The Reporting Clock: Cyber Incident Reporting Requirements in Hong Kong, Singapore and the US, and What They Mean for Your IT Provider Contract

Key findings: Hong Kong's critical infrastructure law, in force since 1 January 2026, gives designated operators 12 hours to report a serious computer-security incident and 48 hours for others. Singapore's clocks are shorter: 2 hours for critical information infrastructure owners and 1 hour for MAS-regulated financial institutions. In the US, banks have 36 hours, listed companies four business days after deciding an incident is material, and the federal critical-infrastructure rule (CIRCIA) is still not in force as of 31 October 2026. Every one of these clocks starts when the regulated firm becomes aware, and for a company that outsources its IT, awareness usually starts inside the provider's monitoring. That is why regulated clients need the provider-to-client reporting time agreed in their own contract, shorter than their shortest regulator clock.

When a regulator writes "within 12 hours of becoming aware", the 12 hours belong to the regulated company. But most companies with 30 to 300 staff do not watch their own systems. Their IT provider's monitoring raises the first alert, their provider's engineer makes the first call on whether something is an incident, and their provider decides when to pick up the phone. If the provider's contract allows a day before it tells the client, the client's 12 hours, or 2 hours, or 1 hour, may have run out before anyone in the business knows the clock started.

This report lines up the cyber incident reporting requirements Hong Kong companies face beside those in Singapore and the United States, the two other markets where Hong Kong firms most often have parents, clients or regulators of their own. It then asks the practical question the side-by-side comparison raises: what does the provider-to-client clause have to say for the client-to-regulator duty to be achievable?

Three limits apply throughout. This is not legal advice; reporting duties depend on your licence, your sector and the facts of an incident, and your counsel should confirm which apply. Regulatory positions are stated as of 31 October 2026. And Mainland China's own incident-reporting measures are deliberately out of scope here.

Every clock starts at "becoming aware", and awareness usually happens at the provider

Read the regimes in this report side by side and one phrase recurs: the reporting window runs from when the regulated entity becomes aware of the incident, discovers it, or determines that it meets a threshold. None of them run from when the company's managing director happens to hear about it.

For a company with an internal security team, that distinction is academic: the people who see the alert work for the regulated entity. For a company that outsources IT, it is not. The sequence in a typical outsourced estate looks like this:

• An endpoint detection tool, a mail filter or a firewall raises an alert in a console the provider watches.
• A provider engineer triages it, often outside the client's office hours.
• The provider decides it is a security incident rather than a fault, and escalates internally.
• The provider tells the client's named contact.
• The client decides whether the incident meets a regulatory threshold and reports.

Regulators generally do not accept "our vendor did not tell us" as an explanation for a late report, and some say so directly. Hong Kong's Securities and Futures Commission, for example, has said that a firm should not delay a required report while it completes its own investigation. The practical effect is that every hour spent between the first alert and the client's named contact is an hour taken out of the client's regulatory window.

That is the gap this report is about. It is not a gap in anyone's security. It is a gap between two contracts: the one between the client and its regulator, and the one between the client and its IT provider.

Hong Kong: one new statute, two financial regulators and a voluntary privacy regime

Hong Kong is the newest and most layered of the three markets. A company can sit under a statutory clock, a regulator's "immediately", or no mandatory clock at all, depending on what it is and what it holds.

The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)

Cap. 653 was passed by the Legislative Council on 19 March 2025. The government gazetted its commencement in June 2025 and it came into operation on 1 January 2026. It imposes statutory duties on organisations designated as critical infrastructure operators, and the Office of the Commissioner of Critical Infrastructure (Computer-system Security), set up under the Security Bureau, administers it, with sector regulators acting for some sectors.

Its reporting duties, as set out in the Ordinance and summarised in the Commissioner's Code of Practice, are:

• 12 hours after becoming aware, for a serious computer-system security incident that has disrupted, is disrupting or is likely to disrupt the core function of a critical infrastructure.
• 48 hours after becoming aware, for any other computer-system security incident in a critical computer system.
• A written report within 14 days of becoming aware.

The Ordinance applies to designated operators, not to every company. Most firms of 30 to 300 staff will never be designated. They meet the Ordinance from the other side: as an IT supplier to an operator, or as a client of a provider that also serves operators. Operators are expected to manage the security of computer systems they rely on third parties for, which in practice means they will push their own 12-hour clock down into their suppliers' contracts. A Hong Kong IT services firm with an operator among its clients should expect to be asked how quickly it reports.

HKMA: "immediately", with no hour count

Authorised institutions supervised by the Hong Kong Monetary Authority work under incident-reporting expectations set out in HKMA guidance rather than a statute with a fixed number of hours. The HKMA's 2010 circular on incident response and management states that an institution should notify the HKMA immediately after becoming aware of a significant incident and should not wait until the incident is rectified; HKMA's later communications, including a 2024 press release, have reminded banks to report promptly incidents with potentially significant impact on business, customers or reputation.

The absence of a number is itself the finding. "Immediately" is shorter than any fixed window in this report, and it leaves no room for a provider that reports to the bank the next morning. For the wider question of what Hong Kong's banking cyber framework expects from outsourced IT, see our report on bundling MSP, MSSP and C-RAF support for Hong Kong institutions.

SFC: "immediately" for licensed corporations

The SFC's Code of Conduct (paragraph 12.5) requires a licensed or registered person to report to the SFC immediately upon the occurrence of a material breach, infringement or non-compliance, or a material failure of its systems. The SFC issued a circular in 2017 reminding licensed corporations that material cybersecurity incidents, including ransomware attacks, should be reported immediately.

The SFC's own data shows why the expectation matters. Its Report on the 2023/24 Thematic Cybersecurity Review of Licensed Corporations, published on 6 February 2025, records that licensed corporations reported eight material cybersecurity incidents between 2021 and 2024. They included ransomware that disrupted trading and back-office systems, unauthorised access to client accounts, and breaches at third-party IT vendors. The same report named end-of-life software and third-party IT service management among the areas where it set out expected standards.

PDPO: no mandatory breach notification, yet

The Personal Data (Privacy) Ordinance (Cap. 486) contains no statutory duty to notify a data breach. Notification to the Privacy Commissioner is voluntary and is guided by the PCPD's Guidance on Data Breach Handling and Data Breach Notifications (June 2023 edition). It is still common: the PCPD received 203 data breach notifications in 2024, up from 157 in 2023, and 246 in 2025, according to its own published figures.

A mandatory regime has been discussed since 2020, when the government's paper to the Legislative Council Panel on Constitutional Affairs proposed one, with notification to the PCPD within a period such as five business days given as an example. As of 31 October 2026 we found no amendment bill introduced into the Legislative Council to implement it; it remains a proposal. If it is enacted, it will add a clock for every Hong Kong company that holds personal data, which is almost all of them.

Singapore: the shortest clocks in the set

Singapore combines a critical-infrastructure statute, a financial regulator with a one-hour rule and a mandatory personal-data regime. Its clocks are the shortest of the three markets.

Cybersecurity Act 2018: 2 hours for CII owners

Under the Cybersecurity Act 2018 and the Cybersecurity (Critical Information Infrastructure) Regulations 2018, the owner of a critical information infrastructure (CII) must notify the Cyber Security Agency of Singapore (CSA) within 2 hours of becoming aware of a prescribed cybersecurity incident, with supplementary details to follow within 14 days.

The Cybersecurity (Amendment) Act 2024 was passed by Parliament on 7 May 2024, and the CSA announced that its key provisions would commence on 31 October 2025. Among other changes, the CSA says the amendments expand the reporting requirements to include incidents suspected of being caused by advanced persistent threats and incidents that disrupt essential services through systems under the CII owner's control that are not interconnected with the CII, and they bring third-party-owned CII within the regime. The direction is clear: more systems, more incident types and more organisations inside a 2-hour window.

MAS Technology Risk Management Notices: 1 hour

Financial institutions regulated by the Monetary Authority of Singapore are subject to MAS Notices on Technology Risk Management, issued separately for each type of licence. The Notices require an institution to notify MAS as soon as possible, and no later than 1 hour after the discovery of a relevant incident, and to submit a root-cause and impact analysis report within 14 days of discovery.

One hour is the shortest fixed clock in this report. It leaves essentially no room for a provider escalation step measured in hours. For a Singapore-regulated institution that outsources monitoring, the provider has to be inside the first few minutes of the response, not reporting into it later. Our MAS TRM checklist for outsourced IT covers the wider outsourcing expectations.

PDPA: 3 calendar days once a breach is notifiable

Under the Personal Data Protection Act 2012 (sections 26A to 26E) and the Personal Data Protection (Notification of Data Breaches) Regulations 2021, an organisation must notify the Personal Data Protection Commission no later than 3 calendar days after assessing that a data breach is notifiable. A breach is notifiable if it is likely to cause significant harm to affected individuals or affects 500 or more individuals. The organisation must also assess suspected breaches expeditiously. Unlike Hong Kong, Singapore's privacy clock is mandatory and applies to almost every organisation that holds personal data.

The United States: a patchwork, with one clause worth copying

The US has no single incident-reporting law. A company may face a securities-disclosure clock, a banking clock, a consumer-finance clock, a pending critical-infrastructure clock and fifty state breach laws, depending on what it is.

SEC Form 8-K Item 1.05: four business days after materiality

The Securities and Exchange Commission's rule on cybersecurity risk management and incident disclosure (Release No. 33-11216, adopted 26 July 2023) requires a listed company to disclose a material cybersecurity incident on Form 8-K under Item 1.05 within four business days after it determines the incident is material. The materiality determination itself must be made without unreasonable delay after discovery. In May 2024, SEC staff clarified that Item 1.05 is intended for incidents the company has determined to be material, and that other incidents can be disclosed voluntarily under a different item.

The bank rule: 36 hours, and a duty on service providers

The OCC, Federal Reserve and FDIC's joint Computer-Security Incident Notification rule took effect on 1 April 2022, with compliance required from 1 May 2022. A banking organisation must notify its primary federal regulator as soon as possible and no later than 36 hours after it determines that a notification incident has occurred.

The rule's second half is the most useful single provision in this report. It places a direct duty on bank service providers: a provider must notify each affected banking customer as soon as possible when it determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours. In other words, a regulator has already written the provider-to-client clause. It does not leave the bank to negotiate it; it binds the provider directly, and it uses "as soon as possible", not a day.

FTC Safeguards Rule: 30 days for non-bank financial institutions

The Federal Trade Commission amended its Safeguards Rule to require non-bank financial institutions, such as mortgage brokers, auto dealers that arrange finance and tax preparers, to notify the FTC as soon as possible and no later than 30 days after discovering a notification event involving the unencrypted information of 500 or more consumers. The amendment took effect on 13 May 2024.

CIRCIA: 72 hours, but not in force

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered entities to report covered cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours and ransom payments within 24 hours. Those duties begin only when CISA's final rule takes effect. As of 31 October 2026 the final rule has not been published; CISA's CIRCIA page states that organisations are not required to submit reports under CIRCIA until the final rule's effective date. Trade press reported that CISA sent the final rule to the White House Office of Management and Budget for review on 1 October 2026, after the statutory deadline of October 2025 passed. Treat any timeline you see for it as a forecast until the Federal Register says otherwise.

State breach laws

All 50 states have their own data breach notification statutes, with different triggers and deadlines, indexed by the National Conference of State Legislatures. We do not reduce them to a single number here, because there is no single number.

The windows side by side

The comparison below puts each instrument on one line: who it binds, what starts the clock, the first deadline and the follow-up. Shortest clocks first.

• MAS TRM Notices (Singapore): binds MAS-regulated financial institutions; clock starts at discovery of a relevant incident; notify MAS no later than 1 hour; root-cause and impact report within 14 days.
• Cybersecurity Act 2018 (Singapore): binds CII owners (and, from 31 October 2025, a wider population); clock starts on becoming aware; notify CSA within 2 hours; supplementary details within 14 days.
• HKMA guidance (Hong Kong): binds authorised institutions; clock starts on becoming aware of a significant incident; notify immediately; no fixed hour count.
• SFC Code of Conduct (Hong Kong): binds licensed and registered persons; clock starts on a material breach or material system failure, including material cybersecurity incidents; report immediately; no fixed hour count.
• Cap. 653 (Hong Kong): binds designated critical infrastructure operators; clock starts on becoming aware; 12 hours for serious incidents, 48 hours for others; written report within 14 days.
• US bank rule: binds banking organisations; clock starts on determining a notification incident; notify regulator within 36 hours. Bank service providers notify affected bank customers as soon as possible after a qualifying disruption of 4 hours or more.
• SEC Item 1.05 (US): binds listed companies; clock starts on the materiality determination; file within 4 business days.
• PDPA (Singapore): binds organisations holding personal data; clock starts on assessing a breach as notifiable; notify PDPC within 3 calendar days.
• FTC Safeguards Rule (US): binds non-bank financial institutions; clock starts on discovery of a notification event affecting 500 or more consumers; notify within 30 days.
• CIRCIA (US): will bind covered critical-infrastructure entities; 72 hours for covered incidents and 24 hours for ransom payments; not in force as of 31 October 2026.
• PDPO (Hong Kong): no mandatory notification as of 31 October 2026; voluntary notification under PCPD guidance.

Two things stand out. First, five of these clocks are measured in hours or are "immediate", and all five apply to the regulated sectors this report is written for: banking, licensed securities firms, other financial institutions and critical infrastructure. Second, the regimes that do not set an hour count, the HKMA and the SFC, are not more relaxed for it. "Immediately" is tighter than any number.

What the clock does to the IT provider contract

If the regulated firm's clock is measured in hours and its awareness usually starts with its provider, then the provider contract is part of the firm's reporting capability. A notification term written for an unregulated client, such as "without undue delay" or a period measured in a day, is a reasonable default. For a client under any of the first five clocks above, it is not enough on its own.

Five terms do the work. They are the terms we would expect a regulated client's counsel to look for, and the terms a provider serving regulated clients should be ready to agree.

• A defined detection obligation. The contract says what the provider monitors (endpoints, mail, identity, firewall, cloud logs), during which hours, and what tool raises the alert. A reporting clause is only as fast as the monitoring behind it.
• A provider-to-client notification time shorter than the client's shortest regulator clock. If the client's shortest applicable clock is 1 hour, the provider's notification to the client's named contact needs to be measured in minutes. If it is 12 hours, a few hours may work. The number belongs in the contract, not in an assumption.
• A named escalation path that works out of hours. A notification sent to a shared mailbox at 2am does not start anyone's response. The contract names who is called, how and in what order, and what happens if they do not answer.
• Evidence preservation and a factual first report. The provider preserves logs and affected-system evidence and gives the client a short factual summary in a form the client can use for its own regulator notice. The client still decides and signs the regulatory report.
• Cooperation through the follow-up report. Cap. 653, the MAS Notices and the Singapore CII Regulations all expect a written follow-up within 14 days. The provider's root-cause analysis has to arrive in time to feed it.

The US bank rule is the clearest model for the second term. It does not tell the provider a number of hours; it tells the provider "as soon as possible" and defines the trigger. A provider that has accepted that standard for its US bank clients has already shown that the clause can be written and lived with.

What it costs

A contractual notification time measured in minutes is only meaningful if someone is watching at 2am. That makes the reporting clock a product question as much as a legal one: 24×7 detection, a security operations function and an escalation rota are services with a cost, and the cost does not disappear because the clause says "immediately". Our report on the rising cost of cybersecurity incidents for IT providers and the companies that hire them covers what incidents cost when they happen; this report is about the legal clock, not the bill.

Hong Kong specifically: three buyers, three different clocks

Because Hong Kong is the focus of this report, it is worth showing how the same provider relationship can carry three different clocks.

• A licensed asset manager (SFC Type 4/9): its clock is "immediately" under the Code of Conduct. Its provider needs to tell it as soon as an incident is suspected, not when it is confirmed, because the SFC has said reporting should not wait for an internal investigation to finish.
• A fintech supplying a bank: it is not an authorised institution, but its bank client is, and the bank's "immediately" will appear in the fintech's supplier contract. Its provider's notification time becomes the first link in the bank's chain.
• An IT or facilities vendor to a designated CI operator: it is not designated itself, but the operator's 12-hour clock under Cap. 653 will be pushed into its contract. Its own IT provider sits one step further back in the same chain.

In all three cases the company's own size is beside the point. What sets the clock is who the company is regulated by, or who it supplies.

Brocent's own position, stated plainly

Brocent sells the detection and escalation the clock requires, so the reader should weigh this section accordingly.

For regulated clients, Brocent agrees the incident reporting and escalation timeline with each client in its Order Form, separately from the standard service terms. The Order Form sets the provider-to-client notification time against the regulatory clocks that client is actually under, names the escalation contacts and hours, and states what evidence and first report the client will receive. A licensed corporation with an "immediately" duty and an unregulated trading company do not need, and do not get, the same clause.

Our published service levels set out first-response, on-site and resolution targets by priority, and the difference between 8×5 business-hours cover and 24×7 cover; a reporting clause measured in minutes only makes sense with 24×7 cover behind it. Continuous detection is delivered through our security operations centre service and SIEM, which are scoped and quoted per client; the FAQ on SOC and SIEM explains how they relate to a managed IT plan. Hong Kong clients can see what is included in a managed plan on our Hong Kong IT support page or get a Hong Kong quote; Singapore clients can start from our Singapore IT support page.

What we do not do is file regulatory reports on a client's behalf, decide whether an incident is material for securities purposes, or give legal advice on which regime applies. Those decisions sit with the client and its counsel.

What this report does not claim

• It is not legal advice and does not say which regime applies to any particular company.
• It does not claim that any regime is complete as summarised here; each instrument has definitions, thresholds and exemptions that matter in a real incident.
• It does not compare Mainland China's incident-reporting measures, which are out of scope.
• It does not state CIRCIA timelines as fact; the rule was not in force on 31 October 2026.
• It does not state the PDPO amendment as law; it was a proposal on 31 October 2026.
• It does not offer any statistic on average detection time or incident cost; those belong to the incident-cost report linked above.

Frequently asked questions

What are the cyber incident reporting requirements in Hong Kong?

It depends on what the company is. Designated critical infrastructure operators under Cap. 653 must report within 12 hours for serious incidents and 48 hours for others, with a written report within 14 days. HKMA-authorised institutions are expected to notify the HKMA immediately on becoming aware of a significant incident. SFC-licensed corporations must report material breaches and material system failures, including material cybersecurity incidents, immediately. Under the PDPO, breach notification to the Privacy Commissioner is voluntary as of 31 October 2026.

Does the Protection of Critical Infrastructures (Computer Systems) Ordinance apply to my company?

Only if your company has been designated as a critical infrastructure operator. Most firms with 30 to 300 staff will not be. You may still feel its effect if you supply IT or services to a designated operator, because operators are expected to manage the security of systems that depend on third parties, and their 12-hour clock will appear in supplier contracts.

What is the shortest incident reporting deadline in Singapore?

For MAS-regulated financial institutions, the MAS Technology Risk Management Notices require notification as soon as possible and no later than 1 hour after discovery of a relevant incident. For CII owners under the Cybersecurity Act 2018, it is 2 hours after becoming aware.

Is CIRCIA's 72-hour reporting rule in force?

Not as of 31 October 2026. CIRCIA's 72-hour (covered incidents) and 24-hour (ransom payments) duties begin only when CISA's final rule takes effect, and CISA states that reports are not required before then.

What should an IT provider's incident notification clause say for a regulated client?

At minimum: what the provider monitors and when; a provider-to-client notification time shorter than the client's shortest applicable regulator clock; a named out-of-hours escalation path; evidence preservation and a factual first report; and cooperation in time for any follow-up report. The US bank rule's duty on service providers is a useful model.

Will Brocent report an incident to the regulator for us?

No. The regulated company decides whether an incident meets a reporting threshold and files its own report. Brocent's role, agreed per client in the Order Form for regulated clients, is to detect, escalate to your named contacts within the agreed time, preserve evidence and give you the facts you need for your report.

Is Hong Kong introducing mandatory data breach notification?

It has been proposed since 2020, but as of 31 October 2026 we found no amendment bill introduced to implement it. Notification to the PCPD remains voluntary under its June 2023 guidance. Watch the Legislative Council's bill list for change.

Sources

Positions are as of 31 October 2026. Hong Kong: Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) and HKSAR Government press release of 27 June 2025 on its commencement; Office of the Commissioner of Critical Infrastructure (Computer-system Security), Code of Practice v1.0; HKMA circular on incident response and management procedures (2010) and HKMA press release (2024); SFC Code of Conduct paragraph 12.5, SFC circular to licensed corporations (2017) and Report on the 2023/24 Thematic Cybersecurity Review of Licensed Corporations (6 February 2025); PCPD Guidance on Data Breach Handling and Data Breach Notifications (June 2023) and PCPD statements on 2024 and 2025 notification figures; Constitutional and Mainland Affairs Bureau paper to the LegCo Panel on Constitutional Affairs (2020). Singapore: Cybersecurity Act 2018 and Cybersecurity (Critical Information Infrastructure) Regulations 2018; CSA press release on commencement of the Cybersecurity (Amendment) Act 2024; MAS Notices on Technology Risk Management; Personal Data Protection Act 2012 and Personal Data Protection (Notification of Data Breaches) Regulations 2021. United States: SEC Release No. 33-11216 (2023) and SEC staff statement (May 2024); OCC, Federal Reserve and FDIC Computer-Security Incident Notification rule (2021, effective 2022); FTC Safeguards Rule amendment (effective 13 May 2024); Cyber Incident Reporting for Critical Infrastructure Act of 2022 and CISA's CIRCIA page; NCSL index of state security breach notification laws.