A look at efforts to shape federal rules for companies disclosing cyberattacks, with a group representing Alphabet and Amazon pushing for a 72-hour window
David Uberti / Wall Street Journal :
Context & Ripple Effects
In August 2021, a trade group speaking for Alphabet and Amazon entered the rulemaking fight over federal cyberattack disclosure, arguing for a 72-hour window before companies must report an intrusion. The push was a counterbid against the direction regulators were already moving: US bank regulators had just settled on a much tighter 36-hour reporting clock for banks, effective May 2022.
The lobbying lost ground on every front that followed. The SEC moved toward a four-day requirement for public companies (floored as a consideration in early 2022 before being formally approved in July 2023), while investment funds and advisers were proposed an even stricter 48-hour clock. The industry's preferred window ended up the loosest deadline in the entire regime rather than the standard.
First-order effects
- Alphabet, Amazon, and other members of the trade group get materially more investigation time under their proposed 72-hour window than under any rule actually adopted — the gap between their ask and the final four-day SEC rule is the direct stake in this fight.
Second-order effects
- Companies operating across sectors now face stacked, inconsistent clocks — roughly 36 hours for banks, 48 proposed for funds and advisers, four business days for public filers — forcing compliance teams to build to the tightest applicable deadline rather than any single standard.
Third-order effects
- Cyberattack disclosure is hardening from voluntary practice into sector-by-sector mandatory infrastructure, with the timing of each clock set through negotiation between industry groups and regulators — making lobbying on disclosure windows a recurring, structural cost of operating regulated digital businesses.
The trend: US cyberattack reporting is consolidating into mandatory, sector-specific disclosure regimes whose deadlines keep tightening relative to what industry lobbies request.