The Regime Clocks

Four regulators, four different clocks, one incident. This is the set for entities that answer to more than one of them — and for the practices that answer for several clients at once.

The problem it solves is sequencing, not any single filing. The confidential 72-hour report to CISA usually precedes the public 8-K. The NYDFS 72-hour notice runs on its own trigger. The SEC clock does not start until you determine materiality, while every other clock starts at discovery. Get the order wrong and you either disclose publicly before you have told your regulator, or you miss a deadline that was already running while you were still deciding whether you had an incident.

I've Been Breached — The First 72 Hours Command Kit — the layer above all of them. The printable Hour-Zero card, the workbook computing 25 notification clocks from your discovery time, the five-lane workstream plan, the eight-gate ransom decision and eleven communications templates. This is what the person in charge uses while the specialists work.

CIRCIA 72/24 Reporting Readiness Pack — the federal one. The two-gate covered-entity test, the four-prong reportability decision tree, the 72-hour and 24-hour clocks, and a report pre-fill with a JSON Schema twin for your SOAR. NPRM-based, with a free update when the final rule publishes.

SEC 8-K Item 1.05 Materiality Workbook — the public-company one. Two clocks kept apart: discovery-to-determination, evidenced step by step, and determination-to-filing, computed to the 5:30 pm ET deadline. Plus the language-to-avoid table, because three years in, enforcement has punished wording rather than lateness.

NYDFS Part 500 Compliance Kit — the New York financial one. The 19-section crosswalk whose summary tells you whether you can sign a Certification of Material Compliance or owe an Acknowledgment of Noncompliance, all sixteen 500.3 policy areas, both filing forms, and the 72-hour and 24-hour notice templates.

Who actually needs all four. Few single companies are subject to every one of these — though a publicly traded, NY-licensed insurer in a critical-infrastructure sector is exactly that, and there are more of them than you would think. The clearer buyer is the practice: a vCISO, MSSP, law firm or advisory carrying clients across several regimes, who needs one consistent method rather than four sets of habits. If you are subject to one regime and not the others, buy that kit on its own.

Every kit's clock sheet computes from the same input — the discovery timestamp — so the four sequence against each other instead of being reconciled by hand at 3 a.m.

Delivered as four separate ZIP downloads.

Not legal advice. Counsel owns every filing, and on the day your breach coach makes the legal calls.