INSIGHTS, THE MAP ITSELF
The notification clock map, on one page and behind nothing.
The whole map: no form, no address collected, nothing gated. Each row gives the duty, what starts it, its window, and who it does not reach, the column most versions leave out.
THE MAP
Fourteen duties, one row each.
Your charter, licenses and counterparties decide which rows are yours.
| Who owes it | What starts it | The window | Who it does not reach |
|---|---|---|---|
| Banking organizations | Determination Determining that a notification incident has occurred, not detecting one | 36 hours, to the primary federal regulator | Not credit unions. No asset size threshold, because the threshold sits in the materiality definition. |
| Bank service providers | Determination Determining that an incident has caused, or is reasonably likely to cause, a material disruption or degradation of covered services for four or more hours | As soon as possible, to each affected bank customer | Only providers of covered services to banking organizations. Scheduled maintenance, testing or software updates previously communicated to the bank are excluded. |
| Federally insured credit unions | Reasonable belief Reasonably believing a reportable cyber incident has been experienced | 72 hours, to NCUA | Not banks. No size exemption. Good faith activity at the system owner's or operator's request is outside it. |
| NYDFS Covered Entities | Determination Determining that a cybersecurity incident has occurred, which is narrower than a cybersecurity event | 72 hours, to the Superintendent | Holders of a DFS authorization only, and the 500.19(a) limited exemption does not remove this duty. Not a firm that merely lends to a New York resident. |
| NYDFS Covered Entities, extortion payment | Payment Making an extortion payment in connection with a cybersecurity event | 24 hours to the Superintendent, then a written explanation within 30 days, under 500.17(c) | Holders of a DFS authorization only. Not removed by the limited exemption. |
| Institutions covered by the FTC Safeguards Rule | Discovery Discovering a notification event at 500 or more consumers | 30 days, to the Federal Trade Commission | Not banks, savings associations or federally insured credit unions. No consumer count relieves it, but it triggers only at 500 or more. |
| SEC reporting companies | Determination Determining that a cybersecurity incident is material | Four business days, on Form 8-K | No application to private companies at all, which is most of this market. |
| Fannie Mae sellers and servicers | Identification Identification, or the reasonable conclusion that an incident may have occurred | 36 hours, to Fannie Mae, without undue delay | Contractual, not supervisory. Nobody outside a Fannie Mae relationship. No size threshold. |
| Freddie Mac Sellers and Servicers | Discovery Discovery of a security incident, including one affecting a third party | 48 hours, to Freddie Mac | Contractual. Nobody outside that relationship. No small company exemption of any kind. |
| Approved Ginnie Mae Issuers | Detection Detecting that a Significant Cybersecurity Incident may have occurred | 48 hours, to Ginnie Mae | Approved Issuers, subservicers included. A document custodian or other Ginnie Mae participant confirms its own position under the current memoranda. |
| FHA approved mortgagees | Determination Determining that a Reportable Cyber Incident has occurred, meaning one that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the ability to originate or service FHA insured mortgages | 36 hours, to the FHA Resource Center and HUD's Security Operations Center, under Mortgagee Letter 2024-23 | Only FHA approved mortgagees, bank and nonbank alike. Mortgagee Letter 2024-10 and its twelve hour clock were superseded on 2 December 2024. |
| Insurance licensees under an enacted Model #668 | Determination Determining that a cybersecurity event has occurred, where the state is the domicile or home state, or 250 or more of the state's consumers are involved and a further notice or harm test is met | 72 hours, to the commissioner | Only in a state that has enacted it, where the enacted text governs and states vary it. The conditions are on Insurance. |
| Louisiana insurance licensees | Determination Determining that a cybersecurity event involving nonpublic information has occurred, where Louisiana is the domicile or home state and harm is reasonably likely, or 250 or more Louisiana consumers are involved and a further test is met | Three business days, to the Commissioner of Insurance | Only Louisiana licensees. The program exemptions do not remove it. |
| Anyone holding residents' personal information | Discovery Discovery of a breach, as each state defines one | Varies by state. Louisiana: 60 days to residents, then 10 days to the Attorney General | Follows the residency of the affected individual, not the location of the business. Triggers and exemptions vary, so no general rule of state law can be stated. |
Each instrument is in full on Financial Services, Mortgage or Insurance, and dated on Sources.
WHY THE WORDS DIFFER
Which clock started, and when did it start.
The words are not synonyms, and no rule uses them loosely. One event can start one duty on one day and another two days later, with nothing changed but who concluded what.
| Word | What it asks | Rows that start there |
|---|---|---|
| Detection | Somebody or something noticed. No judgment yet. | Ginnie Mae |
| Identification | Or a reasonable conclusion an incident may have occurred; a counterparty's word, almost as early. | Fannie Mae |
| Discovery | Later. It attaches to a defined event, not an alert. | Freddie Mac, the FTC, state breach laws |
| Reasonable belief | Would a competent person, on what is known, conclude a defined incident probably occurred? | Credit unions |
| Determination | The latest and most demanding: the institution concludes a defined threshold is met. | Banks and their providers, NYDFS, FHA, Model #668, Louisiana, the SEC |
An extortion payment is a sixth start: an act, not a finding. None of the five is a technical question, and no tool answers one: each is a judgment made by a person, on a date, and recorded.
What the word means for each row.
- Banks
- Determines is the most demanding word. A tabletop that starts the clock when the alert fires rehearses the wrong moment; one that never reaches a determination rehearses none.
- Credit unions
- Reasonably believes comes earlier, so the same facts start a credit union's clock before a bank's, and one procedure for both charters is wrong for one. The judgment is the credit union's, exercised reasonably; the good faith exclusion covers authorized penetration testing.
- NYDFS
- It sits on top of the bank or credit union clock: a New York authorization means two clocks from one set of facts.
- FTC, 16 CFR 314.4(j)
- Discovering, and 30 days, not hours: the duty left until later, and most often missed. The 16 CFR 314.6 exception for fewer than 5,000 consumers does not reach it.
- SEC
- Registrants only; see Financial Services.
- Fannie Mae
- Almost as early as detection: a team that has concluded something may have happened is inside this window while every regulator clock is stopped.
- Freddie Mac
- Discovery includes a third party's incident, so the clock can start on a vendor's facts. It also reaches anyone handling Freddie Mac information or connecting to its systems.
- FHA
- Determined, as for a bank, but of operational disruption. An Issuer that is also an FHA mortgagee runs this clock and Ginnie Mae's from two different moments.
- Model #668
- Only where a legislature enacted it: the one row settled by geography first. The exemption below 10 employees reaches the written program alone; investigation and the 72 hour notice remain.
- Louisiana
- A shorter clock and a domicile harm test. The Louisiana program exemptions do not remove investigation or notice.
THREE ROWS TO READ TWICE
Three rows commonly reported wrongly.
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
The revenue limb of the limited exemption is not a New York revenue test: the entity's own revenue counts wherever earned, and only its affiliates' is limited to New York. Since the Second Amendment, 23 NYCRR 500.17(a) runs its 72 hours from determining that a cybersecurity incident has occurred; a cybersecurity event is wider, so a row written against it describes a duty nobody owes. Section 500.17 is not among the sections a limited exempt entity is relieved of: it owes the 72 hour notice and the 24 hour extortion payment notice in full.
Ginnie Mae APM 24-02
The word that keeps this clock workable is significant, and a row printed without it describes a duty nobody owes. A Significant Cybersecurity Incident is an event that actually or potentially jeopardizes the confidentiality, integrity or availability of information or a system, or violates or threatens to violate security policy, or has the potential to affect the Issuer's ability to meet its Guaranty Agreement obligations. Any one limb is enough.
HUD Mortgagee Letter 2024-23
A row printed from Mortgagee Letter 2024-10, with twelve hours from detection, describes a duty superseded on 2 December 2024. The current letter runs 36 hours from a determination of operational disruption, not a data event.
NOTICE TO PEOPLE
A separate body of law runs to residents.
The duties above run to regulators and counterparties. Every state also has a breach statute, differing in the data that triggers it, any risk of harm test, how long notice may take and when an official is told. The duty follows where the affected person lives, not where the business is, so customers in several states mean several clocks.
State data breach notification law, with Louisiana as the named example
Louisiana's Database Security Breach Notification Law at La. R.S. 51:3071 and following requires notice to affected residents no later than 60 days from discovery and notice to the Louisiana Attorney General within 10 days of that, subject to a risk of harm determination that must be documented and retained for five years, an encryption safe harbor, and an exemption for financial institutions complying with the federal banking regulators' GLBA guidance.
Reaches anyone holding a resident's personal information. Not a general rule: triggers and exemptions vary by state, and Louisiana's numbers are Louisiana's. For a bank or credit union complying with that GLBA guidance, the third limb is the one to read first.
Read the Louisiana Attorney General on the state duty named here
HOW TO USE IT
Build the composite timeline while nothing is happening.
- Keep your rows, and the ones you do not owe, with the reason. A duty established as not yours is one decision nobody makes at speed.
- Name a person against each trigger, not a department: who makes that judgment, the alternate, and the record they leave.
- Rehearse the moment, not the outage. Give the named people partial, ambiguous facts; ask whether their threshold is met. The answer may reasonably be no, and a documented no is an output.
- Keep the timeline as it happens: what was known, by whom and at what hour. Every duty is read against it.
No new tooling is needed; whoever owns the incident response plan writes most of it. Date your version, then read it once with counsel and once with whoever would be woken up: they find different gaps. Related: the seller servicer information security stack, Examination and Evidence Readiness for the evidence afterwards, and Cyber Defense for detection and response design.
Review area eight of the Full scope, readiness to respond, asks which of these clocks would start for you and who would make the call.
An AI system does not get its own row.
No duty carves out a technology. An incident in an AI system, or at the vendor running one, starts these clocks on the same triggers, and two rows expressly include third party incidents. The hard judgment is whether wrong output that reached a customer is a defect or an incident; settle it in writing in advance, in the AI Governance Program failure path, within AI Governance.
Sources
Each checked 23 September 2026.
- 12 CFR Part 53, Computer-Security Incident Notification, eCFR.
- 12 CFR Part 748, including 748.1(c), eCFR.
- 23 NYCRR Part 500, Second Amendment text, New York Department of Financial Services.
- 16 CFR Part 314, Standards for Safeguarding Customer Information, eCFR.
- HUD Mortgagee Letter 2024-23, Reportable Cyber Incidents, 2 December 2024, HUD.
- Fannie Mae Information Security and Business Resiliency Supplement, Fannie Mae.
- Freddie Mac Single-Family Seller/Servicer Guide, Chapter 1302, Freddie Mac.
- Ginnie Mae APM 24-02, Ginnie Mae.
- NAIC Insurance Data Security Model Law, Model #668, NAIC.
- La. R.S. 22:2506, notification to the Commissioner, Louisiana Legislature.
- Louisiana Database Security Breach Notification Law, La. R.S. 51:3071 and following, Louisiana Attorney General.
Work through your own version with us.
A name and an alternate against each trigger is a working session, not a deliverable. Bring your charter, licenses, contracts and whoever would be woken up; we work through which rows are likely yours.