5) When must a breach be reported to the U.S. Computer Emergency Readiness Team?

A breach must be reported to the U.S. Computer Emergency Readiness Team (CERT) when it involves unauthorized access to sensitive information, such as personally identifiable information (PII) or protected health information (PHI), that affects federal systems or critical infrastructure. Federal agencies are required to report incidents within specific time frames, typically within 24 hours for significant breaches. Additionally, organizations that are part of the federal supply chain should report breaches that could impact government operations. Prompt reporting helps facilitate a coordinated response to mitigate risks and enhance cybersecurity.