incident to the cybersecurity authority without delay, if you access data in Djibouti's national health data system as a health professional, health establishment, health-insurance financing body, or other body accessing that system.

Submit an initial report to RIA without delay and no later than 24 hours after becoming aware of a cyber incident that has, or could reasonably be expected to have, a significant effect on your system's security or your service's continuity, unless you are a security authority.

Follow with an incident report no later than 72 hours after becoming aware of the significant incident, updating the initial report, unless you are a qualified trust service provider, in which case you report in a single stage within 24 hours instead.

Immediately notify the Information Network Security Agency (now the Information Network Security Administration) and report the crime to the police, and take appropriate measures.

Notify the National Computer Emergency Response Center of a cyber incident within 48 hours of becoming aware of it, using the system the Administration establishes, and implement the mandatory recommendations or directions the Center provides within the time it sets.

Notify the CSIRT designated as coordinator for your main establishment and ENISA, through the single reporting platform, of any actively exploited vulnerability you become aware of in your product: an early warning within 24 hours of becoming aware, a vulnerability notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure becomes available.

Notify the same recipients of any severe incident affecting the security of your product on the same 24-hour early warning and 72-hour incident notification clock, followed by a final report within one month of the incident notification.

Report a major ICT-related incident to the competent authority your sector's Union law designates under Article 46, the European Central Bank through your national supervisor if you are a credit institution classified as significant, using the templates referred to in Article 20, and submit an initial notification as early as possible and in any case within four hours of classifying the incident as major, and no later than 24 hours from becoming aware of it.

Where classification as major comes later than that, submit the initial notification within four hours of the classification instead.

Notify your CSIRT, or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the incident notification.

Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.

Notify your supervisory authority without delay of a significant incident, one that has caused or could cause a serious service disruption or considerable financial loss to you, or that has affected or could affect another person with considerable material or immaterial damage.

File an early notification within 24 hours of detecting the significant incident, stating whether it is suspected to result from an unlawful or hostile act and the likelihood of cross-border effects, and a follow-up notification within 72 hours of detection, both clocks running from detection rather than from each other; if you are a trust service provider whose trust services are affected, file your follow-up notification within 24 hours instead of 72.

Declare to ANSSI, without delay after becoming aware of it, an incident affecting the networks and information systems necessary to provide your service, where the incident has or is likely to have a significant impact on the continuity of the service (an operator of essential services) or on the provision of the service in the European Union (a digital service provider).

Notify ANSSI without undue delay of any incident with an important impact on the provision of your services (one causing or liable to cause a severe operational disruption or financial loss for you, or considerable material, physical or non-material damage to another person), on a graduated clock: an initial notification within 24 hours of becoming aware of it, an intermediate notification within 72 hours updating the initial one and giving an initial assessment of severity and impact, a report on ANSSI's request, and a final report within one month (or, for an incident still being handled, a progress report at one month followed by a final report within one month of resolution).

Where you are a trust-service provider or one of the domain-name and registry services Articles 8(4) and 9(3) name, notify within 24 hours rather than 72 for the intermediate notification.

Where a particular risk of a breach of the security of your services persists despite your safeguards, inform your subscribers of the risk and of the measures they may take to protect themselves.

Identify in that notice any software or encryption technology available to the subscriber to protect the security of their communications.

Notify the BSI's and the Bundesamt für Bevölkerungsschutz und Katastrophenhilfe's joint reporting office without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating whether the incident is suspected to be unlawful or malicious or to have cross-border effect.

Follow with a full notification within 72 hours of becoming aware, confirming or updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.

Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.

Notify the CSIRT of the National Cybersecurity Authority, without undue delay and in any case within 24 hours of becoming aware of a significant incident, with an early warning stating whether unlawful or malicious action is suspected and whether the incident may have cross-border effects.

Follow within 72 hours of becoming aware of the significant incident with an incident notification updating the early warning and adding an initial assessment of its severity and effects.

Notify the national cybersecurity incident-handling centre (Nemzeti Kiberbiztonsági Intézet, the NKI) of a cyber threat, near-incident or cybersecurity incident affecting your electronic information system: an initial notification without undue delay and in any case within 24 hours of becoming aware, an event notification within 72 hours that updates that report and assesses the incident's severity and impact, and a final report no later than one month after the event notification.

Notify Iceland's national cybersecurity incident-response team as soon as may be about a serious incident or risk threatening the security of a network or information system; the Act sets no fixed hour-based clock of its own for this notification.

State in the notification the number of affected users, the incident's duration, its geographic spread and scale, any outsourcing arrangement relied on, and any possible cross-border contagion effect.

Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, or an attack through a malicious or fake mobile app, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.

Report the incident immediately, at the first opportunity, to law enforcement officials and the relevant Ministry or Agency; the Government Regulation states no numeric clock for this report, only immediacy.

Notify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on.

Notify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month.

Where appropriate, notify the recipients of your service of the incident and of any measures they can take in response.

Notify CSIRT Italia without unjustified delay, and in any event within 24 hours of becoming aware of a significant incident, with a pre-notification stating, where possible, whether the incident appears unlawful or malicious and whether it may have a cross-border impact.

Follow with a full notification within 72 hours of becoming aware, updating the pre-notification and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.

Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.

Immediately inform the National Computer and Cybercrimes Co-ordination Committee, established under section 4 of the Act, of an attack, intrusion, or other disruption to the functioning of another computer system or network, within twenty-four hours of the attack, intrusion, or disruption.

Include in the report a summary of how the breach occurred, an estimate of the number of people affected, an assessment of the risk of harm to them, and an explanation of any circumstance that would delay or prevent telling them.

When you are the subject of a cybersecurity incident or threat of one, gather information about it, assess the risk to your critical infrastructure, customers, suppliers and other stakeholders, take appropriate preventative, mitigating and remedial measures to limit that risk, and report all material information about a significant cybersecurity incident to the National CERT and any relevant Sectoral CERT within 24 hours after you detect it, in the form or manner the CERT prescribes.

As an operator of essential services, notify the Agency for Cyber Security immediately, and no later than 24 hours after becoming aware, of a cyber incident with a significant impact on system security or service continuity, and notify affected persons or the public within a reasonable time where individual notice is impractical.

As a digital service provider, notify the Agency for Cyber Security immediately upon becoming aware of a cyber incident with a significant impact on the digital service you provide.

Notify the sectoral regulator with jurisdiction over your sector no later than 72 hours after you discover the incident; if you notify later than that, explain the reason for the delay in the notice.

If you process data as a processor for a record owner, notify that record owner of an incident within the period your contract sets, and in any event no later than 48 hours after you discover it.

Immediately take all action necessary to contain a detected cyber incident, immediately inform the competent cyber incident prevention institution (in practice CERT.LV for most private-sector and civilian public-sector subjects), and follow its instructions.

For a significant cyber incident, electronically submit an early warning to the competent institution without delay and no later than within 24 hours of becoming aware of it.

Notify the Stabsstelle Cyber-Sicherheit (Cyber Security Office) without delay, and in any event within 24 hours of becoming aware of a significant security incident, with an early warning stating, where relevant, whether the incident is suspected to result from unlawful or malicious acts or to have cross-border effect.

Follow with a full notification within 72 hours of becoming aware, updating the early warning where relevant and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.

Notify NKSC of a significant cyber incident without delay and in any event within 24 hours of becoming aware of it.

Follow within 72 hours of becoming aware with the incident's severity and impact assessment and any evidence of compromise; report a minor incident within 72 hours without a separate 24-hour early warning.

Notify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person.

Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect.

Immediately notify the Director and the CSIRT-MH (the Cyber Security Incident Response Team of the Marshall Islands) of a significant cybersecurity incident affecting your critical information infrastructure, of a significant incident on any interconnected computer system under your control, or of any other incident type the Director specifies by written order.

Submit an early warning within twenty-four hours of becoming aware of the incident, a fuller notification with an initial severity and impact assessment within seventy-two hours, and a final report within thirty days of that notification, or, for an ongoing incident, a thirty-day progress report followed by a final report within thirty days of the incident's resolution.

Notify the Secretary of Justice and the CERT-FSM of a significant cybersecurity incident affecting your critical information infrastructure or an interconnected system: an early warning within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within 30 days of that notification.

On a cyber-attack or violation against your systems, notify the relevant center against cyber-attacks and violations, the Public center for a legal person outside the state information network and outside critical information infrastructure, and obtain assistance where necessary; the text states no numeric clock for this notice.

Where a cyber threat or incident has no effect on the continuity of your service, report it once a month to the Cybersecurity Agency (Article 29).

Where a cyber threat or incident could significantly affect the continuity of your service, submit an initial notification to the Cybersecurity Agency within 24 hours of becoming aware of it, on the prescribed form (Article 30).

Inform your clients of a vulnerability in your information systems, or of a breach that could affect them.

When you detect an event that could affect the security of a client's information systems, inform the national cybersecurity authority of it without delay.

Give your CSIRT and competent authority an early warning without delay, or within 24 hours of becoming aware of a significant incident if immediate reporting is not possible, stating whether the incident is suspected to result from unlawful or malicious action and whether it may have cross-border effects.

Follow with a notification, without delay or within 72 hours, updating the early warning with an initial assessment of the incident's severity and effects.

Notify the Superintendent electronically, in the form set forth on the Department's website, as promptly as possible but no later than 72 hours after you determine that a Cybersecurity Incident has occurred at your organization, an affiliate, or a third-party service provider: an event that requires notice to a government or supervisory body, that has a reasonable likelihood of materially harming a material part of your normal operations, or that results in the deployment of ransomware within a material part of your information systems.

Where you make an extortion payment in connection with a cybersecurity event, notify the Superintendent of the payment within 24 hours of making it, and within 30 days of the payment provide a written description of why the payment was necessary, the alternatives you considered, and the diligence you performed, including under Office of Foreign Assets Control rules.

Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.

Report the incident to the National CERT within 7 days of its occurrence. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.

Notify the competent sectoral CSIRT without delay, and in any event within 24 hours of detecting a significant incident, with an early warning.

Follow with a fuller notification within 72 hours of detection, a periodic report on the CSIRT's request, and a final report no later than one month after the 72-hour notification.

Notify the competent cybersecurity authority of any significant incident, weighing the number and share of users affected, the incident's duration, the severity of the service disruption and its economic and social impact.

Submit an initial notification without undue delay and within 24 hours of concluding that a significant incident exists or may exist, and, where necessary, update it within 72 hours with an initial assessment of the incident's severity and impact; if the incident resolves within two hours of detection, submit only the end-of-impact notification below.

Report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).

Submit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the CSIRT requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point.

Notify the single incident-reporting system, through the Ministry's or the Office for Information Security's website, of an incident that may significantly disrupt information security, without delay and at the latest within 24 hours of becoming aware of it.

If you operate a banking or financial-market ICT system, send that notification to the National Bank of Serbia, and also to the Securities Commission if it supervises you; if you provide an electronic-communications or postal service, send it to the Regulatory Body for Electronic Communications and Postal Services instead.

Immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.

Report the incident to the Team within 7 days of its occurrence even if you already gave the immediate notice section 53(1) requires; failing to do so, without reasonable excuse, is itself an offence distinct from any liability for the disruption reported.

Report without undue delay, and no later than 24 hours after becoming aware of it, an early warning of a significant cyber security incident, stating in particular whether it may have been caused by unlawful conduct or may have a cross-border effect.

No later than 72 hours after becoming aware of it, report a notification updating and completing the early warning, in particular an initial assessment of the incident's severity and impact.

Give your competent CSIRT group an early warning without delay, at latest within 24 hours of detecting a significant incident, stating whether it is suspected to result from an unlawful or malicious act and whether it may have a cross-border effect.

Follow with a full notification without delay, at latest within 72 hours, updating the early warning with an initial assessment of the incident's severity and impact and any available threat indicators, then an interim report if the CSIRT group asks for one, and a final report at latest one month after the 72-hour notification, or a progress report and a final report within one month of resolution if the incident is still ongoing at that point.

Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.

Expect a duty, once enacted, to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.

Expect a duty to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.

Notify the competent authority, through your reference CSIRT, without undue delay, of an incident that may have a significant disruptive effect on the provision of your service, whether on your own networks or a third-party provider's.

For a CRITICO-severity incident under the national notification instruction, notify immediately, follow up with an interim notification within 24 to 48 hours, and file a final notification within 20 days; for a MUY ALTO-severity incident, notify immediately, follow up within 72 hours, and file a final notification within 40 days; an ALTO-severity incident requires only an immediate initial notification.

Inform the authority the government designates (in practice the CSIRT-enhet at Försvarets radioanstalt) of a significant incident as soon as you can, and no later than 24 hours after becoming aware of it.

Follow with a formal incident notification to the same authority as soon as you can; if you provide a trust service, no later than 24 hours after becoming aware, and otherwise no later than 72 hours after becoming aware.

Notify the central competent authority in charge of the relevant sector as soon as the agency becomes aware of a cyber security incident.

Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.

File that report in the form the Minister CPR prescribes.

Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders.

Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.

Inform CERT-UA immediately (невідкладно, without delay; the statute states no fixed hour clock) of a cybersecurity incident affecting your critical infrastructure object's communication or technological systems.

If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred. A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.

If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more. This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.

Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.

Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.

Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.

If your organization is an SEC reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.

Notify the State Security Service of any cybersecurity incident or cybercrime affecting your information systems or resources as soon as it occurs; the statute sets no numeric deadline or severity threshold.

As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.

As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.