60-Day Notice of Proposed Information Collection: Cyber Incident Reporting Requirements
HUD is seeking approval from the Office of Management and Budget (OMB) for the information collection described below. In accordance with the Paperwork Reduction Act, HUD is req...
[Docket No. FR-7109-N-16; OMB Control No.: 2577-New]
AGENCY:
Office of the Assistant Secretary for Public and Indian Housing (PIH), HUD.
ACTION:
Notice.
SUMMARY:
HUD is seeking approval from the Office of Management and Budget (OMB) for the information collection described below. In accordance with the Paperwork Reduction Act, HUD is requesting comments from all interested parties on the proposed collection of information. The purpose of this notice is to allow for 60 days of public comment.
DATES:
Comments Due Date: January 4, 2027.
ADDRESSES:
Interested persons are invited to submit comments regarding this proposal. Written comments and recommendations for the proposed information collection can be sent within 60 days of publication of this notice to
www.regulations.gov.
Interested persons are also invited to submit comments regarding this proposal and comments should refer to the proposal by name and/or OMB Control Number and should be sent to Dawn Martin, Office of Public and Indian Housing, Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410.
FOR FURTHER INFORMATION CONTACT:
Dawn Martin, Office of Public and Indian Housing, Department of Housing and Urban Development, 451 7th Street SW, Washington, DC 20410; email
PIH-PRAPublicComments@hud.gov;
telephone 202-402-6488. This is not a toll-free number. HUD welcomes and is prepared to receive calls from individuals who are deaf or hard of hearing, as well as individuals with speech or communication disabilities. To learn more about how to make an accessible telephone call, please visit
www.fcc.gov/consumers/guides/telecommunications-relay-service-trs.
Copies of available supporting documents for the proposed collection may be obtained from Ms. Martin.
SUPPLEMENTARY INFORMATION:
This notice informs the public that HUD is seeking approval from OMB for the information collection described in section A.
A. Overview of Information Collection
Title of Information Collection:
Cyber Incident Reporting Requirements.
OMB Approval Number:
N/A
Type of Request:
New
Form Number:
N/A
Description of the need for the information and proposed use:
Public housing agencies (PHAs) are required to report cyber incidents to HUD and law enforcement within 36 hours of awareness. PHAs must email HUD's Cyber Incident Response Team at
CIRT@hud.gov
and the PHA's local field office point of contact. For external cyberattacks or unauthorized access, PHAs should also notify the FBI via the internet Crime Complaint Center at
www.ic3.gov.
This collection will facilitate PHAs' required reporting of cyber incidents.
Reports on cyber incidents must include the following:
PHA name
PHA code
Name, email address, and phone number of the PHA point of contact for coordinating follow-up activities
Description of the cyber incident, including the following (if known):
Date of the cyber incident
Cause of the cyber incident
Impact on personally identifiable information
Impact on login credentials
Impact on IT system architecture
List of any impacted subsidiary or parent companies
Status of the PHA's response, including whether law enforcement and/or FBI has been notified
Respondents:
PHAs.
Information collection
Number of respondents
Frequency of response
Responses
per annum
Burden hour per response
Annual
burden hours
Hourly cost per response
Annual cost
Cyber Incident Notification
150
1
150
2
300
$68.96
$20,688.00
Most PHAs will never have to file a report. Burden estimates assume an average baseline event frequency across ~3,300 national PHAs, who would need to report once per incident. To estimate the hourly cost per respondent, HUD used the Department of Labor's Bureau of Labor Statistics' most recent (May 2024) data on the State and local government workers by occupational and industry group, Financial Specialists, All Other (13-2099). HUD
( printed page 69859)
estimates these affected PHAs, All Other, Professional Series, to have an average hourly rate to be $68.96. The total annual burden of this collection is expected to be 300 hours. The total estimated annual cost for this information collection is $20,688.
B. Solicitation of Public Comment
This notice is soliciting comments from members of the public and affected parties concerning the collection of information described in Section A on the following:
(1) Whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will have practical utility;
(2) The accuracy of the agency's estimate of the burden of the proposed collection of information;
(3) Ways to enhance the quality, utility, and clarity of the information to be collected; and
(4) Ways to minimize the burden of the collection of information on those who are to respond, including through the use of appropriate automated collection techniques or other forms of information technology,
e.g.,
permitting electronic submission of responses. HUD encourages interested parties to submit comments in response to these questions.
www.regulations.gov
www.fcc.gov/consumers/guides/telecommunications-relay-service-trs
www.ic3.gov
44 U.S.C. 3507