Cyber Incident Reporting Requirements
Active — no superseding, extending, or expiring guidance found in our tracking.
We track lifecycle status automatically from primary sources; we do not certify it. Verify against the primary source before acting.
Summary
AI summary — grounded in the notice text
This notice instructs public housing agencies to notify HUD promptly whenever a cyber incident occurs, such as a data breach, intrusion, or exploited vulnerability. PHAs must email HUD's Cyber Incident Response Team and their local field office contact within 36 hours of becoming aware of the incident, providing specific required information. This is important so HUD can respond quickly to protect sensitive information and coordinate mitigation steps.
Key Quotes
Verbatim from the notice
“the PHA must email HUD’s Cyber Incident Response Team at CIRT@hud.gov and their local field office point of contact, no later than 36 hours after the PHA’s awareness of the incident”
Verbatim from the notice
“This notice instructs public housing agencies (PHAs) to notify HUD of cyber incidents1 in a timely manner.”
Verbatim from the notice
“Once an incident is reported, HUD representatives will contact the institution’s designated representative to assess the situation and determine appropriate mitigation steps.”
Key Dates
- Published
- Jul 8, 2026