2026 Credit Union Cybersecurity Readiness Checklist

85 auditable controls, mapped to NCUA Part 748, the FTC Safeguards Rule, FFIEC guidance and the 2026 supervisory priorities. It is the single sit-down view your board, your CISO and your examiner can all read from the same page.

➡️Mapped to NCUA Part 748, 16 CFR 314 and FFIEC guidance

➡️Aligned to the NCUA 2026 Supervisory Priorities

➡️Covers the 72-hour rule and third-party vendor risk

➡️Built by TorchLight, nearly two decades securing credit unions

Why exam readiness changed in 2026

The next round of NCUA exams will not look like the last ones. On January 14, 2026, the NCUA published its supervisory priorities. For the first time, they named annual board cybersecurity training as an examination priority.

Examiners are also pressing harder on:

IT risk assessments

Vulnerability management with measurable targets

Scenario-specific incident response playbooks

Payment-system fraud controls

And a written position on AI governance.

Vendor risk is the sharpest edge. Roughly 73% of reported incidents in the sector now originate from third-party vendors. Examiners expect documented due diligence on your core processor and every critical provider.

At the same time, the FFIEC Cybersecurity Assessment Tool (CAT) came to an end on August 31, 2025. The tool a majority of credit unions built their program around is gone. Examiners now expect you to map to a successor framework such as the CRI Profile, NIST CSF 2.0, or the CISA Cybersecurity Performance Goals.

If your documentation still points at the CAT, or your board cannot show evidence of cybersecurity training, those are findings waiting to happen. This Credit Union Cybersecurity Readiness Checklist turns that ambiguity into a clear, evidence-backed picture in about 15 minutes.

What is inside the checklist

A board-ready PDF (Edition 6.2026, 12 pages) organized so anyone from a CISO to a director can use it:

Part I, Regulatory Requirements. Eight control domains, 45 auditable controls:

➡️ Information Security Program
➡️ Authentication and Access
➡️ 72-Hour Cyber Incident Notification
➡️ Member Breach Response
➡️ Third-Party and Vendor Oversight
➡️ Identity Theft Red Flags
➡️ Governance and Board Oversight
➡️ And Testing and Examination Readiness.

Part II, Beyond compliance. Seven forward-looking control sets, 40 controls:

➡️phishing-resistant identity
➡️AI-era fraud defense
➡️ransomware resilience
➡️supply chain and SaaS security
➡️member-facing fraud controls for FedNow and RTP
➡️threat intel and cloud posture
➡️and board cyber literacy.

Two executive visuals. A controls-by-domain breakdown and an emerging-risk priority matrix that shows where to focus before examiners ask.

A built-in readiness self-score. You can rate Part I and Part II in one sitting and set your next reassessment date.

Authority and references for every requirement, ready for your audit workpapers.

85 auditable controls in total. Each one with a box a board member can ask about and a CISO can answer with evidence.

Who the checklist is for

➡️CIOs and IT Directors. The ones who own the controls and need a defensible, prioritized punch list.

➡️Information Security Officers and CISOs. Those who have to produce evidence on demand.

➡️CEOs and boards. The ones who want confidence that the institution will pass its next exam.

➡️Compliance and risk leaders. Those assembling examiner-ready documentation.

Built for credit unions with roughly $1M to $500M in assets. The organizations that carry enterprise-grade regulatory expectations without an enterprise-sized security team.

Why credit unions choose TorchLight

TorchLight has spent nearly two decades securing and managing IT for credit unions. We do not hand you a checklist and walk away. Our Advantage Method takes you from a Stability Foundation, through a Compliance Accelerator, to a Proof Point backed by a virtual CISO, with a 24/7/365 security operations center behind it.

The outcome credit unions come to us for: walk into your next NCUA exam with every control documented, defensible and owned. When a box on this checklist is unchecked, we are the team to check it.

Credit union cybersecurity and NCUA exam FAQ

What are NCUA’s 2026 cybersecurity priorities?

The NCUA’s 2026 Supervisory Priorities, published January 14, 2026, emphasize annual board cybersecurity training as a priority. It also included IT risk assessments, vulnerability management with measurable targets, scenario-specific incident response playbooks, third-party and vendor risk management, payment-system fraud controls, and AI governance. The Information Security Examination (ISE) program remains the examination framework.

What replaced the FFIEC Cybersecurity Assessment Tool (CAT)?

The FFIEC retired the CAT on August 31, 2025. There is no single mandated replacement. Examiners expect credit unions to map their program to a recognized successor framework. A framework such as the CRI Profile, the NIST Cybersecurity Framework 2.0, or the CISA Cybersecurity Performance Goals, and to document the mapping.

What is the NCUA 72-hour cyber incident notification rule?

A federally insured credit union must notify the NCUA as soon as possible. (No later than 72 hours after it reasonably believes it has experienced a reportable cyber incident.) The clock starts at reasonable belief, which is why a tested notification workflow and call tree matter.

Does the NCUA require board cybersecurity training?

For 2026, the NCUA named annual board-level cybersecurity training as an examination priority. Examiners look for evidence that directors have received structured cybersecurity education and understand enough to provide meaningful oversight. The checklist includes the governance and board-oversight controls examiners will ask about.

How do I prepare for an NCUA IT examination?

Start by mapping your program to the controls examiners actually test: a written, board-approved information security program, a current risk assessment, multifactor authentication, a tested incident response plan that meets the 72-hour rule, documented vendor oversight, and board reporting. This checklist lays out all 85 controls so you can find and close gaps before the examiner arrives.

Is the checklist free, and what do I get?

Yes. The download is a free 12-page PDF (Edition 6.2026) with 85 auditable controls across regulatory requirements and forward-looking threats, two executive visuals, a built-in readiness self-score, and a full authority and reference list for your workpapers. No cost and no sales call required.