Post-Incident Response Tool — TX + Federal + All 50 States
Breach Notification Timeline Generator
Enter your incident parameters. Get a ranked, per-jurisdiction notification clock with countdowns, regulator contacts, and notification content checklists — instantly.
72 hrDFARS / NYDFS
4 daysSEC 8-K Item 1.05
60 daysHIPAA / TX SB 820 AG
50+Jurisdictions Covered
Step 1 — Incident Parameters
Step 2 — Data Classes Affected (select all that apply)
Step 3 — Regulatory Triggers
Step 4 — Affected Jurisdictions
Select all states where affected individuals reside. Texas is preselected.
⚠ Not legal advice. Consult qualified breach counsel before taking any action. Regulatory landscape evolves — verify current requirements with counsel.
Breach Notification Timeline
Visual Timeline — Sorted by Deadline Urgency
Save & Email Your Full Notification Checklist (PDF)
Get a formatted PDF of all obligations, deadlines, regulator contacts, and notification content checklists — sent to your inbox.
✓ Your notification timeline has been sent — check your inbox. John will follow up within one business day.
🚨
IR Emergency Hotline
Active incident? CoreRecon deploys within 4 hours — Texas SDVOSB, 24/7 IR retainer.
HIPAA requires notifying affected individuals within 60 days of discovering a breach. If the breach affects 500 or more individuals in a state, you must also notify HHS and prominent media outlets in that state within 60 days. HHS maintains a searchable breach portal. Small breaches (under 500) may be reported annually to HHS.
How fast must a public company report a breach under SEC rules? ▼
Under SEC Item 1.05 of Form 8-K (effective December 2023), a public company must file within 4 business days of determining a cybersecurity incident is "material." The clock starts from materiality determination, not discovery — but you cannot unreasonably delay that determination. Materiality is assessed under the same standard as other SEC disclosures.
What is the Texas SB 820 / §521.053 breach notification deadline? ▼
Texas Business & Commerce Code §521.053 requires notification to affected Texas residents "without unreasonable delay." If the breach affects more than 250 Texas residents, you must also notify the Texas Attorney General within 60 days of discovery. Failure can result in civil penalties up to $500 per violation ($250,000 cap per event) plus AG enforcement action.
Does DFARS require a 72-hour cyber incident report? ▼
Yes. DFARS 252.204-7012 requires defense contractors and subcontractors to report cyber incidents involving covered defense information (CDI) or CUI to the DoD Cyber Crime Center (DC3) within 72 hours of discovery. The contractor must also preserve forensic images for 90 days and submit them upon request. Failure can result in contract termination and DEBARMENT.
What happens if you miss a breach notification deadline? ▼
Penalties vary by regulator. HIPAA OCR has levied fines from $100 to $50,000 per violation (annual cap $1.9M per violation category). The FTC can seek civil penalties under GLBA Safeguards. State AGs can bring enforcement actions. SEC late-filers face civil penalties. TX SB 820 penalties reach $250,000 per event. Class action exposure is significant for large breaches — plaintiff firms monitor the HHS breach portal in real time.