72 hours is shorter than it sounds

Federally insured credit unions must report a reportable cyber incident to NCUA within 72 hours of forming a reasonable belief that one occurred — including substantial incidents at third-party providers that affect the credit union. The threshold language does the heavy lifting: 'reasonable belief' means the clock starts during the fog of an active incident, not after forensics closes.

That interacts with everything else on your incident timeline: Appendix B member-notification obligations, law-enforcement coordination, cyber-insurance carrier notice, and — if you have one — your MSSP's escalation chain. Without pre-made decisions, 72 hours evaporates in conference calls.

We define your reportability criteria in advance — worked examples included — draft the notification templates, wire the escalation tree (including vendor-incident intake), and then run tabletop exercises against realistic scenarios until the 72-hour path is muscle memory. When a real event hits, your team executes a rehearsed play instead of improvising one.