Compliance timers

Overview

Many regulations require organizations to notify authorities or affected individuals within specific timeframes after discovering a security incident. DFIRe helps you track these deadlines with compliance timers.

Compliance timers are available on any case and appear in three places:

• Case sidebar - Active timers are displayed with progress bars, sorted by urgency
• Compliance tab - Full timer management with start, complete, and reset actions
• Timeline tab - A collapsible summary of active timers above the timeline

Preconfigured Timers

DFIRe includes timers for common regulatory frameworks:

Framework	Timer	Deadline	Authority
GDPR (EU)	Data Protection Authority Notification	72 hours	Local DPA (e.g., CNIL, ICO, DPC)
NIS 2 (EU)	Early Warning Report	24 hours	CSIRT / Competent National Authority
NIS 2 (EU)	Incident Notification	72 hours	CSIRT / Competent National Authority
DORA (EU Finance)	Major ICT-Related Incident Report	24 hours	Competent Authority (e.g., Central Bank)
SEC (US Public)	Form 8-K Filing (Materiality)	4 business days	SEC (EDGAR System)
CIRCIA (US Critical Infra)	Covered Cyber Incident Report	72 hours	CISA
CIRCIA (US Critical Infra)	Ransom Payment Report	24 hours	CISA
NYDFS 500 (US Finance)	Cybersecurity Event Notice	72 hours	Superintendent of Financial Services
HIPAA (US Health)	Breach Notification	60 days	HHS Secretary & Affected Individuals
PCI DSS (Global)	Account Data Compromise	24 hours	Payment Brand (Visa/MC) & Acquirer

Each timer includes trigger guidance explaining when the timer should be started, and a reference URL linking to the relevant regulation.

Using Timers

Starting a Timer

To start a compliance timer:

1. Navigate to the Compliance tab

   Open the case and select the Compliance tab.

2. Select a timer template

   Available timer templates are listed with their framework, deadline duration, and trigger guidance. Click on a timer to expand and see details.

3. Click "Start Timer"

   By default the timer begins counting down from the current time. You can also set a custom start time if the triggering event occurred earlier (for example, if you became aware of a breach before creating the case). The deadline is calculated based on the timer's configured duration from the start time.

Timer States

A timer is in one of three states:

• In Progress - Running, with time remaining
• BREACHED - The deadline passed without completion
• Completed - The notification was made and the timer was marked complete

A running timer shows how close it is through the colour of its progress bar rather than through a separate state. It is green while more than half the time remains, turns amber once half is gone, and turns red for the last quarter and after a breach.

Being Told a Deadline Is Approaching

DFIRe raises a warning at three points as a timer runs down, and again when it breaches:

• Half the time remaining
• A quarter of the time remaining
• A tenth of the time remaining
• The deadline passed

Each of those sends an in-app notification to everyone assigned to the case, raises the matching webhook event, and records the crossing on the case timeline. A case with nobody assigned notifies nobody. Each threshold fires once per timer; resetting a timer clears the record so they can fire again.

The Daily Summary marks a case whose timer is approaching its deadline or has breached it, so an approaching deadline is visible without opening the case. See Dashboard.

Completing a Timer

When you've made the required notification, click Mark Complete on the timer. The timer records who completed it and when.

Resetting a Timer

If a timer was started in error, click Reset to restart the countdown from the current time. This does not delete the timer; it restarts the clock. The Compliance tab asks for a reason and records it on the case timeline and in the case notes. A reset made through the API or the MCP server records no reason. Any breach the timer had already recorded is preserved either way.

Sidebar Display

For cases with active timers, a Compliance Timers section appears in the case sidebar. This provides at-a-glance visibility of timer status without leaving the current view.

The sidebar shows:

• Count of active (non-completed) timers
• Mini progress bars for up to three timers, sorted by urgency
• Time remaining for each timer
• Visual warning if any timer is breached (red highlight with pulse effect)

Click the sidebar section to navigate directly to the Compliance tab.

Notifications via Webhooks

DFIRe does not include built-in email notifications for compliance timers. Instead, use outgoing webhooks to notify stakeholders when timers reach critical thresholds.

Available webhook trigger events for compliance timers:

Event	Description
Timer at 50% (Half Time Warning)	Timer has reached 50% elapsed time
Timer at 25% (Quarter Time Warning)	Timer has reached 75% elapsed (25% remaining)
Timer at 10% (Critical Warning)	Timer has reached 90% elapsed (10% remaining)
Timer Breached (Deadline Passed)	Timer deadline has passed without completion

Webhook payloads include timer details such as name, framework, deadline, and time remaining. See Webhook Payload Templates for the full list of available TIMER.* variables.

Example: Pushover Alert at 50%

Create a webhook to send a push notification when any timer reaches 50%:

• Trigger event: Timer at 50% (Half Time Warning)
• Endpoint: Pushover, PagerDuty, Slack, or your alerting system
• Payload template using {{timer.name}}, {{timer.time_remaining_seconds}}, and {{meta.case_url}}

Example: Email the lead investigator at 50%

The same warning, delivered to a person instead of a service. Create a notifier on the Email channel:

• Trigger event: Timer at 50% (Half Time Warning)
• Recipients: {{email.case_lead}}
• Subject: {{timer.name}} is half elapsed on {{case.case_number}}
• Body naming {{timer.deadline}} and {{meta.case_url}}

A case with no lead investigator sends nothing, and the delivery record says so. Add {{email.case_team}} to reach the investigators as well. See Email notifiers.

Custom Timer Templates

Create organization-specific timers for internal policies or regulations not included in the defaults.

Creating a Timer Template

1. Go to Settings → Compliance Timers
2. Click "Add Compliance Timer"
3. Configure the timer
   • Timer ID: Unique identifier (e.g., timer_internal_legal). Cannot be changed after creation.
   • Framework: Regulation or policy name (e.g., "Internal Policy")
   • Timer Name: Descriptive name shown to users
   • Duration (Hours): Time until deadline
   • Business days only: When checked, the timer excludes weekends (Saturday and Sunday) from elapsed-time calculations. Holidays are not excluded. DFIRe does not maintain a holiday calendar, so any public or organizational holidays count as normal business days. If your regulatory regime treats holidays as stopped time, plan the configured duration accordingly.
   • Authority Name: Who must be notified
   • Trigger Guidance: When this timer should be started
   • Reference URL: Link to policy or regulation documentation
4. Save the timer

   The timer is immediately available to add to cases.

Editing and Deleting Timers

Timer templates can be edited or deleted from Settings → Compliance Timers. Deleting a template does not affect timers already active on cases—they continue running with their original settings.

Best Practices

When to Start Timers

• Read the trigger guidance - Each timer includes guidance on when the clock should start
• Document your reasoning - Add a timeline event explaining why you started the timer at this moment
• Start conservatively - If uncertain, start the timer earlier rather than later

Documenting Compliance

• Add timeline events for key compliance milestones (notification sent, confirmation received)
• Attach documentation such as notification emails, portal screenshots, or confirmation receipts
• Record contact details in case notes (who was notified, via what channel)

Multiple Timers

A single incident may trigger multiple notification requirements. For example, a data breach affecting EU citizens and US healthcare data might require:

• GDPR DPA notification (72 hours)
• HIPAA breach notification (60 days)
• Internal legal notification (4 hours)

Start all applicable timers to track each requirement independently.