--- title: NCUA 2019 Supervisory Priorities – ACET and IT Risk Management - SCA Security description: The first NCUA letter to credit unions of the new year, 19-CU-01, offers Supervisory Priorities for upcoming exams, including ACET and IT Risk Management. Among the focus items are enhanced Bank Secrecy Act Compliance and Information Systems and Assurance. As anticipated, Examiners will continue their information security maturity assessments using the Automated Cybersecurity Examination Toolbox, image: https://blog.scasecurity.com/hubfs/Imported_Blog_Media/it-risk-management.jpg --- [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) [![sca-logo-r](https://blog.scasecurity.com/hs-fs/hubfs/sca-logo-r.png?length=190&name=sca-logo-r.png)](https://scasecurity.com/) ☰ - [Home](https://scasecurity.com/) - [Security](https://scasecurity.com/security/) - [Email Phishing & Employee Training](https://scasecurity.com/anti-phishing-training-with-phished-io/) - [Vulnerability Assessments](https://scasecurity.com/security/vulnerability-assessments/) - [Penetration Testing](https://scasecurity.com/security/penetration-testing/) - [Applications](https://scasecurity.com/security/applications/) - [Controls](https://scasecurity.com/security/controls/) - [Centurion ESO](https://scasecurity.com/executive-security-officer/) - [Consulting](https://scasecurity.com/security/consulting/) - [Risk & Compliance](https://scasecurity.com/compliance/) - [CMMC](https://scasecurity.com/cybersecurity-maturity-model-certification/) - [HITRUST](https://scasecurity.com/hitrust/) - [Federal](https://scasecurity.com/compliance/federal/) - [State](https://scasecurity.com/compliance/state/) - [Industry](https://scasecurity.com/compliance/industry/) - [Cybersecurity Risk Assessment](https://scasecurity.com/security/risk-assessment/) - [NIST Cybersecurity Framework Assessment](https://scasecurity.com/compliance/nist-framework/) - [AI Risk Management Services](https://scasecurity.com/ai-risk-management-services/) - [Governance](https://scasecurity.com/compliance/governance/) - [Industries](https://scasecurity.com/industries/) - [Financial Services](https://scasecurity.com/industries/financial-services/) - [Healthcare](https://scasecurity.com/industries/healthcare/) - [Government/Public Sector](https://scasecurity.com/industries/government-public-sector/) - [Title/Real Estate](https://scasecurity.com/industries/title-real-estate/) - [Technology](https://scasecurity.com/industries/technology/) - [Manufacturing](https://scasecurity.com/industries/manufacturing/) - [Professional Services](https://scasecurity.com/industries/professional-services/) - [Automotive](https://scasecurity.com/automotive/) - [Higher Education](https://scasecurity.com/higher-education/) - News & Resources - [Blog](https://blog.scasecurity.com) - [Events](https://scasecurity.com/event/) - [Case Studies](https://scasecurity.com/case-studies/) - [Recorded Webinars](https://scasecurity.com/recorded-webinars/) - [SCA Breach Notification Guide](https://scasecurity.com/breach-notification-guide/) - [HIPAA Security Audit Checklist](https://info.scasecurity.com/hipaa-audit-checklist) - [Cybersecurity Checklist for Insurance Providers](https://info.scasecurity.com/cybersecurity-checklist-for-insurance-providers) - Company - [About Us](https://scasecurity.com/about-us/) - [Leadership](https://scasecurity.com/leadership/) - [Affiliates](https://scasecurity.com/affiliates/) - [Career Opportunities](https://scasecurity.com/career-opportunities/) - [Testimonials](https://scasecurity.com/testimonials/) - [Contact Us](https://scasecurity.com/contact-us/) #### Menu Home Security › Email Phishing & Employee Training Vulnerability Assessments Penetration Testing Applications Controls Centurion ESO Consulting Risk & Compliance › CMMC HITRUST Federal State Industry Cybersecurity Risk Assessment NIST Cybersecurity Framework Assessment AI Risk Management Services Governance Industries › Financial Services Healthcare Government/Public Sector Title/Real Estate Technology Manufacturing Professional Services Automotive Higher Education News & Resources › Blog Events Case Studies Recorded Webinars SCA Breach Notification Guide HIPAA Security Audit Checklist Cybersecurity Checklist for Insurance Providers Company › About Us Leadership Affiliates Career Opportunities Testimonials Contact Us [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) January 31, 2019 # NCUA 2019 Supervisory Priorities – ACET and IT Risk Management By: SCA Editor ![](https://blog.scasecurity.com/hubfs/Imported_Blog_Media/it-risk-management.jpg) The first NCUA letter to credit unions of the new year, 19-CU-01, offers Supervisory Priorities for upcoming exams, including ACET and IT Risk Management. Among the focus items are enhanced Bank Secrecy Act Compliance and Information Systems and Assurance. As anticipated, Examiners will continue their information security maturity assessments using the Automated Cybersecurity Examination Toolbox, (ACET), and the exams now include assessment of credit unions over $250 million in assets that were previously not exposed to the tool or exam process. ### NCUA 2019 Areas of Focus Two areas of focus are evaluating credit union IT Risk Management and how it can identify, remediate and control inherent risks to appropriate residual risk levels and 3rd party/vendor oversight to ensure implementation of an effective risk-based vendor management program. Although the ACET was deemed “voluntary” in the past, it is important to know that NCUA Examiners utilize the ACET output for a consistent and uniform measuring system, regardless of asset size. Ideally, the NCUA would like the credit union to populate the ACET criteria, creating greater internal awareness of the ACET, exam protocol and a deeper understanding of prudent cybersecurity practices. With the roll-out to smaller asset sized credit unions, resources may be stretched to fulfill the data input requirements, (along with the validation of the input). A great place to start is to assign a champion(s) with the task of filling out what is known and then work as a team to complete any remaining items. Validation of your responses are a necessity. ### Meet Baseline Requirements for Security Compliance and IT Risk Management During your annual information security endeavors, work with your provider to assist you with advice on how best to meet minimum or baseline requirements or evolving to more mature levels. SCA Information [Security](https://scasecurity.com/security/) Analysts are experts at working with credit unions to streamline their information security requirements and are a valuable resource for ACET tool assistance. ### Contact Security Compliance Associates Today For More ACET and IT Risk Management Information Contact SCA today to learn more about NCUA 2019 information [security](https://scasecurity.com/security/) examination priorities. Our team has helped credit unions with information security [compliance](https://scasecurity.com/compliance/) and risk assessment for more than 14 years! #### Subscribe Email\* Notification Frequency [Blog](https://blog.scasecurity.com/tag/blog) [February 07, 2025 Preparing for 2025 HIPAA Changes: What Healthcare Organizations Need to Know](https://blog.scasecurity.com/preparing-for-2025-hipaa-changes-what-healthcare-organizations-need-to-know) [October 23, 2024 What is a Vulnerability Assessment (and Why You Need One)](https://blog.scasecurity.com/blog/what-is-a-vulnerability-assessment) [October 10, 2024 Understanding the Risks and Mitigation of Phishing Attacks](https://blog.scasecurity.com/understanding-the-risks-and-mitigation-of-phishing-attacks) ### Comments © 2026 - All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "SCA Editor", "url" : "https://blog.scasecurity.com/author/sca-editor" }, "dateModified" : "2025-04-10T15:54:46.426Z", "datePublished" : "2019-01-31T05:00:00.000Z", "headline" : "NCUA 2019 Supervisory Priorities – ACET and IT Risk Management - SCA Security", "image" : [ "https://blog.scasecurity.com/hubfs/Imported_Blog_Media/it-risk-management.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.scasecurity.com/ncua-2019-priorities-it-risk-management", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.scasecurity.com/hubfs/sca-logo-r.png" }, "name" : "Security Compliance Associates" } } ```