Updated Guidance: NCUA Reporting May Now Be Warranted Following the TruStage Cyber Incident
NCUA Rule 748 requires federally insured credit unions to notify NCUA of a reportable cyber incident within 72 hours. For details on how to notify NCUA of a cyber incident, access the NCUA Cyber Incident Reporting Guide here.
Earlier this week, system partner TruStage sent a general email to credit unions notifying them of a cyber incident. The email did not identify which, if any, credit unions or member data may have been impacted.
TruStage now has up-to-date information and resources regarding the incident on their website.
Based on the initial notice, the League advised that the 72-hour reporting window had not yet been triggered because it was not known whose data, if any, had been compromised. However, now that the TruStage system has been unavailable for multiple days, reporting the incident to NCUA may be warranted at this time.
If your credit union determines that the TruStage outage has disrupted business operations, consider filing the required notice. This determination is separate from whether your credit union's data was compromised, and clarification on that issue is still pending.
For reference, NCUA Rule 748 defines a reportable cyber incident as follows:
(1) Reportable Cyber Incident
(i) A reportable cyber incident is any substantial cyber incident that leads to one or more of the following:
(A) A substantial loss of the confidentiality, integrity, or availability of a network or member information system, as defined in Appendix A, Section I.B.2.e. of this part, that results from unauthorized access to or exposure of sensitive data, disrupts vital member services as defined in § 749.1 of this chapter, or has a serious impact on the safety and resiliency of operational systems and processes.
(B) A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or the exploitation of vulnerabilities.
(C) A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, the compromise of a credit union service organization, cloud service provider, other third-party data hosting provider, or a supply chain compromise.
Questions? Contact Information Central at compliance@cornerstoneleague.coop.
