Over 250 credit union professionals from 9 Leagues registered to participate in Monday’s virtual cyber security town hall hosted by the MD|DC Credit Union Association. Industry experts from the NCUA, TruStage, M3, and League InfoSight discussed emerging cyber threats and best practices for protection and response.

Key takeaways included:

1. Prioritize Cybersecurity from the Top:

• Secure C-suite buy-in to make cybersecurity a strategic priority across the organization.

2. Proactive Prevention:

• Conduct thorough third-party vendor reviews before onboarding them.
• Perform risk assessments, starting before hiring any vendor.
• Implement comprehensive due diligence processes and procedures.

3. Train and Evaluate:

• Continuously train employees on cybersecurity best practices.
• Regularly evaluate the effectiveness of your training programs.

4. Understand Your Business Impact:

• Conduct business impact analyses to identify and prioritize critical assets.
• Assess potential disruptions from various cyber threats.

5. Vendor Management:

• Engage in ongoing reviews of vendors to ensure compliance with contractual expectations such as service level agreement (SLA) terms and conditions.
• Obtain risk assessments and incident response plans from your vendors.
• Understand your exposure through your vendors’ third-party relationships.

6. Post-Breach Response:

• Immediately notify your insurance carrier upon experiencing a breach.
• Engage a forensics specialist to provide an in-depth review of what happened and how to cure the challenges.
• Focus on recovery and mitigation and getting operations restored, a review can be conducted later.

7. Key Resources:

• Leverage League Infosight’s resources and tools which provides notification requirements, business continuity templates, communication template, task checklists and threat assessments.

Additional insights:

• Ransomware remains a significant threat, with average payments exceeding $850,000 according to Coveware
• Prioritize operational recovery and service continuity during incident response.

Thanks to the presenters:

• John Kutchey, NCUA, Eastern Region Director
• Chris Gill, TruStage, Senior Manager, Risk and Compliance Solutions
• Derek Laczniak, M3, Director Cyber Liability & Alex Friedl, M3, Brokerage & Cyber Liability Account Manager

• Amy Wargo, League Infosight, Director of Risk Management

Thanks to the following Leagues for participating:

• The Credit Union League of Connecticut
• CrossState Credit Union Association
• Cooperative Credit Union Association
• Michigan Credit Union League & Affiliates
• Maine Credit Union League
• Association of Vermont Credit Unions
• Virginia Credit Union League
• West Virginia Credit Union League