This post compares four incident reporting clocks as official pages state them: the NIS2 Directive, the Cyber Resilience Act (CRA), the US Securities and Exchange Commission (SEC) Form 8-K rule and the CIRCIA proposal. It uses the European Commission’s NIS2 and CRA pages, the SEC fact sheet and CISA’s CIRCIA page, read as of 9 October 2026. It is not legal advice.
Do the four reporting clocks start at the same moment?
No. The pages describe different starting points. The Commission says the NIS2 clock runs from when a company first becomes aware of an incident, and the CRA page uses the same trigger, becoming aware. The SEC fact sheet starts its four business day count from a different event: the determination that an incident is material. CISA’s page, for the CIRCIA requirement, counts from the time the entity reasonably believes the incident occurred.
The table restates the three rules that are in force or stated as requirements on their pages. CIRCIA is covered in its own section below.
| Topic | NIS2 | CRA | SEC Form 8-K |
|---|---|---|---|
| Clock starts | When the company first becomes aware of the incident | When the manufacturer becomes aware | When the registrant determines the incident is material |
| First report | Early warning within 24 hours | Early warning within 24 hours | Item 1.05 Form 8-K generally within four business days of the determination |
| Next step | Incident notification within 72 hours of becoming aware | Full notification within 72 hours | Most registrants: later of 90 days after publication or December 18, 2023 |
| Final report or exception | Final report no later than one month later | Final report: 14 days after a corrective measure for exploited vulnerabilities, within a month of the 72-hour notification for severe incidents | Delay possible if the Attorney General determines a national security or public safety risk |
The SEC column does not have the same stages as the other two. The fact sheet gives one filing deadline, a compliance start date and one stated exception, so the last two rows show those instead.
What does NIS2 say about the 24 hour, 72 hour and one month steps?
The Commission’s NIS2 questions and answers page says the Directive foresees a multiple-stage approach to incident reporting. Affected companies have 24 hours from when they first become aware of an incident to submit an early warning to the CSIRT or competent national authority. The page says the early warning should be followed by an incident notification within 72 hours of becoming aware, and a final report no later than one month later.
The page shows a last update of 29 June 2023. For where Member States stand, see our post on NIS2 transposition status and the court referrals. The Commission page also says the early warning allows companies to seek assistance, such as guidance or operational advice, if they request it.
What does the CRA reporting page say, and from when?
The Commission’s CRA reporting page, last updated on 11 September 2026, says that as of 11 September 2026 manufacturers are required to report actively exploited vulnerabilities and severe incidents impacting the security of products with digital elements. It says they need to submit an early warning within 24 hours of becoming aware, and a full notification within 72 hours.
The final report has two timings. The page says it is due no later than 14 days after a corrective measure is available for actively exploited vulnerabilities, and within a month from the 72-hour notification for severe incidents. Manufacturers report once through the CRA Single Reporting Platform, which the page says ENISA established and which is operational as of 11 September 2026. The notification goes to the CSIRT where the manufacturer has its main establishment.
The page adds that open-source software stewards are subject to reporting obligations from 11 December 2027. For more on this clock, see our posts on CRA reporting obligations and the 24-hour clock and Cyber Resilience Act key dates for 2026 and 2027.
How does the SEC four business day rule work?
The SEC fact sheet says new Form 8-K Item 1.05 requires registrants to disclose any cybersecurity incident they determine to be material. It says registrants must determine materiality without unreasonable delay following discovery and, if the incident is determined material, file an Item 1.05 Form 8-K generally within four business days of that determination.
The fact sheet names one exception. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission in writing. On compliance dates, it says registrants other than smaller reporting companies must begin complying on the later of 90 days after publication in the Federal Register or December 18, 2023. Smaller reporting companies must begin on the later of 270 days from the effective date or June 15, 2024.
The rule covers disclosure of a material cybersecurity incident, which can include a data breach. Our post on the SEC cybersecurity regulations covers the rule in more detail.
Is the CIRCIA reporting clock in force?
CISA’s page says CIRCIA requires CISA to develop regulations requiring covered entities to report covered cyber incidents to CISA no later than 72 hours from the time the entity reasonably believes the incident occurred. It also says CIRCIA requires regulations on reporting ransom payments within 24 hours of making them. The page says CISA’s proposed regulations for these requirements are reflected in the Notice of Proposed Rulemaking (NPRM), which CISA published in the Federal Register on April 4, 2024, with public comment open until July 3.
CISA’s page says it held four town hall meetings between June 15, 2026, and June 18, 2026, that multiple funding lapses impacted its rulemaking activity, and that it continues to work on the final rule. It gives no effective date. In the meantime, CISA encourages organizations to share information on cyber incidents voluntarily. For the latest, see our post on CIRCIA final rule status in 2026.
What checks follow from the stated clocks?
The pages do not tell any organization which rule applies to it, so these are questions to take to counsel, not conclusions. Which of the rules above could apply to the organization, and which starting point does each use: awareness, materiality, or reasonable belief? Does the incident response plan record the time of first awareness, since the NIS2 and CRA pages count from it? Who decides on materiality for the SEC rule, and how fast? For products with digital elements, is the manufacturer ready to use the CRA Single Reporting Platform, which the Commission says is operational as of 11 September 2026?
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.