It technically follows the industry standard rules (and companies who have been exploited have 30 days to disclose breaches in the U.S. so there's probably similar "best practice" stuff with these kinds of disclosures)