Global Cybersecurity Regulatory Map

A single ransomware incident at a multinational can start four or five legal reporting clocks at once, each with a different trigger, recipient and deadline. Cybersecurity law has moved from voluntary frameworks to binding duties: risk management measures, management accountability, incident reporting measured in hours, and product security obligations. This map compares the main cyber laws (not privacy laws) in the EU, UK, US and Asia Pacific side by side, with scope, reporting timelines, penalties and status as of October 2026. It is for CISOs, incident response leads and GRC teams who need to know which regimes apply and what they demand during the first 72 hours. Several items are still moving through legislatures and rulemaking, so dates marked "as of" should be rechecked before you rely on them.

Key takeaways

• Reporting clocks range from 2 hours to 4 business days. Singapore CII owners report within two hours, CERT-In wants six hours, Australian critical incidents 12 hours, NIS2 and the UK Bill 24 hours for a first notice, and the SEC four business days after a materiality determination.
• The trigger differs as much as the deadline. Clocks start on awareness, on classification as major, on determination of materiality, or on making a ransom payment, so your playbook must log each of those moments.
• Management is personally in the frame. NIS2, DORA and the SEC rules put approval, oversight or disclosure of cyber risk management on boards and senior management.
• Suppliers are being pulled into scope directly. DORA oversees critical ICT third-party providers, the UK Bill adds managed service providers and data centres, and the EU Cyber Resilience Act regulates the products themselves.
• Several regimes are still in flux. As of October 2026 the UK Cyber Security and Resilience Bill has not received Royal Assent, the US CIRCIA final rule had not been confirmed as published, and the Commission has proposed targeted NIS2 amendments.

Regulations and frameworks at a glance

European Union

• NIS2: Article 21 requires essential and important entities to take risk management measures, and management bodies must approve and oversee them. Reporting is staged: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month of the notification. For digital infrastructure and digital providers (cloud, data centres, managed service and managed security service providers, DNS, online marketplaces and others), Implementing Regulation (EU) 2024/2690 sets the technical measures in a 13-section Annex and defines a significant incident, including direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower. ENISA's Technical Implementation Guidance (June 2025) adds examples of evidence.
• NIS2 changes to watch: on 20 January 2026 the Commission proposed targeted amendments to increase legal clarity, which it says would ease compliance for 28,700 companies. As of October 2026 these are proposals, not law.
• DORA: a regulation, so it applies directly without transposition. For financial entities it covers, DORA applies instead of NIS2's risk management and reporting rules. The incident reporting RTS (Delegated Regulation (EU) 2025/301) sets the 4 hour, 72 hour and one month stages above, and the ICT risk RTS (Delegated Regulation (EU) 2024/1774) sets detailed requirements such as identity management (Article 20) and access control (Article 21).
• Cyber Resilience Act: places security-by-design, vulnerability handling and update duties on manufacturers of hardware and software products. Reporting of actively exploited vulnerabilities and severe incidents through ENISA's single reporting platform started on 11 September 2026; the main product obligations apply from 11 December 2027.
• National schemes: some member states add their own regimes on top, for example Germany's BSI C5 criteria catalogue for cloud services and Spain's Esquema Nacional de Seguridad (ENS) for public sector systems and their suppliers. Check these in procurement as well as in law.

United Kingdom

• NIS Regulations 2018: still the operative regime for operators of essential services and relevant digital service providers, with sector competent authorities and a 72-hour notification window.
• Cyber Security and Resilience Bill: introduced on 12 November 2025 and carried over into the 2026-27 session. As of 15 October 2026 it is in the House of Lords after Grand Committee, without Royal Assent. Government factsheets describe a 24-hour initial notification with minimal content, a fuller report within 72 hours, simultaneous notice to the regulator and the NCSC, and a duty on digital and managed service providers and data centres to identify and notify customers likely to be adversely affected. Most measures will commence through secondary legislation after Royal Assent.
• Telecommunications (Security) Act 2021: a separate regime for public electronic communications networks and services, enforced by Ofcom through the Electronic Communications (Security Measures) Regulations 2022.

United States

• SEC rules: Form 8-K Item 1.05 requires disclosure of a material cybersecurity incident within four business days of the materiality determination, delayable only if the US Attorney General finds a substantial risk to national security or public safety. Regulation S-K Item 106 requires annual 10-K disclosure of risk management processes, board oversight and management's role. Foreign private issuers use Forms 6-K and 20-F.
• CIRCIA: the 2022 statute sets 72 hours for covered cyber incidents and 24 hours for ransom payments, reported to CISA, but obligations start only when the final rule takes effect. CISA published its proposed rule in April 2024; as of mid-October 2026 we could not confirm publication of the final rule.
• NYDFS Part 500: the most prescriptive state rule. Section 500.12 requires MFA for any individual accessing any information system of a covered entity, and each covered entity must file a certification of material compliance or an acknowledgment of noncompliance by 15 April each year.
• Sector rules: TSA security directives for pipelines and rail, federal contractor rules for controlled unclassified information (see the CUI Guide) and health sector rules sit alongside these. The voluntary NIST CSF, which the Cybersecurity Enhancement Act of 2014 directs NIST to facilitate, remains the common reference many of them point to.

Asia Pacific

• Australia, SOCI Act: responsible entities for critical infrastructure assets report critical incidents with a significant impact on essential services within 12 hours and other incidents with a relevant impact within 72 hours. An oral report must be followed by a written one within 84 hours (critical) or 48 hours (other).
• Australia, Cyber Security Act 2024: adds mandatory ransomware and cyber extortion payment reporting to ASD within 72 hours for businesses with turnover above A$3m and SOCI responsible entities, security standards for smart devices, limited-use protections for information shared with the National Cyber Security Coordinator, and a Cyber Incident Review Board.
• Singapore, Cybersecurity Act: the 2024 amendments extend regulation beyond CII owners to foundational digital infrastructure such as cloud and data centre providers, entities of special cybersecurity interest and systems of temporary cybersecurity concern. CII owners must report prescribed incidents, now including supply chain incidents, within two hours. According to Hogan Lovells, the ESCI and foundational digital infrastructure parts were not yet in force as of November 2025.
• India, CERT-In Directions: issued under section 70B(6) of the IT Act 2000, they require reporting within 6 hours, retention of ICT logs for a rolling 180 days within Indian jurisdiction, clock synchronisation to NIC or NPL time servers, a designated point of contact, and five-year subscriber records for data centre, VPS, cloud and VPN providers.

Reporting clocks compared

Where identity fits

• Many reportable incidents begin with a compromised identity: stolen credentials, a leaked API key or an over-privileged service account. Fast reporting depends on knowing which identities touched which systems, so identity logs and inventories of non-human identities are part of reporting readiness, not just prevention.
• Prescriptive rules name identity controls directly: NIS2's implementing regulation has an access control section that ends in multi-factor authentication, DORA's RTS has articles on identity management and access control, and NYDFS 500.12 requires MFA broadly. See the Identity Security Regulatory Map.
• Build one incident playbook with a decision log that records the awareness, classification, materiality and payment timestamps every regime above relies on. See the Incident Response Guide.

Standards and references

• EUR-Lex: Directive (EU) 2022/2555 (NIS2)
• EUR-Lex: Commission Delegated Regulation (EU) 2025/301 (DORA incident reporting)
• European Commission: Cyber Resilience Act
• UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
• US SEC: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure rules
• NYDFS: 23 NYCRR Part 500
• Australian Government CISC: Mandatory cyber incident reporting guidance
• CERT-In: Directions under section 70B(6) of the IT Act 2000

Related NHI Mgmt Group resources: Identity Security Regulatory Map · Incident Response Guide · Agentic AI Compliance Guide · Ransomware Prevention Guide. This guide summarises cybersecurity laws and their status as of October 2026 and is not legal advice.