Cybersecurity for Credit Unions: What NCUA Examiners Expect

NCUA cybersecurity expectations have moved well beyond a checklist. If your credit union has sat through an examination recently, you already know that examiners arrive with specific questions, specific documents in mind, and specific outcomes they want to verify. The days of pointing to a policy binder and calling it done are over. NCUA cybersecurity examination findings now show up in your CAMELS rating, drive Documents of Resolution with assigned owners and deadlines, and, if left unresolved, escalate to formal supervisory action.

This guide covers the full picture: the regulatory foundation you’re required to build on, the NCUA examination framework examiners use to assess your program, the specific controls they look for in every tier of credit union, and the current priorities that will shape exam conversations in 2025 and 2026. Whether you run a $30 million community credit union or a multi-billion dollar institution, understanding what examiners want to see, and what they most commonly find missing, is the first step to a smoother NCUA cybersecurity examination.

TL;DR

NCUA cybersecurity compliance for credit unions is grounded in 12 CFR Part 748, which requires all federally insured credit unions to maintain a written information security program covering risk assessment, access controls, vendor oversight, and testing. Appendix A guidance also addresses annual board reporting. Since September 2023, credit unions must also notify NCUA within 72 hours of a reportable cyber incident. Examiners use a tiered framework called the Information Security Examination (ISE) program, which uses SCUEP for credit unions with $50 million or less in assets, CORE above $50 million, and optional CORE+ examination elements based on risk. Cybersecurity remains a top-tier supervisory risk in 2026, including concerns about third-party vendors after a November 2023 ransomware attack on a service provider disrupted operations at 60 small credit unions. Common exam deficiencies include stale risk assessments, missing board annual reports, unreviewed privileged access, former employees with active accounts, undocumented vendor oversight, and untested business continuity plans. NCUA relies primarily on informal tools like Documents of Resolution to address findings rather than formal enforcement, but escalation to formal action is real when informal remedies are ignored.

The Regulatory Foundation: 12 CFR Part 748 and the 72-Hour Rule

NCUA cybersecurity rules for federally insured credit unions rest on 12 CFR Part 748. This regulation requires every federally insured credit union to develop and maintain a written information security program (WISP). The WISP must reflect the actual size, complexity, and risk profile of your institution. Section 748.0 and the Gramm-Leach-Bliley Act establish the information-security safeguards obligation. Appendix A provides guidance on identifying reasonably foreseeable threats to member information, evaluating their potential impact, and assessing whether existing safeguards address those risks. Appendix A guidance discusses access controls, employee screening where appropriate, vendor oversight, independent testing, and incident response. Appendix B provides guidance on responding to unauthorized access to member information, including member notification when warranted.

Federally insured state-chartered credit unions (FISCUs) reach Part 748 through a cross-reference in 12 CFR Part 741.214. As NASCUS commented in its 2024 regulatory review, this cross-referencing structure creates real confusion for both credit unions and examiners because most substantive rules for FISCUs are scattered across rules written for federally chartered credit unions. Part 749 governs records preservation separately. The president or managing official certifies the applicable Profile information in CUOnline, or authorizes another submitter to certify it on their behalf.

Effective September 1, 2023, NCUA amended Part 748 to require all federally insured credit unions to notify the agency within 72 hours of reasonably believing a reportable cyber incident has occurred. The Federal Register final rule published March 1, 2023 established the rule and defined its scope. The rule defines 3 reportable-incident prongs:

Blocked phishing attempts, failed access attempts, unsuccessful malware attacks, penetration tests conducted at the credit union’s request, and routine or planned outages are not reportable. An unplanned widespread outage caused by a failed software upgrade is a different matter and would typically fall under Prong 2. The 72-hour clock runs from when the credit union “reasonably believes” it has experienced a reportable incident. For third-party-caused incidents, the clock starts when the vendor notifies the credit union, if that notification comes first. Reporting goes to cyberreports.ncua.gov, the phone line 833-CYBERCU, or secure email at cybercu@ncua.gov. NCUA Letter 25-CU-02, issued in 2025, updated the earlier guidance in Letter 23-CU-07 on notification requirements.

How the ISE Program Works: Three Examination Tiers

The Information Security Examination (ISE) program replaced the ACET-based examination framework as the standard approach starting in 2023. Where ACET relied heavily on credit union self-reporting across hundreds of questions, the ISE is an examiner-driven, risk-focused assessment. SCUEP applies to credit unions with $50 million or less in assets, CORE to credit unions above $50 million, and specialists may use optional CORE+ elements when risks warrant them. Examiners assess 4 core areas in every ISE: management’s ability to recognize and manage IT risks, whether the credit union has sufficient expertise to manage technology operations, whether the board has adopted adequate technology policies, and the adequacy of internal controls for safeguarding member information.

SCUEP ($50 Million and Below)

The Small Credit Union Examination Program covers credit unions with $50 million or less in assets. Depending on the risk profile, testing may include a current risk assessment, an IT security audit, vulnerability assessment, external penetration test, security awareness training, phishing or vishing simulations, and tabletop testing of disaster recovery and business continuity plans. These examples are not a fixed mandatory SCUEP testing checklist.

CORE (Over $50 Million)

CORE applies to credit unions with more than $50 million in assets. Based on risk, testing may also include annual vulnerability assessments, a documented vulnerability management program, internal penetration testing, and onsite social engineering testing. Practitioners describe onsite tests as a way to check how staff respond when someone attempts access in person. These are possible assessment activities, not automatic CORE requirements.

CORE+ (Large and Complex Credit Unions, at Examiner Discretion)

CORE+ consists of optional examination elements that specialists may use based on risk. Examples include quarterly authenticated vulnerability assessments, smishing (SMS phishing) testing, physical security testing, web application testing (if the credit union operates a web app), wireless controls testing, remote access control testing, password security testing, firewall testing, and ransomware readiness assessments. Each is relevant only when the credit union’s systems and risk profile call for it; the list is not a mandatory CORE+ testing matrix.

The Written Information Security Program: What Examiners Expect

The WISP is the foundation of the credit union information security program and the first thing examiners want to see. Section 748.0 requires a written information security program, while Appendix A guidance supports keeping it current. A policy last updated in 2021 that still references decommissioned systems is a problem, and examiners will find it.

The annual board report is its own common deficiency. Verbal updates alone do not follow the annual reporting approach described by Appendix A guidance. Appendix A Section F guidance says the annual report should cover risk assessment findings, risk management decisions, service provider arrangements, testing results, security breaches and management responses, and recommendations for the coming year. The annual report should be presented to the board or appropriate committee, and the minutes should document the board’s review. The board separately approves the information security program. The 2026 NCUA IT requirements guidance notes that examiners are looking for documented, board-approved risk assessments tied to actual security decisions, not assessments that sit in a folder and get reviewed once a year without driving program changes.

The WISP also must establish a current risk assessment. Your cybersecurity risk assessment should identify internal and external threats specific to your size and complexity, evaluate the likelihood and potential impact of each, and map those risks to the controls in place. The assessment then drives your security testing schedule, your vendor management priorities, and what gets reported to the board. An outdated or generic risk assessment that reads like a template is one of the most frequently cited exam deficiencies.

Vendor and Third-Party Risk Management

Section 748.0 establishes the information-security obligation, while Appendix A guidance advises credit unions to address service provider safeguards in contracts and Appendix B guidance addresses incident response and member notification. The credit union remains responsible to NCUA for notification and remediation even when the breach originates at a vendor. From September 1, 2023 through August 31, 2024, NCUA received 1,072 cyber incident reports, including 742 involving third parties, about 69%. A November 2023 ransomware attack on a service provider disrupted operations at 60 small credit unions, demonstrating how a single vendor failure can cascade across the entire credit union system.

Because NCUA lacks statutory authority to examine third-party vendors directly, the entire burden of oversight falls on the credit union’s own vendor management program. Vendor oversight may be reviewed in an NCUA cybersecurity examination based on the credit union’s risks. Examiners may look for inventories of significant third-party relationships, vendor risk assessments, contract safeguards and notification provisions, and documented ongoing monitoring. The NCUA 2025 Cybersecurity and System Resilience Report identifies reliance on vendors as creating “inconsistent incident response, supply chain attacks, and limited visibility into vendor controls.”

Annual questionnaires alone may not demonstrate adequate ongoing monitoring. NCUA Supervisory Letter 07-01 recommends lifecycle management of third-party relationships, with monitoring matched to each vendor’s risk level. For critical vendors, core processors especially, examiners may review SOC 2 Type II assessments, documented exceptions, and monitoring of the vendor’s financial health. The credit union information security program must treat cloud service providers and SaaS platforms hosting member data the same as any other critical vendor. Cloud DR arrangements don’t transfer regulatory accountability to the cloud provider. The credit union remains responsible for the outcome regardless of where recovery services are hosted. NCUA examines vendor management as part of risk-focused operational and information-security reviews, including when payment systems or other critical providers are involved.

Access Management, Incident Response, and Security Training

Access controls are among the areas NCUA examiners may review based on a credit union’s risks. Examples include multi-factor authentication for remote access and core banking systems, periodic access reviews for critical systems with management sign-off, privileged access reviews documenting who holds admin rights and why, and evidence that terminated employee access was removed promptly. Examiners may compare HR termination records against active accounts in your core system and directory. For higher-risk or complex institutions, testing may also cover remote access controls, conditional access rules, and password security. These are examples of risk-based tests, not fixed requirements assigned to CORE+ by the publicly available ISE description.

Part 748 Appendix B guidance describes 5 elements to consider in an incident response plan: assessing the nature and scope of the incident, notifying NCUA and the state supervisory authority where applicable, notifying law enforcement when federal criminal violations require immediate attention, containing the incident while preserving evidence, and notifying affected members when warranted. Separately, Section 748.1 requires notification to NCUA within 72 hours of reasonably believing a reportable cyber incident occurred. A useful plan sets an internal escalation path, thresholds for deciding what is reportable, and responsibility for making the report. Examiners may also review tabletop exercise documentation, including the scenario tested, participants, findings, and any plan updates that followed. If you ran a tabletop and didn’t update the plan to reflect what you learned, an examiner may ask why.

Security awareness training and social engineering simulations help credit unions address risks identified through the information security program. Depending on those risks, examiners may review training completion records, phishing simulation results, and follow-up action for employees who failed simulations. A closed-loop approach where simulation results drive training decisions and those decisions are documented provides useful evidence. Annual training that doesn’t change based on phishing simulation results may leave a gap. Onsite social engineering exercises or smishing tests may also be relevant, but NCUA’s public ISE tier description does not make them fixed CORE or CORE+ requirements. NCUA Letter 24-CU-02 identifies recurring director cybersecurity training as a board responsibility, so keeping records of board-level training can help during an examination.

Business Continuity, Backup, and the ACET Tool

Part 749, as revised effective July 16, 2026, focuses on preserving vital records needed to restore essential member services. NCUA separately provides business-continuity and catastrophe-preparedness practices that credit unions can use when designing and testing recovery plans. Those practices may include board-reviewed BC/DR policies, a Business Impact Analysis (BIA) defining recovery time objectives and recovery point objectives for critical systems, communication plans, and documented exercises. NCUA does not prescribe specific RTO or RPO numbers. The BIA can establish those based on your own analysis of operational dependencies. Tabletop exercises and full failover testing can help validate plans, depending on the institution’s risk profile. BC/DR plans may include cyber-specific scenarios, and backup restoration testing can be particularly useful for complex systems. These are preparedness practices, not stand-alone requirements imposed by Part 749 or a mandatory CORE+ checklist.

The Automated Cybersecurity Evaluation Toolbox (ACET), currently at version 12.4.0.1, is NCUA’s free voluntary self-assessment tool. It covers inherent risk and cybersecurity maturity across 5 domains with 4 maturity levels (baseline, evolving, intermediate, advanced). The NCUA ACET page clarifies that ACET adds no new regulatory requirements and is not the examination tool. The FFIEC Cybersecurity Assessment Tool was sunset on August 31, 2025, and NCUA updated ACET in September 2025 to incorporate NIST CSF 2.0 content. A credit union that runs ACET regularly and can show a documented self-assessment history is generally better positioned in an exam than one that can’t demonstrate any structured self-evaluation. MERIT, which replaced the legacy AIRES system in August 2021, is the secure platform through which credit unions send documents to examiners, receive exam reports, and respond to findings.

Board Governance and Enforcement

Cybersecurity exam findings primarily land in the Management (“M”) component of NCUA’s CAMELS rating system. The Management component covers board and management oversight, risk management, and internal controls. A credit union with poor cybersecurity governance, whether that means no board-approved information security program, a board that receives no written annual IS report, or management that hasn’t responded to DOR findings, will see a lower M rating. Per NCUA Letter 24-CU-02, boards have 4 defined cybersecurity responsibilities: providing recurring director training, approving the information security program, overseeing operational management including patch management and vendor due diligence, and ensuring effective incident response planning and resilience testing. These are not aspirational. Examiners will ask for documentation of each.

NCUA has not publicly confirmed a formal enforcement action (cease-and-desist order, civil money penalty, or conservatorship) specifically tied to cybersecurity failures in the 2020 through 2026 period. NCUA’s stated philosophy is to use the lowest level of action necessary. The Document of Resolution (DOR) is the primary informal tool: it names responsible parties, sets remediation timelines, and is tracked through NCUA’s examination system. Historical data shows an average resolution time of about 10 months. Ignoring a DOR without justification triggers escalation to formal action. The OIG audit of NCUA’s Office of National Examinations and Supervision found zero recommendations when it reviewed cybersecurity oversight effectiveness.

Common deficiencies that generate DORs include:

●      Stale or generic risk assessments

●      Missing written annual board IS reports

●      Unreviewed privileged access

●      Former employees with active system credentials

●      Vendor oversight failures: SOC 2 exceptions not reviewed, no documented ongoing monitoring

●      Untested or outdated BC/DR plans

●      Patch management gaps with no defined severity-based timeframes

●      MFA not enforced for remote access or core banking

●      No network segmentation between member-facing and internal systems

●      No DMARC email authentication

●      Insufficient audit logging

2025 and 2026 Examiner Priorities

Cybersecurity remains a top-tier supervisory risk in 2026. Current examinations address it through information-security reviews and operational-risk areas such as payment systems, fraud, and vendor management. The ISE program is now in its fourth year with no fundamental restructuring, but several specific developments are shaping current examiner expectations.

AI-enabled attacks are accelerating. The NCUA 2026 Cybersecurity and System Resilience Report notes that attacks involving AI-enabled techniques increased by nearly 90%, citing CrowdStrike data. AI makes social engineering more convincing and exploit development faster. NCUA has issued no formal credit union-specific AI risk guidance, and a 2025 GAO report (GAO-25-107197) flagged this as a supervisory gap. Credit unions using AI in lending, fraud detection, or member services should document their AI governance frameworks now, citing NIST AI RMF, to be ready when NCUA cybersecurity examiner questions formalize around this area.

Ransomware remains an acute threat. The NCUA 2025 Cybersecurity and System Resilience Report states that ransomware attacks, payments, frequency, scope, and volume are all rising. Ransomware-as-a-service has lowered the barrier to entry for attackers significantly. Ransomware readiness assessments may be included in optional, risk-based examination work. Any credit union without a dedicated ransomware incident response playbook is likely to see that gap show up in NCUA examination findings under business continuity or incident response categories, even at CORE tier.

Third-party vendor scrutiny remains important given what the incident data has shown. NCUA’s 2026 priorities address vendor oversight in risk-focused examinations, especially around payment systems and operational risk. Depending on exposure, examiners may review vendor due diligence, security controls and access authorizations, and contingency plans for vendor outages. Payment systems security is entering the NCUA examination scope more directly, with faster payments adoption bringing new questions about access authorizations and fraud controls around payment processing systems.

For smaller credit unions, NCUA directs institutions to several free resources. CISA’s Cyber Hygiene Services provides free scanning and vulnerability identification; more than 300 credit unions engaged with CISA’s services in the 2024-2025 reporting period. FS-ISAC and the NCU-ISAO provide threat intelligence sharing. The NCUA Cybersecurity Resource Center offers free online training courses and links to agency guidance. A credit union that runs ACET regularly and can show examiners a documented self-assessment history will generally have a smoother NCUA cybersecurity examination than one that can’t demonstrate any structured self-evaluation activity.

Network Security Controls Examiners Review

NCUA cybersecurity examination coverage of network security depends on the credit union’s risk profile and ISE scope. Depending on the systems involved, examiners may review firewall rules, network segmentation between member-facing and internal systems, intrusion detection and prevention monitoring, separate wireless networks for guests and staff, and secured remote access and VPN configurations. The public ISE description does not prescribe this as a fixed control checklist for every credit union.

Patch management may be reviewed at any examination tier based on risk. Examiners may ask for a documented patch policy with severity-based timeframes for critical, high, and medium vulnerabilities. A policy that says patches will be applied “as soon as possible” without specific remediation windows will not satisfy an examiner who wants to see how you prioritize critical vulnerabilities versus lower-severity findings.

Email security controls are increasingly in scope. DMARC email authentication and sufficient audit logging are examples of controls examiners may assess when relevant to the credit union’s risks. Smaller institutions sometimes defer these protections. Audit logs need to cover access events, administrative changes, and security-relevant system activity for a period sufficient to support incident investigation.

Testing should be performed or reviewed by parties independent of those who build or run the network security program, as discussed in Appendix A guidance. Depending on risk, institutions may use internal or external penetration testing, authenticated vulnerability assessments, firewall testing, and web application testing. These are examples of possible examination evidence, not mandatory CORE or CORE+ testing schedules established by public NCUA materials. Examiners may ask for test reports, evidence that important findings were addressed under the credit union’s policy, and documentation of approved exceptions.

What a Prepared Credit Union Looks Like Going Into an Exam

Being ready for an NCUA cybersecurity examination comes down to documentation, validation, and board engagement. Controls with no paper trail are controls that didn’t happen from an examiner’s perspective. The NCUA examination framework gives examiners clear criteria across each area of the information security program, and the most common exam conversations involve gaps that were entirely predictable.

Before your next examination, your credit union should be able to produce:

●      A current, board-approved WISP with a recent update date that matches your current technology environment

●      A documented written annual IS report reviewed by the board covering the topics described in Part 748 Appendix A Section F guidance

●      A current cybersecurity risk assessment for your credit union that drives actual security decisions

●      Access review logs for critical systems showing the review frequency set by risk, management sign-off, and action taken

●      A vendor inventory with risk ratings, documented due diligence for each critical vendor, SOC 2 reports reviewed with exception assessments, and evidence of ongoing monitoring

●      Penetration test and vulnerability assessment reports where warranted by risk, with documented plans for findings

●      Tabletop exercise documentation, when conducted, showing scenario, participants, findings, and plan updates that followed

●      Phishing and vishing simulation results, when used, with evidence of follow-up for employees who failed

●      An incident log covering the entire examination period even if no reportable incidents occurred

●      Board minutes showing the credit union information security program was formally reviewed, the annual IS report was reviewed, and director cybersecurity training was conducted

The NCUA cybersecurity exam is partly a test of documentation discipline. A credit union with solid controls and weak documentation will have a harder conversation with examiners than one with good documentation and a few open items that are actively being addressed. Document everything, validate everything, and make sure the board’s involvement is visible in the record.

Frequently Asked Questions

Does 12 CFR Part 748 apply to state-chartered credit unions?

Yes. Federally insured state-chartered credit unions (FISCUs) reach Part 748 through a cross-reference in 12 CFR Part 741.214. The written information security program and 72-hour incident notification requirements apply to FISCUs as they do to federally chartered credit unions. Appendix B provides guidance on member notification.

What triggers the 72-hour notification clock under NCUA’s cyber incident rule?

The clock starts when the credit union “reasonably believes” a reportable cyber incident has occurred. For incidents caused by third parties, the clock runs from when the third party notifies the credit union, if that notification comes first. You don’t need to have completed an investigation. You need to have a reasonable belief that a reportable event occurred.

What types of incidents are not reportable under the 72-hour rule?

Blocked phishing attempts, failed access attempts, unsuccessful malware attacks, penetration tests conducted at the credit union’s request, and routine or planned outages are excluded. However, an unplanned widespread outage caused by a failed system upgrade would typically be reportable under Prong 2 of the rule’s three-prong definition.

What does NCUA examine under the Management component of CAMELS for cybersecurity?

The Management component is where cybersecurity findings primarily land. Examiners assess board governance of the information security program, management oversight of IT risks, staff expertise in managing technology operations, and the adequacy of internal controls. Weak board engagement, missing annual information security reports, and inadequate vendor oversight all negatively affect the Management rating.

What is the NCUA ISE program and how does it differ from the old ACET-based exam?

The Information Security Examination (ISE) program replaced the ACET-based examination framework as the standard exam approach starting in 2023. Where ACET relied on credit union self-reporting through hundreds of questions, the ISE is an examiner-driven assessment with SCUEP for credit unions with $50 million or less in assets, CORE above $50 million, and optional CORE+ examination elements used based on risk. ACET remains a voluntary self-assessment tool but is no longer the primary examination vehicle.

What is a Document of Resolution and how does it work?

A DOR is NCUA’s primary informal enforcement tool. It documents an agreement with credit union officials to address areas of unacceptable risk, names the responsible party, and sets a remediation timeline. DORs are tracked through NCUA’s examination system. Failure to resolve a DOR without justification escalates to formal enforcement action.

How often do credit unions need to run a cybersecurity risk assessment?

Part 748 doesn’t specify a mandatory frequency, but examiners expect the assessment to reflect current operations. Annual refresh is the practical standard, and any material change to technology, vendors, products, or the threat environment should trigger an update outside the annual cycle. Stale assessments not reflecting the current environment are one of the most frequently cited exam deficiencies.

Is MFA required for all users at all credit unions?

Part 748 doesn’t specify MFA by name, but the credit union should select access controls that address its assessed risks. Examiners may review MFA for remote access or core banking systems and ask how those controls protect member information. Remote access testing and conditional access checks may be included in risk-based examination work, but public NCUA material does not make them fixed CORE+ requirements.

What should a credit union’s vendor management program include to satisfy examiners?

A complete vendor management program covers pre-engagement due diligence, risk assessment for each vendor, contract review confirming breach notification and audit right provisions, ongoing monitoring beyond annual questionnaires, and documented review of SOC 2 Type II reports for critical vendors with assessment of any noted exceptions. Examiners look for evidence all of these elements are occurring and documented.

How does the ISE tier for small credit unions (SCUEP) differ from CORE?

SCUEP applies to credit unions with $50 million or less in assets, while CORE applies above $50 million. Depending on risk, SCUEP examinations may consider risk assessments, IT security audits, vulnerability testing, staff awareness, phishing or vishing exercises, and business-continuity tabletops. CORE examinations may also consider internal penetration tests, vulnerability management, and onsite social engineering. Specialists may use optional CORE+ elements such as authenticated scans, smishing, physical and wireless testing, remote access checks, firewall testing, and ransomware readiness assessments. These are examples of risk-based testing, not mandatory tier-by-tier checklists.

What resources does NCUA offer small credit unions for cybersecurity compliance?

NCUA offers the free ACET self-assessment tool (version 12.4.0.1), free online courses through the NCUA Cybersecurity Resource Center, and referrals to CISA’s free Cyber Hygiene Services for vulnerability scanning. NCUA also recommends membership in FS-ISAC and the NCU-ISAO for threat intelligence sharing.

What is MERIT and why does it matter for credit union examinations?

MERIT (Modern Examination and Risk Identification Tool) replaced NCUA’s legacy AIRES system in August 2021. It is the secure platform through which credit unions send documents to examiners, receive exam reports, and respond to findings. Getting your NCUA Connect administrator account set up before an examination begins is a practical step that avoids delays during the exam itself.

Can a credit union be formally penalized solely for a cybersecurity exam deficiency?

NCUA’s published enforcement record doesn’t confirm any formal enforcement action specifically tied to cybersecurity failures in 2020 through 2026. NCUA’s preference is to use the lowest level of action necessary. However, ignoring a Document of Resolution without justification can and does trigger escalation to formal enforcement action.

What does NCUA expect boards to do on cybersecurity?

Per NCUA Letter 24-CU-02, boards have 4 defined cybersecurity responsibilities: providing recurring director training, approving the credit union information security program, providing operational oversight including vendor due diligence and patch management, and ensuring effective incident response planning and resilience testing. Examiners will ask for documentation of each.

What incident types does NCUA see most frequently under the 72-hour reporting rule?

From September 1, 2023 through August 31, 2024, NCUA received 1,072 cyber incident reports, including 742 involving third parties, about 69%. Reported incident types also included ATM-related attacks, business email compromise and phishing, and ransomware.