Cyber Incident Reporting (2024)

Cyber Incident Notification Requirements

NCUA 12 CFR 748

The National Credit Union Administration amended Part 748 of its regulations to require a federally insured credit union (FICU) that experiences a reportable cyber incident to report the incident to the NCUA as soon as possible and no later than 72 hours after the FICU reasonably believes that it has experienced a reportable cyber incident. This notification requirement provides an early alert to the NCUA and does not require a FICU to provide a detailed incident assessment to the NCUA within the 72-hour time frame.

Cyber Incident Reporting Quick Reference Guide

When to Report

A federally insured credit union that experiences a reportable cyber incident must report the incident to the NCUA as soon as possible and no later than 72 hours after the credit union reasonably believes that it has experienced a reportable cyber incident.

How to Report

To report a cyber incident, federally insured credit unions may notify the NCUA through the following channels:

What to Report

Federally insured credit unions should be prepared to provide the following information, if known, at the time of reporting.

  • Reporter Name and Title: Name and title of individual reporting the incident
  • Callback Number: Best callback number for the NCUA to contact regarding the incident
  • Charter Number: Do not include leading zeros
  • Credit Union Name: Name of affected credit union
  • Date and Time Identified: The date and time the credit union reasonably believes a reportable cyber incident took place
  • Description: A general description of the reportable cyber incident:
    • What services were impacted?
    • Was sensitive data or member information compromised?
    • What impact did it have on operations?

At the time of initial notification, do not send the NCUA:

  • Sensitive personally identifiable information;
  • Indicators of compromise;
  • Specific vulnerabilities; or
  • Email attachments.
Cyber Incident Reporting (2024)

FAQs

Cyber Incident Reporting? ›

Organizations should report anomalous cyber activity and/or cyber incidents 24/7 to report@cisa.gov

cisa.gov
The Cybersecurity and Infrastructure Security Agency (CISA ) is an operational component of the Department of Homeland Security (DHS).
https://www.cisa.gov › doing-business-cisa
or 1-844-Say-CISA.

What is the CISA rule for cyber incident reporting? ›

CIRCIA specifies that covered entities must report cybersecurity incidents within 72 hours after the entity reasonably believes a covered incident has occurred, and 24 hours after making a ransomware payment, and also authorizes CISA to request information and compel information disclosure through enforcement actions.

How do I report a cyber incident to the DOD? ›

A: All Mandatory/Voluntary Reports can be submitted through the DIBNet (https://dibnet.dod.mil) splash page. You may also call the DCISE Hotline to report an incident (410) 981-0104.

What is reporting in cybersecurity? ›

What is a cybersecurity report? A cybersecurity report presents critical information about cybersecurity threats, risks within a digital ecosystem, gaps in security controls, and the performance of security programs.

What is the NIST incident reporting process? ›

The NIST incident response process is a cyclical activity featuring ongoing learning and advancements to discover how to best protect the organization. It includes four main stages: preparation, detection/analysis, containment/eradication, and recovery.

What are the NIST requirements for incident response? ›

NIST Incident Response Framework: The 4 Steps
  • Step 1: Incident Preparation and Prevention. The first phase of the NIST framework includes two important functions: preparation and prevention. ...
  • Step 2: Detection & Analysis. ...
  • Step 3: Containment, Eradication, and Recovery. ...
  • Step 4: Post-Incident Activity.

What are four 4 guidelines for completing an incident report? ›

Writing any incident report involves four basic steps.
  • Respond Immediately. Employees should notify their supervisor as soon as an accident or injury occurs. ...
  • Find the Facts. ...
  • Analyze. ...
  • Complete Corrective Action Plan.

What is considered a cyber incident? ›

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

When should you report a cyber incident? ›

If you suffer a personal data breach you'll need to contact the ICO: You're legally obliged to report any personal data breaches within 72 hours of becoming aware of them, unless you can show that the breach is unlikely to pose a risk to individuals' rights and freedoms.

Who is legally responsible for a cyber incident? ›

If the breach involves a cyberattack in a traditional data owner's proprietary network & data center, the data owner is obviously potentially liable. State and federal data privacy laws in the U.S. do not impose civil liabilities in the event of a cyber intrusion.

Can you report cyber crime to the FBI? ›

Visit IC3, the FBI's Internet Crime Complaint Center. Your tips help the FBI track down cyber criminals around the world. Report your crime to www.IC3.gov today.

Who do you contact in the event of a cybersecurity incident? ›

Cybercrimes can be reported to your local police department or the local RCMP detachment for geographical areas where the RCMP is the police of jurisdiction.

How to report security incidents? ›

If the incident poses any immediate danger, call 911 to contact law enforcement authorities immediately. You can also report IT security incidents within your unit or department.

What are the three stages of reporting a security incident? ›

Our Cyber Incident Response Team (CIRT) has classified three phases of remediating lateral movement: visibility, containment, and response. Let's break down each phase and see how you can apply the methodology to your own environment.

What is the CISA disclosure policy? ›

The Cybersecurity and Infrastructure Security Agency's (CISA) Vulnerability Disclosure Policy (VDP) Platform supports agencies with the option to use a centrally managed system to intake vulnerability information from the public to improve the security of the agency's internet-accessible systems.

How does CISA define cybersecurity? ›

Cybersecurity is the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.

What are the cybersecurity incident response protocols? ›

The National Institute of Standards and Technology (NIST) provides four phases of an incident response plan: Preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Recognizing that preparatory and post-incident activities are equally significant.

What is the CISA Act for cybersecurity and infrastructure security agency? ›

The Cybersecurity and Infrastructure Security Agency Act of 2018 (H.R. 3359, Pub. L. Tooltip Public Law (United States) 115–278 (text) (PDF)) was signed by president Donald Trump on November 16, 2018, to establish the Cybersecurity and Infrastructure Security Agency under the Department of Homeland Security.

Top Articles
Latest Posts
Article information

Author: Sen. Ignacio Ratke

Last Updated:

Views: 6348

Rating: 4.6 / 5 (56 voted)

Reviews: 87% of readers found this page helpful

Author information

Name: Sen. Ignacio Ratke

Birthday: 1999-05-27

Address: Apt. 171 8116 Bailey Via, Roberthaven, GA 58289

Phone: +2585395768220

Job: Lead Liaison

Hobby: Lockpicking, LARPing, Lego building, Lapidary, Macrame, Book restoration, Bodybuilding

Introduction: My name is Sen. Ignacio Ratke, I am a adventurous, zealous, outstanding, agreeable, precious, excited, gifted person who loves writing and wants to share my knowledge and understanding with you.