Briefing
Banking organizations supervised by the OCC, the Federal Reserve or the FDIC must notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a computer-security incident rises to the level of a notification incident. Bank service providers must notify affected bank customers as soon as possible when an incident could disrupt service for four or more hours.
Federally insured credit unions must notify the NCUA as soon as possible and no later than 72 hours after they reasonably believe they have experienced a reportable cyber incident. The requirement is in 12 CFR 748.1 and has applied since September 1, 2023.
At the same time, the assessment landscape changed. The FFIEC Cybersecurity Assessment Tool was sunset on August 31, 2025, and NCUA updated ACET in September 2025 with mappings to NIST CSF 2.0. Institutions that relied on CAT need a replacement method, and examiners will still ask how incidents are classified and reported.
What to do
- Define in writing which events count as notification incidents for your institution, using the definitions in the rules rather than general severity labels.
- Name the person authorized to make the determination and the person authorized to notify, with a backup for each.
- Record the start time of the clock in your incident ticket template so it is captured at the moment of determination.
- Review contracts with core processors and other service providers for notification commitments.
- Select a replacement assessment framework, map last year's CAT results to it, and present the plan to the board.
How to verify
- Run a tabletop exercise and measure the time from detection to the notification decision.
- Confirm the incident ticket template includes the determination time and the regulator contact.
- Check that board minutes record the framework decision.
- Confirm each critical vendor has a current incident contact on file.
Sources
- Federal Register, Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers (2021)
- eCFR, 12 CFR Part 53, Computer-Security Incident Notification (OCC)
- eCFR, 12 CFR 748.1, Filing of reports (NCUA cyber incident notification)
- NCUA, ACET and Other Assessment Tools
- OCC Bulletin 2024-25, FFIEC Cybersecurity Assessment Tool sunset statement
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
Want help putting this in place? Contact Computer Plus.