HUD has put a firm timeline on something many agencies handle informally. Under Notice PIH 2026-17, issued July 8, 2026, every PHA must notify HUD of a cyber incident within 36 hours of becoming aware of it. The notice applies to all public housing agencies and remains in effect until amended, superseded, or rescinded.
For most agencies, the requirement itself is simple. The challenge is being ready to meet it. Thirty-six hours passes quickly when staff are also containing the incident, contacting vendors, and answering questions from leadership.
What the Notice Requires
When a cyber incident occurs, the PHA must email HUD’s Cyber Incident Response Team at CIRT@hud.gov and its local field office point of contact no later than 36 hours after the agency becomes aware of the incident. HUD will then contact the agency’s designated representative to assess the situation and determine mitigation steps.
The notice defines incidents broadly. Data spillage, unauthorized access, breaches, exploited vulnerabilities, and other attacks all qualify. In practical terms, any event that puts the confidentiality, integrity, or availability of agency information or systems at risk starts the clock. That includes events discovered through a vendor or software provider, not just attacks on systems the agency runs directly.
When the incident involves an external attack or unauthorized access, HUD also recommends notifying law enforcement and the FBI’s Cyber Crimes Unit through the Internet Crime Complaint Center. That step is recommended, not required.
What the Report Must Include
The notification email is more than a heads-up. HUD specifies the information each report must contain:
- PHA name and PHA code
- Name, email address, and phone number of the agency’s point of contact
- Date and cause of the incident, if known
- Impact on Personally Identifiable Information (PII)
- Impact on login credentials
- Impact on IT system architecture
- Any impacted subsidiary or parent companies
- Status of the response, including whether law enforcement or the FBI has been notified
- Gathering these details from scratch in the middle of an active incident is difficult. Gathering them from a template the agency built in advance takes minutes.
One status note for precision: the notice instructs PHAs to implement this notification practice now, while its information collection requirements take formal effect once approved by the Office of Management and Budget under the Paperwork Reduction Act. Agencies should not wait on that approval to build their process.
Steps PHAs Can Take Now
- Designate a cyber incident point of contact and a backup, and record their information where leadership and IT staff can find it.
- Confirm your local field office point of contact today, before an incident makes the question urgent.
- Build a one-page reporting template that mirrors HUD’s required data elements, ready to complete and send.
- Add the 36-hour HUD notification step to your incident response plan, with the clock starting at awareness, not at confirmation.
- Train front-line staff to recognize and escalate potential incidents, since the clock starts when anyone at the agency becomes aware.
- Review agreements with software vendors and IT providers to confirm their breach notification timelines allow you to meet yours.
Stay Ahead of HUD Policy Changes
HUD regulations shift often, and the operational impact is not always obvious at first read. AMA’s policy updates break down what changed, what it means for PHA operations, and what to watch next, delivered in plain language your team can act on.
When Additional Support May Make Sense
Agencies reviewing their incident response procedures, vendor agreements, or system security posture do not need to build that capacity alone. AMA supports PHAs with structured operational processes, technology advisory, and the documentation that makes compliance defensible when HUD follows up.
This article is intended as general information and does not replace HUD regulations or official guidance.