Credit unions must report a reportable cyber incident to NCUA within 72 hours, including vendor-caused ones

12 CFR 748.1 requires federally insured credit unions to notify NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, and that includes disruptions caused through a cloud, hosting or other third-party provider.

Source facts

Under 12 CFR 748.1(c), each federally insured credit union must notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone or another prescribed method, and NCUA must receive it as soon as possible but no later than 72 hours after the credit union reasonably believes the incident occurred.

A reportable cyber incident is a substantial cyber incident that leads to a substantial loss of confidentiality, integrity or availability of a network or member information system; a disruption of business operations, vital member services or a member information system from a cyberattack or exploited vulnerability; or a disruption or unauthorized access to sensitive data caused through a compromised credit union service organization, cloud service provider, other third-party data hosting provider, or supply chain. For that third-party case the 72 hours can run from being notified by the third party, whichever is sooner. Good-faith activity performed at the system owner’s specific request is excluded.

The same section separately requires notice to the regional director within 5 business days of a catastrophic act, and an annual certification of compliance with the part by the president or managing official.

Applicability

Use this for federally insured credit unions and their technology providers. The rule defines disruption as an unplanned event that makes an information system inoperable for a length of time.

DSE recommendation

DSE recommends adding an NCUA 72-hour decision step to the credit union’s incident plan and to every IT and hosting vendor contract. Name who decides that the credit union reasonably believes a reportable incident occurred, record the time of that belief, keep the NCUA point-of-contact details in the out-of-band contact list, and require providers to notify the credit union immediately of any incident that could meet the third-party definition.

Verification

In a tabletop exercise, simulate a hosting provider outage and a vendor credential compromise. Confirm the decision log records the belief time and the notifying third party, that the NCUA notice could be sent within 72 hours, and that the vendor’s contractual notice path actually reached the credit union.

Official reference

eCFR — 12 CFR Part 748, Security Program, Report of Suspected Crimes, Suspicious Transactions, Catastrophic Acts, Cyber Incidents, and Bank Secrecy Act Compliance. Reviewed October 18, 2026.