Cyber Security in Financial Services
Financial firms face the same attacks as other businesses, plus regulators who set tight deadlines and hold them responsible for their suppliers. Which rules apply depends on the type of institution, so confirm with counsel.
On this page
Sector-specific risks
- Payment and account fraud: Stolen logins can turn directly into money movement.
- Customer data: Financial records are valuable and trigger specific legal duties.
- Disruption: An outage can stop customers from reaching their money.
- Shared suppliers: One core processor or service provider can affect many institutions at once.
U.S. incident notification rules
| Who | Rule | Timing |
|---|---|---|
| Banking organizations (OCC example) | Computer-security incident notification rule | As soon as possible, and no later than 36 hours after determining a notification incident occurred |
| Bank service providers | Same rule | Notify affected customer banks as soon as possible after a qualifying material disruption |
| Federally insured credit unions | NCUA rule | As soon as possible, and no later than 72 hours after reasonably believing a reportable incident occurred |
| Non-bank financial institutions under FTC jurisdiction | FTC Safeguards Rule | No later than 30 days after discovering a breach of unencrypted data of at least 500 consumers |
| Broker-dealers, investment companies, and advisers | SEC Regulation S-P amendments | Notify affected individuals as soon as practicable, and no later than 30 days after becoming aware |
| Public companies | SEC Form 8-K, Item 1.05 | Generally four business days after determining an incident is material |
| New York DFS-regulated entities | 23 NYCRR Part 500 | No later than 72 hours after determining a cybersecurity incident occurred (Section 500.17) |
A broader federal rule is still pending: CISA says it continues to work on the final CIRCIA rule. Regulation S-P's compliance dates have also passed, including June 3, 2026, for small firms.
Provider dependencies
Outsourcing work doesn't outsource accountability. Federal banking agencies published interagency guidance on third-party risk management. The FTC says that if a non-bank firm uses a service provider to run its security program, "the buck still stops with you". NYDFS's 72-hour notice also covers incidents at third-party service providers.
Questions for a critical provider
- How fast will you tell us about an incident, in time to meet our own deadline?
- What will your notice contain, and who is our contact?
- Who else depends on the same underlying suppliers?
- How do we keep operating, or get our data, if you're down?
Also note that the FFIEC said it would remove its Cybersecurity Assessment Tool from its website on August 31, 2025, and that institutions can refer directly to newer resources such as NIST CSF 2.0 and CISA's Cybersecurity Performance Goals. If your program still references the tool, update it. See our compliance guide for how those frameworks work.
Example: a provider outage
A vendor outage hits a community bank
This scenario is invented. A loan-system vendor reports ransomware on a Friday. The bank's first task is to decide whether the event meets its notification definition, because the 36-hour clock starts at that determination, not at the vendor's call. Its response team pulls the contract contact list, records the time of each decision, and briefs counsel. Which is why those contacts should be tested before anything goes wrong.
Incident handling
NIST's SP 800-61 Rev. 3 (April 2025) ties incident response to overall risk management. For financial firms, write the regulatory clocks into the plan, and rehearse them using a leadership tabletop exercise. Sector members may also share threat information through FS-ISAC, a member-driven nonprofit.
Related reporting: cybersecurity in the fintech world, and data analysis for fraud detection. See also how managed services split responsibility.
General information, not legal advice.
Building a compliance program? See what a consultant can prepare and what needs independent review.
Read the compliance guide