Reporting clocks differ. The Coast Guard rule says immediately upon discovery. The EU CER Directive says an initial notice generally within 24 hours and a follow-up within a month. The UK bill, per a law firm summary, mirrors NIS2 with 24 hours and 72 hours. TSA's 2021 rail directive named CISA as the recipient.
The table
- US Coast Guard maritime rule: report to the National Response Center, immediately upon discovery.
- EU CER Directive: report to the national authority, with an initial notice generally within 24 hours and a follow-up within one month.
- TSA SD 1580-21-01 (2021, freight rail): report to CISA; the notice does not state a timing.
- UK Cyber Security and Resilience Bill: report to the regulator; summaries mention 24 and 72 hours, and the bill's status needs checking.
The UK row rests on a secondary summary, and the government page we read does not list the provisions. Treat it as unconfirmed.
Same event, several clocks
A ransomware event at a port operator with a UK or EU arm could trigger more than one. A common mistake is to set up a single clock based on the strictest rule you know. Better: list each regime, each clock, each recipient.
A runbook that survives stress
- Name who decides that an event is reportable.
- Draft one template with fields all regimes ask for: what happened, when found, what is affected, what you have done.
- Keep the contact method for each recipient in an offline copy.
- Start every clock at discovery, and write down the discovery time.
- Send a short first notice, then follow up.
Do not wait for certainty
The Coast Guard wording says immediately upon discovery. Teams that wait for a full root cause usually miss the first window. A short, accurate notice is better than a late, complete one.
Related reading
See our posts on the Coast Guard rule, the CER Directive and the TSA directive for the details of each.
Safeguard supports compliance and evidence automation, so the timeline you send is backed by logs you can show.
Rehearse the notice, not just the response
Teams often drill the technical response and skip the paperwork. Run a short exercise where the only task is to draft and send the first notice within a set time. Time it. You will find that the slow parts are usually finding the right contact, getting sign-off and agreeing what is safe to say. All three can be fixed in advance.
Quick check
Which regime in the table says immediately?
The Coast Guard maritime rule, per the summary we read.
Is the UK timing confirmed?
No. It rests on a law firm summary and the bill's status should be checked.
Sources
- Jones Walker: Coast Guard rule
- DLA Piper: CER Directive overview
- Federal Register notice on the TSA directive
- gov.uk: Cyber Security and Resilience Bill
Last reviewed: 19 October 2026.
