72 Hours: The NCUA's New Cyber Incident Reporting Requirement

Listen to this post

Three days. Starting September 1, 2023, that is all federally insured credit unions will have to report cyber incidents.

The rule, approved on February 16, 2023, broadly defines cyber incident to include any incident that jeopardizes an information system or the information stored in one. Reportable incidents however are defined by a slightly less broad, but perhaps more complex, three-part definition that also requires a report when a credit union has a "reasonable belief" it has been the victim of a cyber attack:

• Part one requires a report if the incident causes a substantial loss to an information system. This includes through the exposure of data, disruption of vital services, or as a result of a serious impact to the safety and resiliency of a system.