United StatesNCUA Cyber Incident Notification Requirements for Federally Insured Credit Unions
NCUA Cyber Incident Notification Requirements, 12 CFR 748.1(c)
In force since .
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a federally insured credit union. Declare is_bank where that holds; a credit union that is not federally insured is outside this paragraph.
- If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
- Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
- A cyber incident performed in good faith by an entity in response to a specific request by the owner or operators of the system is not a reportable cyber incident.
These lines are LexLint's reading of the law's text, as of .
What this law does
A federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe.
The NCUA must receive the notification as soon as possible but no later than 72 hours after the credit union reasonably believes that it has experienced a reportable cyber incident or, if the incident arises through a third party, within 72 hours of being notified by the third party, whichever is sooner.
A reportable cyber incident includes a substantial cyber incident that leads to a substantial loss of confidentiality, integrity, or availability of a network or member information system that results from the unauthorized access to or exposure of sensitive data, disrupts vital member services, or has a serious impact on the safety and resiliency of operational systems and processes.
A reportable cyber incident also includes a substantial cyber incident that leads to a disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.
A reportable cyber incident further includes a substantial cyber incident that leads to a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.
A reportable cyber incident does not include any event where the cyber incident is performed in good faith by an entity in response to a specific request by the owner or operators of the system. The final rule is effective .
When LexLint raises it
When your app profile says your app is a bank.