Quick answer: Federally insured credit unions in the US must maintain a written information security program under NCUA rules, protect member information in line with the Gramm-Leach-Bliley Act, oversee third-party providers and report reportable cyber incidents to the NCUA within 72 hours. Many use the NCUA’s Automated Cybersecurity Evaluation Toolbox (ACET) to assess their maturity before examinations.
Credit unions hold sensitive financial data but often have small IT teams. Examiners expect a risk-based program that matches the institution’s size and complexity. This guide summarizes the key requirements and practical steps to meet them.
Key requirements at a glance
| Requirement | What it means |
|---|---|
| Information security program | Written, board-approved program with risk assessment, controls, training and testing |
| Member information protection | Safeguards for confidentiality and integrity of member data |
| Incident response program | Procedures to respond to unauthorized access to member information |
| Cyber incident notification | Report reportable incidents to the NCUA within 72 hours |
| Third-party oversight | Due diligence and monitoring of vendors and service providers |
The board of directors is responsible for overseeing the program. Examiners look for evidence that it is reviewed, tested and updated, not just written.
Practical steps for compliance
- Run an annual risk assessment covering systems, vendors and member data.
- Use the ACET or a framework such as the NIST CSF to measure maturity; a gap analysis shows where to focus.
- Enforce multifactor authentication for staff, administrators and remote access.
- Patch promptly and monitor for suspicious activity, using managed services if needed; see EDR vs MDR.
- Keep tested, offline backups to recover from ransomware.
- Review core processor and fintech contracts for security and notification clauses.
- Train staff and board members, including on phishing and social engineering.
- Test the incident response plan, including the 72-hour notification process.
Common examination findings
- Risk assessments that are outdated or too generic.
- Weak vendor management documentation.
- Incident response plans that have never been tested.
- Limited board reporting on cyber risk.
The NCUA publishes requirements and tools on its cybersecurity resources page. The FFIEC also provides guidance used across financial institutions. For wider context, see our compliance and frameworks guides and GRC in cyber security. Vendor contract terms are covered in our MSA guide.
Frequently asked questions
How quickly must a credit union report a cyber incident?
Within 72 hours of reasonably believing a reportable cyber incident has occurred, under the NCUA’s notification rule.
What is the ACET?
The Automated Cybersecurity Evaluation Toolbox is a free NCUA tool that helps credit unions assess their cyber security maturity.
Who is responsible for a credit union’s information security program?
The board of directors oversees it, while management and IT run it day to day.
Do small credit unions have the same requirements?
The requirements apply to all federally insured credit unions, but programs are expected to match each institution’s size and complexity.
Conclusion
Credit union cyber compliance is about a living, risk-based program. Assess risk each year, enforce core controls, manage vendors closely and rehearse incident reporting. Clear board reporting ties it all together and makes examinations smoother.
