Three regulators, on three different continents, converged on almost the same number this year, entirely independently. Washington set 72 hours. Brussels set 72 hours, after an initial 24-hour early warning. Abu Dhabi’s own financial free zones set 24 to 72 hours, depending on which one is asking. None of them coordinated on this. All three concluded, at roughly the same time, that a cyber incident report cannot wait for an organisation to feel ready to send it.
What Each Regime Actually Requires
In the United States, the Cyber Incident Reporting for Critical Infrastructure Act, CIRCIA, is expected to be finalised this month. It will require covered entities across 16 critical infrastructure sectors, an estimated 300,000 organisations in total, to report a significant cyber incident within 72 hours and a ransomware payment within 24. In the European Union, the NIS2 Directive is already live. Essential entities, those with 250 or more staff or turnover above 50 million euros, across energy, healthcare, banking, water and digital infrastructure, must send an early warning within 24 hours, a full assessment within 72, and a final report within a month. In the UAE, the pattern repeats at the free zone level. Firms regulated by Abu Dhabi Global Market must report a material cyber incident to the regulator within 24 hours, weekends and public holidays included. Firms in the Dubai International Financial Centre generally work to a 72-hour window. Three jurisdictions, three legal systems, the same rough number.
Why This Is a Delivery Problem, Not a Legal One
Most organisations have handed this requirement to legal or compliance to interpret, which is the wrong owner. A 72-hour reporting deadline is not primarily a question of what the law says. It is a question of whether an organisation can detect an incident, assess its materiality, assemble the right people, and produce an accurate report, all inside three days, under pressure, without the benefit of hindsight. That is a programme capability, not a policy position. Legal can tell you what the deadline is. Legal cannot build the operating rhythm that hits it.
The Capability Most Organisations Are Missing
The gap rarely shows up in the reporting template. It shows up upstream, in whether anyone can say, inside the first few hours, what actually happened. A US hospital system’s own social media accounts were hijacked by the ransomware group that had already breached it, which posted ransom demands directly to the public before the organisation regained control, a case study in how quickly a slow, uncoordinated response becomes the story itself. A reporting deadline assumes an organisation already knows what it is looking at. Most of the work that determines whether a report is accurate, or even possible, happens before anyone opens the compliance template.
What a Real Programme Looks Like
A credible response to any of these three regimes looks less like a legal memo and more like a programme: a named incident commander, a materiality assessment framework agreed before an incident rather than during one, a communications protocol that assumes attackers may control channels an organisation thinks are its own, and a rehearsal cadence, not a policy filed away and never tested. None of that is jurisdiction-specific. An organisation that builds this properly for NIS2 has, with minor adjustment, built it for CIRCIA and for ADGM as well.
The interesting part of this story is not which country moved first. Three regulators, working independently on three continents, arrived at the same conclusion, that organisations cannot be trusted to disclose on their own timeline, so a timeline was imposed. Whichever regime applies, the question worth asking this quarter is simple. Could the organisation hit the deadline today, if the incident happened this afternoon?