Credit unions and banks are held to almost the same information security standard. For federally insured credit unions it is NCUA's Part 748. For banks it is the safeguarding standards set out by their federal regulator, most often the OCC or the FDIC, in its own part of the rules. The duties they give the board are close to word for word.
One difference is worth knowing. The bank guidelines say the board "shall" approve the program and receive the annual report. NCUA's appendix says "should". In practice examiners expect both.
| Duty | Credit unions | Banks |
|---|---|---|
| Approve the written information security program (board or a board committee) | Part 748 App. A, III.A.1 ("should") | OCC and FDIC Guidelines III.A ("shall") |
| Oversee the program: assign responsibility, review management's reports | App. A, III.A.2 | III.A |
| Receive a report at least once a year | App. A, III.F | III.F ("shall") |
| Oversee service providers: due diligence, contracts, monitoring | App. A, III.D | III.D |
| Adjust the program as technology, threats and the business change | App. A, III.E | III.E |
| Have a response program, and notify members or customers when information is misused | Part 748 App. B | Supplement A |
| Notify the regulator of a significant cyber incident | 748.1(c): within 72 hours | Within 36 hours (12 CFR 53, 225.300-303, 304.21-24) |
What the annual report to the board should cover
Both texts list the same contents. The report should describe the overall status of the program and whether the institution complies with the guidelines, and discuss material matters, such as:
- the risk assessment;
- risk management and control decisions, including any risks management has chosen to accept;
- service provider arrangements;
- results of testing;
- security breaches or violations, and management's responses;
- recommendations for changes to the program.
Where the rules sit
- Credit unions: 12 CFR Part 748, Appendix A (safeguarding member information) and Appendix B (response programs and member notice).
- National banks and federal savings associations: 12 CFR Part 30, Appendix B (OCC).
- State member banks: 12 CFR Part 208, Appendix D-2 (Federal Reserve).
- State nonmember banks: 12 CFR Part 364, Appendix B (FDIC).
Why it matters to directors personally
Regulators can act against individual directors, not only institutions. For banks, 12 U.S.C. 1818(e) and (i) allow removal from banking and civil money penalties; for credit unions, 12 U.S.C. 1786(g) and (k) do the same. A record showing that the board approved the program, received its reports and asked questions is the board's best evidence that it did its job.
What examiners read
The FFIEC Information Security booklet repeats the same expectation: the board approves and oversees the program and reviews a report on its overall status at least annually. The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions to resources such as the NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals. It said these are not examination programs. NCUA's ACET remains available to credit unions.
BoardAlign reads your board packets and minutes against these duties for your charter, and shows the board where the record meets them and where it does not.
Sources
- 12 CFR Part 748, Appendix A
- 12 CFR Part 748, Appendix B
- 12 CFR Part 30, Appendix B (OCC)
- 12 CFR Part 208, Appendix D-2 (Federal Reserve)
- 12 CFR Part 364, Appendix B (FDIC)
- FFIEC, sunset of the Cybersecurity Assessment Tool (2024)
- 12 U.S.C. 1818
- 12 U.S.C. 1786
General information for directors, not legal advice. Current as of October 13, 2026. Rules change: check the cited source before relying on it.