China requires reporting cyberattacks within one hour if they affect over 50% of a province or 10 million people. The U.S. SEC's 4-day rule faced fierce corporate pushback but has worked fine. Early disclosure matters for national defense against state-sponsored threats.
Chapters
China has implemented regulations for 1-hour reporting of severe cybersecurity incidents, including disruptions that impact over 50% of the people in a province or 10 million people, such as a critical infrastructure attack. The irony is thick as China is recognized as one of the most aggressive nation-state actors, renowned for its advanced foreign cyber operations that includes industrial espionage theft of defense secrets, and breaching national critical infrastructures. Unfortunately, there is brilliance in this move that requires Chinese companies and operators to quickly report severe cyberattacks. The faster government becomes aware, the quicker they can respond with national-level assets to mitigate the impacts. Given their international expertise in hacking, China has an excellent perspective in how such attacks can be used to disrupt adversaries and push foreign policy. Basically, China doesn't want to suffer in the ways that their targets might, and therefore is improving its response and recovery capabilities. In contrast, the United States struggles with such early reporting. We have a myriad of disorganized requirements, and we see pushback every time a requirement is proposed. For example, when the SEC required public companies to report material outages within 4 days in the beginning of 2025, there was upheaval from the business executives. The crux of the requirement was to ensure investors were informed in a timely manner and insiders didn't have an unfair insider information trading advantage. Companies complained and tried to rally the public to their side, unsuccessfully. Even some cybersecurity leaders came out against the regulation, stating that it was impossible, or at the very least irresponsible, and would actually aid the attackers. This, of course, was all nonsense. Since the regulation took effect, no major issues have arisen from the 4-day requirement. Since then, those cybersecurity leaders have all been silent, but the financial sector has quietly hired powerful lobbyists to convince Congress to repeal the act. So far, no luck in watering down the current regulation. Now, this was a situation where individual companies placed their interests over the needs of the community or fair investing practices, which is why the SEC was originally formed. These companies simply don't want the extra oversight or to be forced to make material breaches public to customers, partners, or shareholders. Instead, companies want latitude to manage the public image of cyber incidents by controlling when, how, and if the public is to be informed. This may be good for the executive bonuses and investor meetings, but not for the customers, investors, or economic sectors if such attacks are kept concealed. We have seen this in the past where public companies intentionally kept severe breaches concealed for extended periods of time and only released information after others brought it to light. Prescriptive public reporting regulations limit their decision ability to delay downplay, or outright refuse to notify downstream users or partners that were impacted. With this as a foundation, let's consider that the vast majority of US critical infrastructure is operated by private industry, and concealing cybersecurity compromises only benefits the attackers, which have included aggressive nation-states. Like China. The US Cybersecurity and Infrastructure Security Agency, CISA, knows this and is looking to update rules specifically for US critical infrastructure, mandating a 72-hour notification, but the final rule may not be published until mid-2026. And I sincerely hope my peers in cybersecurity will show forethought and strategic responsibility, realizing the necessity and supporting early notification in the US. Concealing severe cyberattacks hinders coordinated responses and can both prolong and increase the overall impacts. Such effects go beyond the stock price of any single company and can impact the daily lives of our society. China knows something and realizes the importance of early reporting. Even the most aggressive US reporting proposal falls short of the 1-hour requirement that China benefits from.
