In a recently released letter to credit unions, the NCUA says the frequency, speed, and sophistication of cyberattacks are growing exponentially, targeting critical infrastructure sectors, including credit unions. The agency reports that from September 1, 2023, through August 31, 2024, federally insured credit unions reported 1,072 cyber incidents, with 70% involving third-party vendors. One notable attack, caused by “malvertising,” highlights the dangers of malicious digital ads that infect systems without user clicks.

The NCUA is urging credit union boards to prioritize cybersecurity as an essential governance responsibility, and recommends they focus on four key areas:

Provide for Recurring Training:

Credit union board needs to stay aware of the specific cyber risks that pertain to your credit union’s operations and the implications of these risks. Board members don’t need to be technical experts, but they must know enough about cybersecurity to provide effective oversight and direction for the executive team and subject matter experts.

Approve Information Security Program

Boards must approve a comprehensive information security program that meets the requirements of Part 748 of the NCUA’s regulations, which includes risk assessments, security controls, and incident response plans. Your credit union board should review the program at least annually to ensure it adapts to the evolving threat landscape and incorporates lessons learned from past incidents.

Oversee Operational Management

Boards are responsible for overseeing the management of the following cybersecurity areas: ensuring third-party due diligence, vulnerability management, cyber threat intelligence, maintaining robust cybersecurity reporting and budgets. Regular audits and effective reporting frameworks are critical to assess cybersecurity effectiveness.

Boards must also implement strong backup strategies, regularly testing systems and ensuring staff readiness for data restoration in case of ransomware or data loss. Educating members on sound cybersecurity practices, such as multi-factor authentication, is also essential.

Incident Response Planning and Resilience

Credit unions must report cyber incidents to the NCUA within 72 hours, and boards should establish clear communication plans with internal and external stakeholders. Regular tabletop exercises help test and improve incident response capabilities. Ensuring adequate cyber insurance coverage is another key consideration for boards.

Read the Letter to Credit Unions