Current maximum reporting times for relatively serious or above incidents
CIIO operators: report immediately to the protection department and public security, no later than 1 hour. Central/state organ departments and directly affiliated units: no later than 2 hours to their cybersecurity institution. Other operators: no later than 4 hours to the provincial CAC office. Sector-specific rules can impose additional duties.
