Banks must report major cyber incidents within 36 hours under finalized regulation

Industry won some concessions in the final version of the rule, which banks must comply with by May.