For credit unions
Evidence that your board is overseeing what Part 748 asks of it.
Part 748 places the board at the center of information security, BSA/AML and incident response. We show your board, your supervisory committee and your examiner what the record supports, and where it falls short.
Arrange a conversationWhat NCUA expects of your board
Each of these is tested against your board packets, minutes and policies, with the finding cited to its page.
Citations summarised for orientation; dated and re-verified before launch.
12 CFR 748, Appendix A
The information security program
The board approves the written program, oversees it, and receives a report on its status at least once a year.
12 CFR 748.2
The BSA/AML program
Written, approved by the board and reflected in the minutes.
12 CFR 748.1(c)
Cyber incident notification
Reportable incidents go to NCUA within 72 hours, and the board should hear about them promptly from management.
NCUA guidance
AI and third parties
Due diligence on AI and service providers, overseen by the board. We also show where recognized practice for banks would set a higher bar.
In your words
A readout written for a credit union board
Members, not customers. The supervisory committee, not an audit committee. Peers are credit unions of a similar size, from NCUA call report data.
- 1What the board should receive, and how much arrived complete
- 2Reports that never reached the board
Free download
The Board Cyber Scorecard and Schedule
The cyber reporting a credit union board should receive, and how often. Use it to check your own board packets before your next meeting.