<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-regulatory-incident-reporting
description: >-
  Manage regulatory incident reporting obligations across jurisdictions
  including GDPR, HIPAA, PCI DSS, and SEC requirements with automated
  deadline tracking, template generation, and submission workflows.
domain: cybersecurity
subdomain: incident-management
tags:
  - regulatory
  - compliance
  - reporting
  - gdpr
  - hipaa
  - notification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-5", "RS.RP-1", "ID.GV-3"]
  frameworks: ["GDPR Art. 33/34", "HIPAA Breach Notification", "PCI DSS 12.10", "SEC Regulation S-K"]
---

# Performing Regulatory Incident Reporting

## Overview

Regulatory incident reporting requires precise tracking of notification
deadlines, content requirements, and submission procedures across multiple
jurisdictions. Failure to report within required timeframes carries severe
penalties — GDPR mandates 72-hour supervisory authority notification,
HIPAA requires notification within 60 days, and SEC requires material
cybersecurity incident disclosure within 4 business days.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Regulatory requirement matrix | Obligations by jurisdiction and data type |
| Legal counsel access | Review authority for regulatory submissions |
| Data classification inventory | Types of data involved in incident |
| Submission credentials | Portal access for each regulatory body |

## Key Concepts

### Notification Timeline Matrix

| Regulation | Authority Notification | Individual Notification | Threshold |
|-----------|----------------------|----------------------|-----------|
| GDPR Art. 33 | 72 hours | Without undue delay | Risk to rights/freedoms |
| HIPAA | 60 days | 60 days | > 500 individuals |
| PCI DSS 12.10 | Immediately | N/A | Cardholder data compromise |
| SEC 8-K Item 1.05 | 4 business days | N/A | Material incident |
| NIS2 Directive | 24h early warning, 72h full | N/A | Significant incident |
| CCPA | N/A | Expedient, no delay | CA resident data |

### Reporting Decision Tree

```
INCIDENT CONFIRMED
       │
       ▼
┌──────────────────┐    YES   ┌──────────────────┐
│ Personal data    │─────────▶│ GDPR Art. 33     │
│ involved?        │          │ 72h notification  │
└────────┬─────────┘          └──────────────────┘
         │ NO
         ▼
┌──────────────────┐    YES   ┌──────────────────┐
│ Health data      │─────────▶│ HIPAA Breach     │
│ involved?        │          │ 60-day notify     │
└────────┬─────────┘          └──────────────────┘
         │ NO
         ▼
┌──────────────────┐    YES   ┌──────────────────┐
│ Payment card     │─────────▶│ PCI DSS notify   │
│ data involved?   │          │ Immediate         │
└────────┬─────────┘          └──────────────────┘
         │ NO
         ▼
┌──────────────────┐    YES   ┌──────────────────┐
│ Material impact  │─────────▶│ SEC 8-K filing   │
│ to business?     │          │ 4 business days   │
└──────────────────┘          └──────────────────┘
```

### Report Content Requirements

| Element | GDPR | HIPAA | SEC |
|---------|------|-------|-----|
| Nature of breach | Required | Required | Required |
| Data categories | Required | Required | N/A |
| Approximate records | Required | Required | N/A |
| Likely consequences | Required | N/A | Required |
| Mitigation measures | Required | Required | Required |
| DPO contact | Required | N/A | N/A |
| Material impact assessment | N/A | N/A | Required |

## Workflow

1. Determine applicable regulations based on data types and jurisdictions
2. Calculate notification deadlines from incident discovery time
3. Generate required report templates for each obligation
4. Route reports to legal counsel for review
5. Submit reports through appropriate channels
6. Track acknowledgment and follow-up requests
7. Document all submissions in incident record

```bash
# Determine reporting obligations
node agent.js assess --incident-id INC-2026-0200 \
  --data-types '["personal","health"]' --jurisdictions '["eu","us"]'

# Generate regulatory report
node agent.js generate-report --incident-id INC-2026-0200 \
  --regulation gdpr

# Track submission deadlines
node agent.js track-deadlines --incident-id INC-2026-0200
```

## Verification

- [ ] All applicable regulations identified within 4 hours
- [ ] Notification deadlines calculated and tracked
- [ ] Reports reviewed by legal before submission
- [ ] Submissions confirmed with acknowledgment receipt
- [ ] Follow-up requests tracked to completion

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- GDPR Art. 33/34
