Community Banks, Credit Unions, RIAs

What arrives

The Interagency Guidelines: 12 CFR Part 364, Appendix B. A written information security program, a risk assessment, service provider oversight, and a report to the board at least annually.; Source
The 36-hour notice: FDIC computer-security incident notification, 12 CFR 304.23. Notice to the primary federal regulator no later than 36 hours after a notification incident is determined.; Source
The ISE: NCUA Information Security Examination procedures, implemented in 2023 to standardize the examination of credit union information security and cybersecurity programs.; Source
The 30-day notice: SEC Regulation S-P amendments, 2024. Notice to affected individuals as soon as practicable, and no later than 30 days after learning of unauthorized access to customer information.; Source
The 72-hour rule: NCUA cyber incident notification, 12 CFR 748.1(c). Notice to NCUA no later than 72 hours after a credit union reasonably believes a reportable cyber incident occurred.; Source