Free field brief · November 5, 2026
Who do you have to notify, and how fast?
The main cyber incident reporting requirements colleges should review, who they apply to, and what to prepare before an incident.
Why it matters
One incident can start several reporting deadlines at once, and they come from different places: federal student aid agreements, GLBA and the FTC, HIPAA for medical centers, defense research contracts and state law. Few schools have them all in one place, and the fastest one says "immediately".
Source: Federal and state reporting rules, as of November 2026. A summary of public guidance in our own words, not legal or compliance advice.
What you'll learn
- Five reporting deadlines and who each one applies to
- The federal rule that is coming, and where it stands
- Who owes what, by type of school
- What to have ready: a plan, the requirements, templates and a named owner
