Henry's Handy Links:

3. Are You Ready to Report Cyber Incidents to the NCUA?

Starting in September, federally insured state and federal credit unions will have up to 72 hours to report a cyber incident to the NCUA. This is a very significant development in the area of cyber breach reporting even though states have been mandating such disclosures for years. Again, this is a regulation that will require you to update your policies and procedures. The final regulation defines a Reportable Cyber Incident as "any substantial cyber incident that leads to one or more of the following: (A) A substantial loss of confidentiality, integrity, or availability of a network or member information system as defined in appendix A, section I.B.2. e., of this part that results from the unauthorized access to or exposure of sensitive data, disrupts vital member services as defined in § 749.1 of this chapter, or has a serious impact on the safety and resiliency of operational systems and processes. (B) A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities. (C) A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise."

Instant Insights /

3 Things to Put On Your Summer (Compliance) Bucket List

Related Stories

Recommended For You