AWACSMortgage compliance intelligence from Flightline

FHA · Mortgagee Letter ML 2024-23 · Published

Revised Cyber Incident Reporting Requirements

FHA requires approved mortgagees to notify HUD as soon as possible and no later than 36 hours after determining that a reportable cyber incident occurred. Reports must include mortgagee identification, contact details, incident description, and current response status.

Action requiredIn effect nowChecks passed· adjusted automaticallyRead the letter ↗ (opens in a new tab)

Loan impact

From the letter text · verified

Applies to: All FHA-approved mortgagees originating or servicing FHA-insured mortgages that experience a reportable cyber incident.

Addressed to
All FHA-Approved Mortgagees
Investor
FHAFrom the publisher, not quoted from the text
Programs
FHAFrom the publisher, not quoted from the text
Affected area
Records
Applicability confidence
Verified: every row taken from the source text is supported by it; rows marked "from the publisher" are not quoted
Supporting quotes from the letter
  • affected areas“The policy changes supersede ML 2024-10 and will be incorporated into Handbook 4000.1 as follows: Operational Compliance (V.A.2.b)”

What changed

From the letter text · Section V.A.2.b
RequirementPreviouslyNow
Reportable Cyber Incident notification deadlineChangedRequiredNot statedMortgagees must notify HUD as soon as possible and no later than 36 hours after determining that a Reportable Cyber Incident has occurred.
Cyber Incident notification required informationChangedRequiredNot statedReported cyber incidents must include mortgagee identification, designated contact information, incident description, and current response status.

What to do

AWACS interpretation · not source language

What to review: Review the immediate requirement to notify HUD of reportable cyber incidents within 36 hours of determination along with all mandated incident and contact details.

Compliance

Notify HUD as soon as possible and no later than 36 hours after determining that a reportable cyber incident has occurred, submitting all required mortgagee details, contact information, incident descriptions, and response status updates.

IT

Establish escalation procedures to capture and provide all required cyber incident details to HUD within 36 hours of determining that a reportable incident occurred.

QC implications

  • Verify that any reportable cyber incidents were reported to HUD no later than 36 hours after determination and contained all mandatory reporting details.

Source and record

Version 1 · archived

Checks

  • Source verified: Passed

    The document ID, link and publication date match the official source.

  • Quotes match the source: Passed, adjusted automatically

    Every quoted passage appears word for word in the official document.

    • A detail the source does not support was removed or adjusted

  • Requirements backed by the source: Passed

    Anything marked required is backed by the requirement language and dates in the source.

  • In scope: Passed

    The document is about residential mortgage lending.

  • Format and labels: Passed, adjusted automatically

    The record follows the AWACS format and uses its standard labels.

    • A detail the source does not support was removed or adjusted