Introduction
On November 18, federal banking agencies[1] issued the long-awaited final rule,[2] establishing data security incident response notification requirements for “banking organizations” and “bank service providers” (terms defined below). Included in this rule is a headline-grabbing 36-hour regulatory notification requirement for banking organizations. This final rule is set to take effect on April







