In the event of a cyberbreach of electronic records relating to customs business, when must the customs broker report the breach to CBP following the discovery of the breach?
How to get there
19 CFR 111.21(b)Each broker must provide notification to the CBP Office of Information Technology Security Operations Center (CBP SOC) of any known breach of electronic or physical records relating to the broker's customs business. Notification must be electronically provided ([email protected]) within 72 hours of the discovery of the breach, including any known compromised importer identification numbers … Within ten (10) business days of the notification, a broker must electronically provide an updated list of any additional known compromised importer identification numbers. …
The initial report is due within 72 hours of discovery: A.
Why the other choices are wrong
C) 10 business days: that's the follow-up deadline for an updated list of compromised importer numbers, counted from the first notification. The question asks about the initial report.
B) 10 calendar days: that's the address-change deadline (§ 111.30(a)), not the breach rule.
D) 30 calendar days: that's the deadline for producing records on request (§ 111.25(b)) and for employee list updates (§ 111.28(b)).
Tip
Breach timeline: 72 hours to report (with known compromised IOR numbers) → 10 business days for the updated IOR list → 72 hours for each new discovery after that. It covers physical records too, not just electronic ones.
Source: 19 CFR 111.21(b) (eCFR).
CBP answer key: Answer A · 19 CFR 111.21(b)Source: CBP past exams ↗