2026 Credit Union Cybersecurity Readiness Checklist
85 auditable controls mapped to NCUA Part 748, the FTC Safeguards Rule, and FFIEC guidance . One sit-down view your board, your CISO, and your examiner can all read from the same page.
Free 12-page PDF (Edition 6.2026). No cost and no sales call required.
Built for your next NCUA exam
- Mapped to NCUA Part 748, 16 CFR 314, and FFIEC guidance
- Aligned to the NCUA 2026 Supervisory Priorities
- Covers the 72-hour rule and third-party vendor risk
- Built by TorchLight, nearly two decades securing credit unions
Auditable controls across 15 domains
NCUA cyber incident notification rule, covered
Of sector incidents originate with third-party vendors
Securing and managing IT for credit unions
The next round of NCUA exams will not look like the last ones
On January 14, 2026, the NCUA published its supervisory priorities and, for the first time, named annual board cybersecurity training as an examination priority. This checklist turns the new expectations into 85 evidence-backed controls you can score in about 15 minutes.
Why exam readiness changed in 2026
Board training is now an exam priority
Examiners look for evidence that directors have received structured cybersecurity education and can provide meaningful oversight. A verbal assurance is no longer enough.
The FFIEC CAT is gone
The Cybersecurity Assessment Tool retired on August 31, 2025. Examiners now expect a documented mapping to a successor framework such as the CRI Profile, NIST CSF 2.0, or the CISA Cybersecurity Performance Goals.
Vendor risk is the sharpest edge
Roughly 73% of reported incidents in the sector now originate with third-party vendors . Expect documented due diligence on your core processor and every critical provider.
New areas of scrutiny
IT risk assessments, vulnerability management with measurable targets, scenario-specific incident response playbooks, payment-system fraud controls, and a written position on AI governance .
A board-ready PDF anyone from a CISO to a director can use
Every one of the 85 controls comes with a box a board member can ask about and a CISO can answer with evidence, plus the regulatory authority behind it for your audit workpapers .
Part I, Regulatory Requirements.
45 auditable controls across eight domains: information security program, authentication and access, 72-hour incident notification, member breach response, vendor oversight, identity theft red flags, governance, and exam readiness.
Part II, Beyond Compliance.
40 forward-looking controls: phishing-resistant identity , AI-era fraud defense , ransomware resilience, supply chain and SaaS security, FedNow and RTP fraud controls, threat intel and cloud posture, and board cyber literacy.
Two executive visuals.
A controls-by-domain breakdown and an emerging-risk priority matrix that shows where to focus before examiners ask.
A built-in readiness self-score.
Rate Part I and Part II in one sitting and set your next reassessment date.
Built for the people who answer to examiners
Designed for credit unions with roughly $1M to $500M in assets. The organizations that carry enterprise-grade regulatory expectations without an enterprise-sized security team.
Who the checklist is for
When a box comes up unchecked, TorchLight can help you close it:
Those who have to produce evidence on demand, control by control.
The ones who want confidence that the institution will pass its next exam.
Those assembling examiner-ready documentation and board reporting.