Operational and IT incident reporting

How do we log an incident from the first report, assess it against the notification rules and notify the regulator inside 36 hours where it qualifies?

Give every employee one way to report and the bank one clock. An employee or a monitoring alert reports an incident on a structured screen; Callvu classifies it (a security incident, an operational outage, a data breach, a fraud event, a third-party incident), assesses it against the bank's notification rules (the 36-hour computer-security incident rule, state breach laws, GLBA customer notice, card network rules, the third-party's contract), routes the incident response team's decisions in the Decision Desk with the clocks visible, sends the notifications on time, and keeps the incident record for the exam.

In scopeComplex: multi-party handoffsCallvu moves: classify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The outage was reported in a chat channel, and the question of whether it was notifiable came up on day three.

Today, without Callvu

A system goes down, a laptop is lost, a vendor reports a breach, a phishing email is clicked. Each is reported differently: a chat message, a call to the help desk, an email to the CISO. The incident response team learns the facts in pieces. Nobody counts the hours against the rule that requires notifying the primary regulator within 36 hours of determining that a computer-security incident rises to the level of a notification incident.

The notification rules stack: the banking agencies' 36-hour rule for notification incidents; GLBA customer notice guidance for unauthorized access to customer information; state breach notification laws with their own thresholds and deadlines; card network rules for account data compromise; and the bank's contracts with third parties, which require them to notify the bank promptly. Each needs a determination, a date and a record.

The determination is the clock. A process that records when the facts became known is the only defense against the question of when the 36 hours began.

How it runs

From the requestto the system of record.

An employee reports an incident on the structured screen from any device, a monitoring system raises an alert, or a third party notifies the bank under its contract. Callvu opens the incident with the report time and the facts as stated.

Employee: Reports what they saw on a structured screen and answers follow-ups.
IT security: Triages, contains and investigates, and records the technical facts on the case.
Risk: Owns the incident record, makes the notification determinations in the Decision Desk, and reports to management and the board.
Callvu: Captures, classifies, assesses against the notification rules, tracks the clocks, routes decisions, sends notifications and keeps the record.

Capture and classify
The report captures the what, when, where, who and the impact known so far. The classification (security incident, outage, data breach, fraud event, third-party incident, physical) sets the response team, the severity rule and the notification assessments to run. The time of the report and each later fact are recorded.
Assess against the rules
Callvu runs the notification assessments the classification requires: whether the incident is a notification incident under the 36-hour rule (materially disrupting or degrading operations, a line of business, or stability), whether customer information was accessed and the GLBA notice guidance applies, which state breach laws apply by the affected customers' residence and their thresholds and deadlines, whether card data was involved, and which contracts require the bank to notify a counterparty. Each assessment has a determination to make and a date.
Decide, in the Decision Desk
The incident response team records containment and the technical findings; risk makes each notification determination in the Decision Desk with the facts, the rule and the clock, and only the allowed outcomes: notifiable (with the date of determination, which starts the 36 hours), not notifiable with reasons, or more facts needed with a deadline. Senior management and the board are informed per the severity rule.
Notify and write back
The notifications go out on their clocks (the primary regulator within 36 hours of the determination, customers and state attorneys general on the state deadlines, the card networks, the counterparties) from templates with the required content, and each is recorded with its time. The incident record holds the timeline, the facts, the determinations, the notifications, the remediation and the lessons learned, and feeds the board report and the exam.

Where it ends: Every incident has one record with its timeline, its classification, each notification determination with its date, and the notifications sent inside their deadlines, so the bank can show when it knew and when it told whom. The Decision Trace shows each assessment and determination; the Audit Trace shows every report, fact, decision and notification with its time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

Bank incident notification rule (36 hours) (12 CFR part 53, part 225 subpart N, and part 304 subpart C): A banking organization must notify its primary federal regulator as soon as possible and no later than 36 hours after it determines that a computer-security incident has occurred that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, its operations, a line of business or the stability of the financial sector (a notification incident). Bank service providers must notify affected bank customers as soon as possible of an incident that disrupts services for four or more hours.
GLBA customer notice guidance (Interagency Guidance on Response Programs for Unauthorized Access to Customer Information, 12 CFR part 364 appendix B supplement A): The bank's response program includes assessing an incident of unauthorized access to sensitive customer information, notifying its regulator as soon as possible, containing the incident, and notifying affected customers when misuse has occurred or is reasonably possible.
State breach notification laws: Each state sets the definition of personal information, the harm threshold, the deadline (commonly 30 to 60 days, some shorter) and the attorney general notice requirement; the affected customers' states determine which apply.
Card network account data compromise rules and third-party contracts: A compromise of card data requires notice to the networks under their rules; the bank's contracts with third parties require prompt notice to the bank, and the bank's own obligations to counterparties flow from its contracts.

Company policies

One structured report for every employee and every channel; a chat message is not an incident report.
The time of each fact is recorded, and the notification determination is a recorded decision with a date.
The 36-hour clock runs from the determination, which the Decision Desk records.
Notifications go from templates with the required content and are recorded with times.
The incident record is the system of record and feeds the board report.

Controls

Structured capture with timestamps.
Classification setting the response team and the assessments.
Rule-by-rule notification assessment with determinations and dates.
Decision Desk control of determinations with clocks visible.
Notification templates and delivery records.
Timeline, remediation and lessons learned on the record.

Clocks and deadlines

Regulator notification (36-hour rule): No later than 36 hours after the determination that a notification incident occurred.
State breach notifications: The affected states' deadlines from discovery, with attorney general notices where required.
Service provider notice: As soon as possible for a disruption of four or more hours, where the bank is the provider or the recipient under contract.

Documents and checks

The structured report with the time and the facts
The classification and the assessments with determinations and dates
The containment and technical findings
Each notification as sent with its time
The timeline, remediation and lessons learned

In the Decision Trace

The classification and the assessments it required.
Each determination, its date, the person and the reasons.
Each notification's deadline and its send time.

In the Audit Trace

The report and each fact with its time.
Each Decision Desk step.
Each notification sent.
The record's closure and the board report.

The handoff

Between the front doorand the back office.

The front door

A structured report from any employee on any device, a monitoring alert, or a third party's notice. The facts arrive once with their times.

The back office

IT security contains and investigates on the case; risk makes the determinations in the Decision Desk with the clocks; notifications go from the record.

The Decision Desk

Risk makes each notification determination in the Decision Desk with the facts, the rule and the clock, and only the allowed outcomes: notifiable with the determination date, not notifiable with reasons, or more facts needed with a deadline.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Banca Transilvania automated more than 100 workflows with Callvu.

BNK-04

Bank Leumi digitized all loan application and servicing workflows within six months, and dozens more processes since.

BNK-01

Questions

What buyers ask next,answered plainly.

When does the 36-hour clock start?

At the bank's determination that a notification incident occurred, which risk records in the Decision Desk with the date. The report time and each fact's time are on the record to support it.

How are state breach laws handled?

The affected customers' states determine which laws apply; each has its own threshold and deadline, assessed and tracked on the case.

What does the board see?

The incident record with its timeline, determinations and notifications, produced from the case per the severity rule.

Related processes

User access provisioning and reviews Vendor due diligence Account takeover recovery Try it in the sandbox All banking and credit unions processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.