Compliance
Could you meet the 72-hour reporting rule?
Since September 2023, NCUA requires credit unions to report a reportable cyber incident within 72 hours — and FFIEC-regulated institutions face parallel expectations. Six questions on whether you could actually meet that clock.
The 72-hour clock starts whether or not you're ready. This checks the decisions and evidence habits that let you meet it without improvising.
Why this matters
The clock starts before you understand the incident
Seventy-two hours sounds generous until you're in it: the hardest part isn't filing, it's deciding whether the event even qualifies, at 2 a.m., with partial information, when the incident may have started at a vendor you don't monitor. Institutions that meet the deadline do it because the reportability criteria, the decision-maker, and the escalation path were all set in advance — and because they documented the decision as they went.
How this is scored
Six weighted questions on the specific capabilities the rule demands: written reportability criteria, a named decision-maker, a tested escalation path, timely vendor notice, a reporting-focused tabletop, and a real-time decision log. Each scores 0–3; the total maps to a readiness band with prioritized gaps.
Questions
What counts as a reportable incident?
Broadly, a substantial cyber incident that disrupts operations or member services, or that involves unauthorized access to sensitive data — including at a vendor. The critical move is to write your own criteria in advance so the call isn't made cold.
Does the rule apply to incidents at our vendors?
Yes. If a reportable incident occurs at a third party that affects the credit union, the clock still applies — which is why timely contractual notice from core, digital-banking and MSP vendors matters.
What do examiners look for afterward?
A tested plan, evidence it was tested, and a decision log showing how and when you determined reportability and filed. Reconstructed-after-the-fact evidence is weak; log it in real time.
Make the 72-hour clock a non-event
We set your reportability criteria, escalation path and evidence habits in advance, so the decision is made with a recommendation in hand.