The regulator clock is 72 hours from detection and never moves. An incident cannot close until it is assessed, and — when the assessment requires it — both the regulator and the affected people are notified.