In a pure mathematical attack, (i.e., lacking any other information to help break a cipher) two factors above all count: 1  Computational power available, i.e., the computing power which can be brought to bear on the problem. 2  Key size, i.e., the size of key used to encrypt a message.
OMB's guidance to agencies requires them to report each PII-related breach to DHS's U.S. Computer Emergency Readiness Team (US-CERT) within 1 hour of discovery. However, complete information from most incidents can take days or months to compile; therefore preparing a meaningful report within 1 hour can be infeasible.
Once you suspect that there is a security incident, you should quickly communicate the breach to the rest of the core CSIRT. The incident lead, along with the rest of the team, should quickly identify who needs to be contacted outside of the core CSIRT.