National Credit Union Administration Docket NCUA-2022-0099 Proposed Rule

2022-16013: Cyber Incident Notification Requirements for Federally Insured Credit Unions

Comment Period Closed

Public comment closed .

Get alerted when the next rule lands

New rules open for comment on their own schedule. Pick how you want to hear about them — we email you when one appears.

Alert me on new National Credit Union Administration rules or alert me on a subject

Publishing to members? Embed a live rule tracker on your own site — the proposed rules in your area and the comment deadlines closing on them, updating themselves. Free, one line of HTML.

Create a free account & build one →

Summary

Due to the increased frequency and severity of cyberattacks on the financial services sector, the NCUA Board is proposing to require a federally insured credit union that experiences a reportable cyber incident to report the incident to the NCUA as soon as possible and no later than 72 hours after the federally insured credit union reasonably believes that it has experienced a reportable cyber incident. This notification requirement provides an early alert to the NCUA and does not require credit unions to provide a detailed incident assessment to the NCUA within the 72-hour time frame.

The agency’s own summary, as published.

What this changes

Amends 1 part of the Code of Federal Regulations — the standing rules this notice rewrites.

Don't miss the comment window

One Click Politics alerts you on every deadline, hearing, and rule change.

See all rules with comments due soon →