FHA's Releases 12-Hour Cyber Incident Notification Rule

On May 23, the U.S. Department of Housing and Urban Development (HUD) announced that Federal Housing Administration-approved Mortgagees are subject to a heightened cybersecurity incident reporting regime. The new requirement, which amends the Single Family Housing Policy Handbook 4000.1, requires FHA-approved Mortgagees to report "suspected" "Significant Cybersecurity Incidents" within 12 hours of detection.

Under the new requirements, FHA-approved mortgagees must report to HUD when they experience a "suspected" Significant Cyber Incident, which HUD defines as either an event that (1) "actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system" or (2) "constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies and has the potential to directly or indirectly impact the FHA-approved mortgagee's ability to meet