--- title: NCUA Examiner Insight for 2017 - SCA Security description: The 12th annual CUISPA (Credit Union Information Security Professionals Association) conference was held on February 21 & 22 in San Antonio. SCA routinely participates in this conference to network with credit union information technology and risk management professionals, and just as importantly, to engage NCUA examiners about items on their priority list... --- [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) [![sca-logo-r](https://blog.scasecurity.com/hs-fs/hubfs/sca-logo-r.png?length=190&name=sca-logo-r.png)](https://scasecurity.com/) ☰ - [Home](https://scasecurity.com/) - [Security](https://scasecurity.com/security/) - [Email Phishing & Employee Training](https://scasecurity.com/anti-phishing-training-with-phished-io/) - [Vulnerability Assessments](https://scasecurity.com/security/vulnerability-assessments/) - [Penetration Testing](https://scasecurity.com/security/penetration-testing/) - [Applications](https://scasecurity.com/security/applications/) - [Controls](https://scasecurity.com/security/controls/) - [Centurion ESO](https://scasecurity.com/executive-security-officer/) - [Consulting](https://scasecurity.com/security/consulting/) - [Risk & Compliance](https://scasecurity.com/compliance/) - [CMMC](https://scasecurity.com/cybersecurity-maturity-model-certification/) - [HITRUST](https://scasecurity.com/hitrust/) - [Federal](https://scasecurity.com/compliance/federal/) - [State](https://scasecurity.com/compliance/state/) - [Industry](https://scasecurity.com/compliance/industry/) - [Cybersecurity Risk Assessment](https://scasecurity.com/security/risk-assessment/) - [NIST Cybersecurity Framework Assessment](https://scasecurity.com/compliance/nist-framework/) - [AI Risk Management Services](https://scasecurity.com/ai-risk-management-services/) - [Governance](https://scasecurity.com/compliance/governance/) - [Industries](https://scasecurity.com/industries/) - [Financial Services](https://scasecurity.com/industries/financial-services/) - [Healthcare](https://scasecurity.com/industries/healthcare/) - [Government/Public Sector](https://scasecurity.com/industries/government-public-sector/) - [Title/Real Estate](https://scasecurity.com/industries/title-real-estate/) - [Technology](https://scasecurity.com/industries/technology/) - [Manufacturing](https://scasecurity.com/industries/manufacturing/) - [Professional Services](https://scasecurity.com/industries/professional-services/) - [Automotive](https://scasecurity.com/automotive/) - [Higher Education](https://scasecurity.com/higher-education/) - News & Resources - [Blog](https://blog.scasecurity.com) - [Events](https://scasecurity.com/event/) - [Case Studies](https://scasecurity.com/case-studies/) - [Recorded Webinars](https://scasecurity.com/recorded-webinars/) - [SCA Breach Notification Guide](https://scasecurity.com/breach-notification-guide/) - [HIPAA Security Audit Checklist](https://info.scasecurity.com/hipaa-audit-checklist) - [Cybersecurity Checklist for Insurance Providers](https://info.scasecurity.com/cybersecurity-checklist-for-insurance-providers) - Company - [About Us](https://scasecurity.com/about-us/) - [Leadership](https://scasecurity.com/leadership/) - [Affiliates](https://scasecurity.com/affiliates/) - [Career Opportunities](https://scasecurity.com/career-opportunities/) - [Testimonials](https://scasecurity.com/testimonials/) - [Contact Us](https://scasecurity.com/contact-us/) #### Menu Home Security › Email Phishing & Employee Training Vulnerability Assessments Penetration Testing Applications Controls Centurion ESO Consulting Risk & Compliance › CMMC HITRUST Federal State Industry Cybersecurity Risk Assessment NIST Cybersecurity Framework Assessment AI Risk Management Services Governance Industries › Financial Services Healthcare Government/Public Sector Title/Real Estate Technology Manufacturing Professional Services Automotive Higher Education News & Resources › Blog Events Case Studies Recorded Webinars SCA Breach Notification Guide HIPAA Security Audit Checklist Cybersecurity Checklist for Insurance Providers Company › About Us Leadership Affiliates Career Opportunities Testimonials Contact Us [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) March 01, 2017 # NCUA Examiner Insight for 2017 By: SCA Editor The 12th annual CUISPA (Credit Union Information Security Professionals Association) conference was held on February 21 & 22 in San Antonio. SCA routinely participates in this conference to network with credit union information technology and risk management professionals, and just as importantly, to engage NCUA examiners about items on their priority list. This year’s panel of 6 examiners included leadership from the ONES (Office of National Examinations and Supervision) and several RISOs (Regional Information Systems Officer). Following is what was shared during their panel discussion: An information security program is based on, starts with, policy, standards & procedures and employee use guidelines. Two Areas of Focus for Better Exam Results: 1. Annual Risk Assessments are expected. The Risk assessment should identify the actual threats specific to the CU and not generic threats, vulnerabilities associated with the threats and a risk rating showing likelihood of occurrence, impact rating, controls to mitigate and the resulting risk rating. Threats and vulnerabilities should also be correlated with an asset inventory ranked by criticality. 2. Control tests. FFIEC Cybersecurity Assessment Tool (CAT): The CAT is not a risk assessment. It is a tool to complement a credit union’s information security program. Use of the CAT is voluntary, however, some state programs require the CAT. If a credit union gets Domain 1 right, the rest will fall into place. Domain 1, Cyber Risk Management and Oversight, includes policies and risk assessments. The NCUA will roll out the CAT in their exam process in late Q3 or early Q4 of 2017. Until then, they are finalizing the tool which they will actually use, and honoring their commitment to a tight process and well trained examiners before roll out. It was recommended that social engineering email phishing test frequency is quarterly or at a frequency deemed commensurate for credit union size, complexity and culture. Email phishing tests should include a retest when there is a high failure rate. This provides an opportunity to educate and re-evaluate those employees. Two other areas examiners are paying attention to are Reg 749 and legacy software. NCUA Reg 749 addresses a credit union’s Records Preservation Program including Record Retention Guidelines and Catastrophic Act Preparedness Guidelines. A thorough Disaster Recovery and Business Continuity Plan including a Business Impact Analysis as well as a thorough Incident Response plan are vital to satisfying Reg 749. Credit unions should regularly test these plans to ensure they are effective and align with the credit union over time. Legacy software such as Windows XP or Server 2003 are no longer supported (i.e. patched) and present easy targets for hackers. Examiners strongly encourage updating to modern versions such as Windows 10 and Server 2012 R2. \[/vc\_column\_text\]\[/vc\_column\]\[/vc\_row\]\[/vc\_section\]     #### Subscribe Email\* Notification Frequency [Blog](https://blog.scasecurity.com/tag/blog) [February 07, 2025 Preparing for 2025 HIPAA Changes: What Healthcare Organizations Need to Know](https://blog.scasecurity.com/preparing-for-2025-hipaa-changes-what-healthcare-organizations-need-to-know) [October 23, 2024 What is a Vulnerability Assessment (and Why You Need One)](https://blog.scasecurity.com/blog/what-is-a-vulnerability-assessment) [October 10, 2024 Understanding the Risks and Mitigation of Phishing Attacks](https://blog.scasecurity.com/understanding-the-risks-and-mitigation-of-phishing-attacks) ### Comments © 2026 - All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "SCA Editor", "url" : "https://blog.scasecurity.com/author/sca-editor" }, "dateModified" : "2025-04-10T15:44:05.565Z", "datePublished" : "2017-03-01T05:00:00.000Z", "headline" : "NCUA Examiner Insight for 2017 - SCA Security", "mainEntityOfPage" : { "@id" : "https://blog.scasecurity.com/ncua-examiner-insight-for-2017", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.scasecurity.com/hubfs/sca-logo-r.png" }, "name" : "Security Compliance Associates" } } ```