HUD Proposes Cyber Incident Reporting Requirement Within 36 Hours
HUD has issued Notice PIH 2026-17, outlining new reporting requirements for Public Housing Agencies (PHAs) that experience cybersecurity incidents.
Once in effect, if a Housing Authority becomes aware of a cyber incident, it must notify HUD's Cyber Incident Response Team (CIRT) at CIRT@hud.gov and its local field office point of contact within 36 hours of becoming aware of the incident.
Cyber incidents broadly include things like data breaches, unauthorized system access, exploited vulnerabilities, or other attacks that threaten the security of information or IT systems (for example, malware or ransomware, losing a laptop).
When reporting an incident, PHAs will need to provide:
- Housing Authority name and PHA code
- Contact information for the agency representative
- Date and cause of the incident (if known)
- A description of the incident, including any impact on personally identifiable information (PII), login credentials, or IT system architecture
- Status of the agency's response efforts, including whether law enforcement has been notified
HUD also strongly recommends notifying local law enforcement and the FBI's Internet Crime Complaint Center (IC3) when incidents involve external cyberattacks or unauthorized access.
Key Takeaway: While this requirement isn't yet officially in effect, there have been cyber incident requirements in place for a while, but many Housing Authorities have not reported these issues. This notice makes it clearer about whom to contact and when. Housing Authorities should begin reviewing their cybersecurity response procedures now, so staff are prepared to report incidents promptly to HUD once the requirement is finalized.
If you have any questions about this notice or what should be considered a cyber incident, give us a call.
Full Notice Attached Below
