Credit Union Security Risk Management: A Practical Guide

Ask your information security officer to name the credit union's top five risks and the controls for each. If they can't do it in under five minutes, you have a gap an examiner will find.

Closing that gap doesn't take a bigger binder of policies. It takes a framework that ties every control to a specific threat. This guide walks CEOs, CISOs, and security officers through building a program that satisfies both examiners and your board, from governance and risk assessment to vendors and incident response.

Adopt a Risk-Based Framework

A security risk framework is the process you use to identify threats, assess their likelihood and impact, put controls in place, and confirm those controls work. It is an operating system for your program.

Credit unions face the same attackers as large banks, with smaller teams. The NCUA's 2025 Cybersecurity and Credit Union System Resilience Report noted that credit union transaction activity exceeded $86 trillion in 2024, which makes the industry an attractive target. Between September 2023 and August 2024, federally insured credit unions reported 1,072 cyber incidents. Nearly seven in ten involved a third-party vendor.

Without a framework, security decisions are reactive. With one, you can proactively identify risks, prioritize spending where it matters, and show examiners your program is deliberate. If your program is just a comparison of your controls to a standard, it likely isn’t risk-based.

That doesn’t mean ignoring standards. It means using one as structure while your risk assessment sets priorities. We recommend the NIST Cybersecurity Framework (CSF) for that structure. The FFIEC’s Cybersecurity Assessment Tool (CAT) was built on it and has since been sunset, and the NCUA’s ACET maps to it, so it makes sense to build directly on the source. CSF 2.0 organizes a program into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

CSF is not a checklist of controls. It describes outcomes, such as ensuring only authorized users can access member data, and leaves it to you to choose the controls that achieve them. Used that way, a CSF assessment becomes a tool for identifying the right controls for your credit union rather than a list to check off. The framework is broad, so tailor it to the outcomes tied to your highest risks, and document why you scoped things the way you did.

What Examiners Look For

The NCUA's Information Security Examination (ISE) procedures focus on four objectives:

• Can management recognize, assess, monitor, and manage technology risks?
• Does the credit union have the expertise to run its technology operations?
• Is the board providing adequate oversight and governance of information security?
• Are internal controls enough to protect member information?

Examiners don’t grade you against a self-assessment tool. The NCUA offers ACET, a free, voluntary tool that rates control maturity against NIST CSF, and it can be a useful gap check. But a maturity score shows how your controls compare to a standard, not whether they address your actual risks. Examiners are looking for a continuous, risk-based program: current risk assessments, policies that match real practice, and staff who know their roles. Preparing the week before won’t work.

Governance and Board Reporting

The NCUA's Letter 24-CU-02 tells boards to treat cybersecurity as a top oversight priority. Examiners want to see strategic engagement, not an annual signature.

Your board should:

• Approve the security program and budget
• Review risk assessment and control testing results
• Receive incident reports and trends
• Confirm third-party risk management meets expectations
• Complete recurring cybersecurity training so directors can ask informed questions

Part 748 calls for at least an annual report to the board on the overall status of the information security program. It should cover risk assessment, risk management and control decisions, service provider arrangements, testing results, security incidents and management’s response, and recommended changes to the program.

Good reports connect each threat to its controls, state residual risk honestly, flag where limited resources weaken a control, and recommend actions with timelines. A report full of green indicators that never says what "green" means doesn't help anyone.

Ownership matters too. FFIEC guidance calls for the information security officer to be independent of IT operations and not to report to IT management. When the same person builds controls and judges whether they work, examiners are likely to flag it. A virtual CISO (vCISO) is one way smaller credit unions get that independence without a full-time executive hire, but only if the vCISO is truly separate from the people running your technology. If your vCISO works for your managed service provider, they are likely not independent. They would be evaluating controls their own firm designed, implemented, and maintains, and reporting gaps that their employer is responsible for fixing. Even with the best intentions, that’s the same conflict the guidance is meant to prevent.

Risk Assessment and Controls

A real risk assessment follows a sequence: identify the systems and information you need to protect, identify the threats to them, rate likelihood and impact, document existing controls, and determine residual risk. Two common mistakes undermine it:

• Too high-level. Results are too vague to act on, often because the assessment never pinned down which systems and data were in scope.
• Overstated controls. Controls can bring a high inherent risk down to low, but only if they’re operating effectively. If your assessment claims a large reduction, you should be able to point to testing that proves the controls work as designed. Without that evidence, the residual rating is an assumption, not a finding.

You can’t do everything at once. Let your risk assessment set the order, but for most credit unions that means starting with access controls and authentication, then monitoring and detection, then advanced capabilities. Make each layer repeatable and tested before building the next.

Third-Party Risk

Outsourcing a service does not outsource the risk. With nearly 70% of reported incidents involving vendors, this is a primary governance responsibility.

For any critical vendor, do two assessments:

• The vendor’s threats and controls, using SOC 2 Type II reports and independent audits
• Your own use of the service, meaning the risks created by how your credit union configures and relies on it. The complementary user entity controls listed in the vendor’s SOC 2 report are a good starting point. An even better approach is to also ensure the product the third party provides is part of the organization’s risk assessment.

In our experience, most institutions do only the first. Beyond that:

• Tier vendors by the data they access and how critical the service is.
• Match due diligence to the tier and document your reasoning.
• Include incident notification and data protection terms in contracts. If a vendor’s incident compromises your data or disrupts your operations, you have 72 hours from their notice to report it to the NCUA, but every hour they wait is an hour you can’t spend protecting members. Contracts should require prompt notification.
• Monitor vendors after signing, not just before.

Vendor programs tend to fail in one of two ways: so complicated nobody can explain the goal, or so neglected they never get done. Keep yours simple and repeatable.

Incident Response

A plan that has never been practiced is just a document. Yours should cover:

• How incidents are identified, classified, and scoped, including which systems and member information are affected
• Containment and eradication steps
• Who decides whether an incident is reportable, and who communicates with staff, the board, members, regulators, and law enforcement
• When members must be notified, and when a Suspicious Activity Report is required
• Recovery procedures with defined recovery time and maximum downtime targets

The NCUA’s cyber incident notification rule requires reporting substantial incidents no later than 72 hours after you reasonably believe one occurred, or after a vendor notifies you of one. The initial report is an early alert, not a full assessment, so don’t delay it while you investigate. Your team needs to know that deadline exists and who makes the call.

Run tabletop exercises regularly. They expose gaps before a real incident does, and the NCUA recommends them as part of board-level resilience planning. Test your recovery procedures too, so you know you can actually hit your targets.

Next Steps

Start with an honest comparison of your current program against the components above. Find the gaps, then fix them in order of risk, not ease.

If you need independent security leadership to build or evaluate your framework, Bedel Security's vCISO services are designed for credit unions. Contact us at sales@bedelsecurity.com or visit our CISO Assessment page.