Significant security incidents must be reported in detail to the relevant authorities within 24 hours. Companies need clear procedures for this.