Resources
Resources for directors
Short, practical material for board members of credit unions and banks, each with its sources. Leave a work email for the scorecard and it downloads straight away; the guides are open to everyone, with a PDF of each.
Free download
The Board Cyber Scorecard and Schedule
What a board should receive on cyber, and how often: annual, semi-annual, quarterly and immediate. Use it to check your own board packets before your next meeting. By Mark Blazek.
All resources
Download
The Board Cyber Scorecard and Schedule
What a board should receive on cyber, and how often: annual, semi-annual, quarterly and immediate. By Mark Blazek.
Get the scorecard
Guide
Questions every director should be able to answer
Twelve questions from our director questionnaire, one set for each part of cyber oversight, with what a well-supported answer looks like.
Read the guide
Explainer
Part 748, the OCC and the FDIC: what the board must see
The board's information security duties for credit unions and banks, side by side, with the citations.
Read the explainer
Guide
What a good cyber report to the board looks like
One page the board can read in a meeting: what it should contain, how often it should arrive, and the signs it is not doing its job.
Read the guide
Guide
Reading a penetration test as a director
What a penetration test is, what to look for in the summary the board receives, and five questions that make it useful.
Read the guide
Guide
Your cyber insurance application is a promise
What you tell your insurer is in place should match your policies and what the board is told. When it does not, coverage can be at risk.
Read the guide
Explainer
Incident notification: 72 hours, 36 hours, and what the board should hear when
The regulator notification rules for credit unions and banks, and how to make sure the board is told in time to do its part.
Read the explainer
Guide
AI oversight for boards: what to ask now
There are few AI-specific rules for credit unions and community banks. That makes the board's questions more important, not less.
Read the guide
Guide
Fraud and BSA/AML: what the board should receive, and how the reports should agree
The board's duties for the BSA program and suspicious activity reports, and why fraud, BSA/AML and cyber figures should tell the same story.
Read the guide