After an initial cyber incident report, what subsequent time frame is typically used to provide a detailed incident summary?

• A. Within one business day
• B. Within 12 hours
• C. Within 24 hours
• D. Within 72 hours

Answer: (C)

After an initial cyber incident report, a detailed incident summary is typically due within 24 hours. This timeframe provides a practical balance: it gives responders enough time to gather essential facts, affected systems, and initial containment steps, while still ensuring timely communication to reliability coordinators, the ERO, and other stakeholders. A 24-hour window helps maintain situational awareness and supports coordinated analysis and follow-up actions without letting critical information drift. Shorter windows, like 12 hours, would be demanding and may lead to incomplete or inaccurate summaries, while longer windows (such as 72 hours) could delay necessary coordination and response. In many NERC-related practices, the 24-hour mark is the standard for delivering a substantive, detailed incident summary after the initial report.