The bar for
cybersecurity governance isn't set by your asset size — It's set by the threat
landscape.
The Sunday
after Thanksgiving is not when most people are thinking about cybersecurity.
Families are still together. Offices are quiet. Guards are down.
That's exactly
when it happened.
On November 26,
2023, a ransomware attack hit Ongoing Operations, a cloud services and business
continuity provider owned by Trellance — a technology firm serving credit
unions across the country. By the time the holiday weekend was over,
approximately 60 credit unions were experiencing outages, confirmed by the
National Credit Union Administration (NCUA).
No credit union
was directly breached. They didn't have to be. When a vendor you depend on for
critical operations gets hit, the disruption flows downstream — fast. Online
banking. Data processing. Member services. All of it vulnerable because of a
single point of failure that wasn't even inside any credit union's walls.
That incident
became a defining moment for the NCUA and the foundation for what examiners
will be asking you this year.
What the NCUA Is Actually Looking for in 2026
Your examiner
won't arrive with a checklist and a stopwatch. They will arrive with a
framework — and they'll want to see evidence that your institution has moved
beyond awareness to action.
The NCUA's 2026
priorities signal something important for small credit unions: right now, that
threat landscape is unforgiving and ever evolving.
Here's what
they will be evaluating — the questions you'll need to answer:
- Does your board understand cybersecurity or are they
simply acknowledging it? This year, board training has become a formal
examiner priority. Members need to demonstrate active comprehension of
your institution's risk posture, not just passive awareness.
- Can you prove your IT risks are being managed, not
just identified? Examiners will evaluate your risk assessment against a
defined set of criteria. You'll need to show action. A list of risks will
be an incomplete answer.
- Are you fixing vulnerabilities? Running scans and
generating reports is no longer enough. Examiners want measurable
improvement over time, documented explanations for exceptions, and
board-approved thresholds. The distinction now is between institutions
that manage vulnerabilities and those that simply track them.
- What will you do in the first 72 hours after an
attack? This is a regulatory requirement. Federally insured credit unions
must report a cyber incident to the NCUA within 72 hours of becoming aware
of it. In addition to having a policy in place, you will need
scenario-specific plans and proof that your team knows how to execute
them.
- Who is watching your vendors? Given what happened in
November 2023, this question carries significant weight. Examiners want to
see active oversight — signed agreements only won't be adequate. This one
deserves a deeper dive.
The Vendor Issue Leaving Your Institution Vulnerable
Think about how
many vendors have access to your systems right now. Data processors. Cloud
providers. Payment platforms. Each one is a door. Examiners want to know you
aren't leaving any of them unlocked.
The NCUA cannot examine your vendors directly. That gap exists and it hasn't been fixed. Which means the responsibility is yours. Know who you're working with, understand their approach to security, whether they are being good custodians of your data, and have agreements in place that require them to notify you quickly when something goes wrong.
Your security
is only as strong as the vendors you trust.
The Right Expertise Without the Overhead
You're likely
well aware of what the NCUA now expects. The harder question is how to resource
the requirements. Your team is already stretched. You're wearing more hats than
anyone planned for. Enterprise-grade cybersecurity governance was built for
institutions with teams and budgets far beyond yours.
That's the gap JNTtek IT Solutions was built to close. Through Fractional CRO and Virtual CISO services, your institution gains C-suite level risk and cybersecurity leadership without adding to your headcount. That means better threat detection, smarter fraud monitoring, and the kind of continuous oversight that keeps you ahead of what's coming — not just reacting to what already happened.
The Sunday after Thanksgiving in 2023 was a wake-up call.
The question now is whether you're prepared if it happens to you.
