A reporting obligation is a formal duty to notify a regulator, customer, partner, or other stakeholder about a security issue within a defined timeframe. In cyber security, the trigger may be a vulnerability, a data breach, malware activity, or another serious incident that meets a legal or contractual threshold.
This matters because timing changes response. Security teams need triage rules, evidence preservation, and clear ownership so they can decide what must be reported, who approves the message, and when it is sent. In real defenses, reporting obligations push organizations to document impact, classify incidents consistently, and coordinate security, legal, and engineering work. In attacks, delayed reporting can hide risk from affected users and widen exposure; in mature programs, rapid reporting supports containment, transparency, and compliance.