12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.
\nUnder 12 CFR 748.1(c), each federally insured credit union must notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone or another prescribed method, and NCUA must receive it as soon as possible but no later than 72 hours after the credit union reasonably believes the incident occurred.
\nA reportable cyber incident is a substantial cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system; a disruption of business operations, vital member services or a member information system from a cyberattack or exploited vulnerability; or a disruption or unauthorized access to sensitive data caused through a compromised credit union service organization, cloud service provider, other third-party data hosting provider, or supply chain. For that third-party case the 72 hours can run from being notified by the third party, whichever is sooner. Good-faith activity performed at the system owner’s specific request is excluded.
\nThe same section separately requires notice to the regional director within 5 business days of a catastrophic act, and an annual certification of compliance with the part by the president or managing official.
\nUse this for federally insured credit unions and their technology providers. The rule defines disruption as an unplanned event that makes an information system inoperable for a length of time.
\nDSE recommends adding an NCUA 72-hour decision step to the credit union’s incident plan and to every IT and hosting vendor contract. Name who decides that the credit union reasonably believes a reportable incident occurred, record the time of that belief, keep the NCUA point-of-contact details in the out-of-band contact list, and require providers to notify the credit union immediately of any incident that could meet the third-party definition.
\nIn a tabletop exercise, simulate a hosting provider outage and a vendor credential compromise. Confirm the decision log records the belief time and the notifying third party, that the NCUA notice could be sent within 72 hours, and that the vendor’s contractual notice path actually reached the credit union.
\neCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance. Reviewed October 18, 2026.
", "content_text": "12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.\nSource facts\nUnder 12 CFR 748.1(c), each federally insured credit union must notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone or another prescribed method, and NCUA must receive it as soon as possible but no later than 72 hours after the credit union reasonably believes the incident occurred.\nA reportable cyber incident is a substantial cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system; a disruption of business operations, vital member services or a member information system from a cyberattack or exploited vulnerability; or a disruption or unauthorized access to sensitive data caused through a compromised credit union service organization, cloud service provider, other third-party data hosting provider, or supply chain. For that third-party case the 72 hours can run from being notified by the third party, whichever is sooner. Good-faith activity performed at the system owner’s specific request is excluded.\nThe same section separately requires notice to the regional director within 5 business days of a catastrophic act, and an annual certification of compliance with the part by the president or managing official.\nApplicability\nUse this for federally insured credit unions and their technology providers. The rule defines disruption as an unplanned event that makes an information system inoperable for a length of time.\nDSE recommendation\nDSE recommends adding an NCUA 72-hour decision step to the credit union’s incident plan and to every IT and hosting vendor contract. Name who decides that the credit union reasonably believes a reportable incident occurred, record the time of that belief, keep the NCUA point-of-contact details in the out-of-band contact list, and require providers to notify the credit union immediately of any incident that could meet the third-party definition.\nVerification\nIn a tabletop exercise, simulate a hosting provider outage and a vendor credential compromise. Confirm the decision log records the belief time and the notifying third party, that the NCUA notice could be sent within 72 hours, and that the vendor’s contractual notice path actually reached the credit union.\nOfficial reference\neCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance. Reviewed October 18, 2026.", "content_markdown": "12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.\n\n## Source facts\n\nUnder [12 CFR 748.1(c)](https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748), each federally insured credit union must notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone or another prescribed method, and NCUA must receive it as soon as possible but no later than 72 hours after the credit union reasonably believes the incident occurred.\n\nA reportable cyber incident is a substantial cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system; a disruption of business operations, vital member services or a member information system from a cyberattack or exploited vulnerability; or a disruption or unauthorized access to sensitive data caused through a compromised credit union service organization, cloud service provider, other third-party data hosting provider, or supply chain. For that third-party case the 72 hours can run from being notified by the third party, whichever is sooner. Good-faith activity performed at the system owner’s specific request is excluded.\n\nThe same section separately requires notice to the regional director within 5 business days of a catastrophic act, and an annual certification of compliance with the part by the president or managing official.\n\n## Applicability\n\nUse this for federally insured credit unions and their technology providers. The rule defines disruption as an unplanned event that makes an information system inoperable for a length of time.\n\n## DSE recommendation\n\nDSE recommends adding an NCUA 72-hour decision step to the credit union’s incident plan and to every IT and hosting vendor contract. Name who decides that the credit union reasonably believes a reportable incident occurred, record the time of that belief, keep the NCUA point-of-contact details in the out-of-band contact list, and require providers to notify the credit union immediately of any incident that could meet the third-party definition.\n\n## Verification\n\nIn a tabletop exercise, simulate a hosting provider outage and a vendor credential compromise. Confirm the decision log records the belief time and the notifying third party, that the NCUA notice could be sent within 72 hours, and that the vendor’s contractual notice path actually reached the credit union.\n\n## Official reference\n\n[eCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance](https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/", "url": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Credit unions must report a reportable cyber incident to NCUA within 72 hours, including vendor-caused ones", "item": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/#article", "identifier": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/", "url": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/", "headline": "Credit unions must report a reportable cyber incident to NCUA within 72 hours, including vendor-caused ones", "description": "12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and…", "abstract": "12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.", "articleBody": "12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.\nSource facts\nUnder 12 CFR 748.1(c), each federally insured credit union must notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone or another prescribed method, and NCUA must receive it as soon as possible but no later than 72 hours after the credit union reasonably believes the incident occurred.\nA reportable cyber incident is a substantial cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system; a disruption of business operations, vital member services or a member information system from a cyberattack or exploited vulnerability; or a disruption or unauthorized access to sensitive data caused through a compromised credit union service organization, cloud service provider, other third-party data hosting provider, or supply chain. For that third-party case the 72 hours can run from being notified by the third party, whichever is sooner. Good-faith activity performed at the system owner’s specific request is excluded.\nThe same section separately requires notice to the regional director within 5 business days of a catastrophic act, and an annual certification of compliance with the part by the president or managing official.\nApplicability\nUse this for federally insured credit unions and their technology providers. The rule defines disruption as an unplanned event that makes an information system inoperable for a length of time.\nDSE recommendation\nDSE recommends adding an NCUA 72-hour decision step to the credit union’s incident plan and to every IT and hosting vendor contract. Name who decides that the credit union reasonably believes a reportable incident occurred, record the time of that belief, keep the NCUA point-of-contact details in the out-of-band contact list, and require providers to notify the credit union immediately of any incident that could meet the third-party definition.\nVerification\nIn a tabletop exercise, simulate a hosting provider outage and a vendor credential compromise. Confirm the decision log records the belief time and the notifying third party, that the NCUA notice could be sent within 72 hours, and that the vendor’s contractual notice path actually reached the credit union.\nOfficial reference\neCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:08+00:00", "dateModified": "2026-10-18T22:22:06+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/ncua-credit-union-72-hour-cyber-incident-report/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Credit unions must report a reportable cyber incident to NCUA within 72 hours, including vendor-caused ones" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Playbook", "Important priority" ], "genre": "Playbook", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 397, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "eCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance", "url": "https://www.ecfr.gov/current/title-12/chapter-VII/subchapter-A/part-748" } } ] } }