Three federal banking regulators issued a rule Thursday that requires banks and other financial institutions to notify their regulator within 36 hours of a “computer-security incident” that materially affects their operation, ability to deliver services, or the stability of the financial sector.



