60-Day Notice of Proposed Information Collection: Cyber Incident Reporting Requirements

Issuing agencies

Abstract

HUD is seeking approval from the Office of Management and Budget (OMB) for the information collection described below. In accordance with the Paperwork Reduction Act, HUD is requesting comments from all interested parties on the proposed collection of information. The purpose of this notice is to allow for 60 days of public comment.

Full Text

<html>
<head>
<title>Federal Register, Volume 91 Issue 213 (Thursday, November 5, 2026)</title>
</head>
<body><pre>
[Federal Register Volume 91, Number 213 (Thursday, November 5, 2026)]
[Notices]
[Pages 69858-69859]
From the Federal Register Online via the Government Publishing Office [<a href="http://www.gpo.gov">www.gpo.gov</a>]
[FR Doc No: 2026-22639]


-----------------------------------------------------------------------

DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT

[Docket No. FR-7109-N-16; OMB Control No.: 2577-New]


60-Day Notice of Proposed Information Collection: Cyber Incident 
Reporting Requirements

AGENCY: Office of the Assistant Secretary for Public and Indian Housing 
(PIH), HUD.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: HUD is seeking approval from the Office of Management and 
Budget (OMB) for the information collection described below. In 
accordance with the Paperwork Reduction Act, HUD is requesting comments 
from all interested parties on the proposed collection of information. 
The purpose of this notice is to allow for 60 days of public comment.

DATES: Comments Due Date: January 4, 2027.

ADDRESSES: Interested persons are invited to submit comments regarding 
this proposal. Written comments and recommendations for the proposed 
information collection can be sent within 60 days of publication of 
this notice to <a href="http://www.regulations.gov">www.regulations.gov</a>. Interested persons are also invited 
to submit comments regarding this proposal and comments should refer to 
the proposal by name and/or OMB Control Number and should be sent to 
Dawn Martin, Office of Public and Indian Housing, Department of Housing 
and Urban Development, 451 7th Street SW, Washington, DC 20410.

FOR FURTHER INFORMATION CONTACT: Dawn Martin, Office of Public and 
Indian Housing, Department of Housing and Urban Development, 451 7th 
Street SW, Washington, DC 20410; email <a href="/cdn-cgi/l/email-protection#6e3e2726433e3c2f3e1b0c02070d2d0103030b001a1d2e061b0a40090118"><span class="__cf_email__" data-cfemail="9dcdd4d5b0cdcfdccde8fff1f4fedef2f0f0f8f3e9eeddf5e8f9b3faf2eb">[email&#160;protected]</span></a>; 
telephone 202-402-6488. This is not a toll-free number. HUD welcomes 
and is prepared to receive calls from individuals who are deaf or hard 
of hearing, as well as individuals with speech or communication 
disabilities. To learn more about how to make an accessible telephone 
call, please visit <a href="https://www.fcc.gov/consumers/guides/telecommunications-relay-service-trs">https://www.fcc.gov/consumers/guides/telecommunications-relay-service-trs</a>. Copies of available supporting 
documents for the proposed collection may be obtained from Ms. Martin.

SUPPLEMENTARY INFORMATION: This notice informs the public that HUD is 
seeking approval from OMB for the information collection described in 
section A.

A. Overview of Information Collection

    Title of Information Collection: Cyber Incident Reporting 
Requirements.
    OMB Approval Number: N/A
    Type of Request: New
    Form Number: N/A
    Description of the need for the information and proposed use: 
Public housing agencies (PHAs) are required to report cyber incidents 
to HUD and law enforcement within 36 hours of awareness. PHAs must 
email HUD's Cyber Incident Response Team at <a href="/cdn-cgi/l/email-protection#febdb7acaabe968b9ad0999188"><span class="__cf_email__" data-cfemail="4a0903181e0a223f2e642d253c">[email&#160;protected]</span></a> and the PHA's 
local field office point of contact. For external cyberattacks or 
unauthorized access, PHAs should also notify the FBI via the internet 
Crime Complaint Center at <a href="https://www.ic3.gov">https://www.ic3.gov</a>. This collection will 
facilitate PHAs' required reporting of cyber incidents.
    Reports on cyber incidents must include the following:

<bullet> PHA name
<bullet> PHA code
<bullet> Name, email address, and phone number of the PHA point of 
contact for coordinating follow-up activities
<bullet> Description of the cyber incident, including the following (if 
known):
[cir] Date of the cyber incident
[cir] Cause of the cyber incident
[cir] Impact on personally identifiable information
[cir] Impact on login credentials
[cir] Impact on IT system architecture
[cir] List of any impacted subsidiary or parent companies
[cir] Status of the PHA's response, including whether law enforcement 
and/or FBI has been notified

    Respondents: PHAs.

--------------------------------------------------------------------------------------------------------------------------------------------------------
                                             Number of     Frequency of    Responses per    Burden hour    Annual burden    Hourly cost
         Information collection             respondents      response          annum       per response        hours       per response     Annual cost
--------------------------------------------------------------------------------------------------------------------------------------------------------
Cyber Incident Notification.............            150               1             150               2             300          $68.96      $20,688.00
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Most PHAs will never have to file a report. Burden estimates assume 
an average baseline event frequency across ~3,300 national PHAs, who 
would need to report once per incident. To estimate the hourly cost per 
respondent, HUD used the Department of Labor's Bureau of Labor 
Statistics' most recent (May 2024) data on the State and local 
government workers by occupational and industry group, Financial 
Specialists, All Other (13-2099). HUD

[[Page 69859]]

estimates these affected PHAs, All Other, Professional Series, to have 
an average hourly rate to be $68.96. The total annual burden of this 
collection is expected to be 300 hours. The total estimated annual cost 
for this information collection is $20,688.

B. Solicitation of Public Comment

    This notice is soliciting comments from members of the public and 
affected parties concerning the collection of information described in 
Section A on the following:
    (1) Whether the proposed collection of information is necessary for 
the proper performance of the functions of the agency, including 
whether the information will have practical utility;
    (2) The accuracy of the agency's estimate of the burden of the 
proposed collection of information;
    (3) Ways to enhance the quality, utility, and clarity of the 
information to be collected; and
    (4) Ways to minimize the burden of the collection of information on 
those who are to respond, including through the use of appropriate 
automated collection techniques or other forms of information 
technology, e.g., permitting electronic submission of responses. HUD 
encourages interested parties to submit comments in response to these 
questions.

C. Authority

    44 U.S.C. 3507.

Laura Kunkel,
Chief, Office of Policy, Program, and Legislative Initiatives.
[FR Doc. 2026-22639 Filed 11-4-26; 8:45 am]
BILLING CODE 4210-67-P


</pre><script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script></body>
</html>