Managed IT and Cybersecurity for Columbus Credit Unions

Our core processor got breached. Is that ours to report?

Yes. When a core processor, CUSO, cloud host or other vendor is compromised and it disrupts your operations or exposes sensitive data, NCUA counts it as your reportable cyber incident. The report is yours to file, as soon as possible and no later than 72 hours after you reasonably believe it happened, or within 72 hours of the vendor telling you, whichever is sooner.

The notices that follow stay with you too. Telling members and regulators is the credit union’s job, even when the breach is on the vendor’s systems. You can contract with the vendor to send the notices for you.

That is why vendor contracts should require the vendor to tell you about any incident as soon as possible. Every clock runs from what you know, and nobody can report an incident they were never told about.

Something went wrong. Who do we have to tell, and how fast?

One incident can owe four separate notices. Treating it all as "72 hours to tell NCUA" is the most common mistake.

• NCUA, within 72 hours. The cyber incident report is due as soon as possible and no later than 72 hours after you reasonably believe a reportable incident happened. You do not need confirmation first. File at cyberreports.ncua.gov, by phone at 1.833.CYBERCU, or by email to cybercu@ncua.gov.
• Your NCUA Regional Director, as soon as possible. NCUA guidance says your response program should cover notifying the Regional Director, and for an Ohio charter the Division of Financial Institutions, once you learn of unauthorized access to sensitive member information. It sets no 72-hour limit.
• The Regional Director again, within 5 business days, if it is a catastrophic act. Ransomware that keeps core processing down into a third business day counts.
• FinCEN, within 30 calendar days, if the activity calls for a Suspicious Activity Report, or 60 days if you need the extra time to identify a suspect.

Members get notice too. NCUA guidance says to investigate first, then tell affected members as soon as possible once misuse of their sensitive information has happened or is reasonably possible. A written request from law enforcement is the only reason it gives for waiting.

Meeting these clocks starts well before an incident. You need to know what counts as reportable, have tools that would surface an incident, and have someone named to make the call and file. That is what our virtual CISO and Managed IT work sets up ahead of time.

Our vendors connect into our network. How do we watch systems we don’t run?

You will not install an agent on the core or read its logs. What you control is your side of every connection, and that side is bigger than most credit unions have mapped:

• The site-to-site tunnel to the core.
• The CUSO’s remote access.
• The link to item processing.
• The ATM or ITM vendor’s connection.
• Whatever remote support tool an integrator installed during a conversion weekend.

Write that list down first, because it is almost always longer than the answer people give from memory. Then narrow each path to what the service needs: a named rule per vendor, scoped to the hosts and ports in use, with logging turned on. The usual failure is a tunnel opened wide for a go-live and left that way for four years.

Accounts are the other half. An integrator’s domain account, a guest account for a support engineer who worked one project, a service account nobody has signed into since the conversion. None came through HR, so none leave through offboarding. Review them on a schedule:

1. List every account that does not belong to an employee.
2. Name the person who owns each one.
3. Confirm it still needs to exist.
4. Confirm multifactor authentication applies to it.
5. Remove what is dead.
6. Record the date you did it.

Managed firewall protection and Network Operations Center work cover the equipment those paths land on. Virtual CISO and Compliance-as-a-Service work keeps the evidence, so the answer you give at your cyber insurance renewal and the answer you give an examiner come out of the same file.

What does NCUA expect in our written security program?

A written program that covers protecting member records, responding to a breach, and identifying threats. Your board or a board committee approves it and assigns who is responsible. At least once a year, the board should hear how it is going: program status, risk decisions, vendor arrangements, test results and any breaches.

Under it sits a risk assessment you keep current, because it sets how often you test. NCUA lists eight measures to consider: access controls, physical restrictions, encryption, change control, dual controls and background checks, intrusion monitoring, incident response, and protection against environmental hazards. Considering each one is mandatory even where adopting it is not, so write down why you declined any of them. Which ones you adopted, which you declined, and why is the question an examiner asks first.

Testing should be done or reviewed by someone independent of the people who build and run the program. If we build your program or run your network, that testing should come from an independent third party or from staff independent of us.

For a starting point, our $349 Security Analysis shows where your technical controls stand today, including credentials, endpoints, Microsoft 365 and the firewall, mapped to 38 compliance frameworks. It is a snapshot, not the ongoing testing, and it cannot tell you why your board adopted or declined a measure. That reasoning has to come from you.

Which rules apply to us?

Share insurance decides it, not your charter. If NCUA insures your shares, Part 748 applies whether your charter is federal or Ohio. That means a written security program and an annual certification of compliance, made personally by the president or managing official through NCUA’s Credit Union Profile system. A compliance vendor cannot sign it for you.

If your shares are privately insured, Part 748 does not reach you. Your Gramm-Leach-Bliley duties run to the FTC instead, under its Safeguards Rule and 30-day breach notice. Ohio’s breach law also applies in full: notice to affected Ohio residents within 45 days, plus the nationwide consumer reporting agencies when more than 1,000 Ohio residents are affected.

An Ohio charter adds the Division of Financial Institutions, which can inspect your books and records at any time. After an exam, your directors must meet within 30 days of receiving the report to consider it, and the president tells the Superintendent what action was taken.

Ohio’s cybersecurity safe harbor reaches credit unions as well. A program that reasonably conforms to the Gramm-Leach-Bliley security requirements is one way to qualify, which is one more reason to be able to prove your program exists. Our virtual CISO engagements start by working out which of these rules reaches you.