Briefing
Two federal notification rules apply to the US community banks and credit unions we support. Banks supervised by the OCC, the Federal Reserve or the FDIC must notify their primary regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred. Federally insured credit unions must notify the NCUA as soon as possible and no later than 72 hours after they reasonably believe a reportable cyber incident has occurred, a requirement in effect since September 1, 2023.
The FFIEC Cybersecurity Assessment Tool was retired on August 31, 2025. NCUA updated its Automated Cybersecurity Evaluation Toolbox (ACET) in September 2025 and mapped it to NIST CSF 2.0. Assessment tooling has changed. The notification clocks have not.
What we see in practice is a communications problem, not a paperwork problem. The incident that starts the clock is often the same event that takes down email, the hosted phone system or the core network. If the only copy of the regulator contact list lives in the mailbox that is encrypted, or the only way to reach the incident team is a desk phone on the affected network, the 36 or 72 hours start without anyone able to act.
What to do
- Write the notification step into the incident response plan: who decides that an event is reportable, who makes the call to the regulator, and the backup for each.
- Keep the regulator contact details, the plan and the call tree in a printed copy and in an out-of-band location that does not depend on your domain email.
- Set up an out-of-band voice path for the incident team: mobile numbers on a separate carrier, or a conference bridge that does not ride your production network.
- Confirm your hosted phone platform can forward main numbers to mobile devices within minutes if the branch network is unavailable, and document who can make that change.
- Ask each critical vendor (core, digital banking, MSP) how they will notify you. The bank rule also requires bank service providers to notify affected customers.
- Choose a current assessment framework (ACET for credit unions, NIST CSF 2.0 or CISA CPG 2.0 for banks) and record the choice with the board.
How to verify
- Run a tabletop where email and the main phone line are assumed unavailable. Time how long it takes to reach the person authorized to notify the regulator.
- Test the call forwarding change on a weekday afternoon and record how long it took.
- Confirm the printed plan copy is current by comparing its revision date to the electronic version.
- Review vendor contracts for incident notification language and note any gaps.
Sources
- Federal Register, Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers (2021)
- eCFR, 12 CFR Part 53, Computer-Security Incident Notification (OCC)
- eCFR, 12 CFR 748.1, Filing of reports (NCUA cyber incident notification)
- NCUA, ACET and Other Assessment Tools
- OCC Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool sunset statement
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
- CISA, Cybersecurity Performance Goals 2.0
Questions about your phones, network or IT? Contact Texwan.