# 2026-22639: HUD Wants Housing Agencies Reporting Cyberattacks Within Just 36 Hours

2026-22639, 60-Day Notice of Proposed Information Collection: Cyber Incident Reporting Requirements, is a Federal Register notice from Housing and Urban Development Department published 2026-11-05, effective Comments Due Date: January 4, 2027.; PRIA reads it as touching household money (as of 2026-11-06).

- Canonical: https://policyrisk.com/federal-register/2026-22639
- As of: 2026-11-06
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Document number: 2026-22639
- Title: 60-Day Notice of Proposed Information Collection: Cyber Incident Reporting Requirements
- Type: Notice
- Agencies: Housing and Urban Development Department
- Citation: 91 FR 69858
- Published: 2026-11-05
- Effective: Comments Due Date: January 4, 2027.
- Comments close: 2027-01-04
- Significant: no
- Touches household money: yes
- Regulation identifier numbers: none
- Last updated: 2026-11-06

## In one line

HUD Wants Housing Agencies Reporting Cyberattacks Within Just 36 Hours

## Summary

Public housing agencies must now report cyberattacks to HUD and law enforcement within 36 hours of finding out. HUD is asking for public feedback on this new rule by January 4, 2027. This helps keep housing data safe and secure, with no extra fees mentioned.

## Abstract

HUD is seeking approval from the Office of Management and Budget (OMB) for the information collection described below. In accordance with the Paperwork Reduction Act, HUD is requesting comments from all interested parties on the proposed collection of information. The purpose of this notice is to allow for 60 days of public comment.

## Effects PRIA read

- 36‑Hour Cyberreporting Deadline for PHAs: cost, low. Public housing agencies (PHAs) must report cyber incidents to HUD and law enforcement within 36 hours of becoming aware. PHAs must email HUD's Cyber Incident Response Team at [email protected] and their local HUD field office, and for external attacks or unauthorized access they should also notify…
- Required Report Content and Data Elements: cost, low. PHAs' cyber incident reports must include the PHA name and code; the PHA point‑of‑contact name, email, and phone; and a description of the incident including date, cause, impacts on personally identifiable information, impacts on login credentials, impacts on IT system architecture, any impacted pa…
- Estimated Annual Burden and Cost to PHAs: cost, low. HUD estimates 150 responses per year at 2 hours per response (300 total burden hours), using an hourly labor rate of $68.96 to produce an estimated total annual cost of $20,688 for the collection. HUD notes this is a new information collection and that most of the ~3,300 PHAs nationwide will never…

## Related documents

- [2026-16228](https://policyrisk.com/federal-register/2026-16228): HUD's Implementation of the Fair Housing Act's Disparate Impact Standard; Amendments to HUD's Title VI Regulations, 2026-08-10
- [2026-13939](https://policyrisk.com/federal-register/2026-13939): Rescission of Floodplain Management and Protection of Wetlands; Minimum Property Standards for Flood Hazard Exposure; Building to the Feder…, 2026-07-10
- [2026-08406](https://policyrisk.com/federal-register/2026-08406): HOME Investment Partnerships Program: Further Program Updates and Streamlining, 2026-04-30
- [2026-08339](https://policyrisk.com/federal-register/2026-08339): HOME Investment Partnerships Program: Further Program Updates and Streamlining, 2026-04-29
- [2026-08244](https://policyrisk.com/federal-register/2026-08244): Equal Access to Housing in HUD Programs Revisions, 2026-04-28
- [2026-06926](https://policyrisk.com/federal-register/2026-06926): HOME Investment Partnerships Program-Maximum Per-Unit Subsidy Limit Methodology and Amount; Notice for Comment, 2026-04-10

## Sources
- [2026-22639 on federalregister.gov](https://www.federalregister.gov/documents/2026/11/05/2026-22639/60-day-notice-of-proposed-information-collection-cyber-incident-reporting-requirements)
- [2026-22639 as published (PDF)](https://www.govinfo.gov/content/pkg/FR-2026-11-05/pdf/2026-22639.pdf)

## Related
- [Previous: 2026-22638, 60-Day Notice of Proposed Information Collection: Family Report, MTW Family Rep…](https://policyrisk.com/federal-register/2026-22638)
- [Next: 2026-22640, Pacific Fishery Management Council; Public Meeting](https://policyrisk.com/federal-register/2026-22640)
- [All Federal Register documents](https://policyrisk.com/federal-register)

Source: PRIA, https://policyrisk.com/federal-register/2026-22639 (as of 2026-11-06).