What's the Dilly-o with cybersecurity: a buyer's guide for credit unions

The Dilly-o

Your credit union has 72 hours to report a cyber incident to the NCUA, and that clock can start when a third party notifies you.³⁴ So we'd start by reading the incident notice terms in the security and technology contracts you already have.

How we'd size up a vendor

1. Vendor notice - will the provider commit in the contract to tell you about an incident as soon as possible? One contract guide warns that a clause saying "within five business days" leaves the credit union exposed.⁵
2. Response authority - when the provider sees an attack at 2 a.m., can it isolate a device or lock an account, or only send an alert? Get the answer in writing, along with who on your team gets the call.
3. Exam evidence - can the provider hand you audit-ready records that map to the framework your examiner now uses? Ask to see a sample monthly report before you sign.

What changed this year

The FFIEC Cybersecurity Assessment Tool (CAT) retired on August 31, 2025, according to the vendor TorchLight.⁶ On July 23, 2025, the NCUA told credit unions about an FFIEC webinar on the CAT's retirement that highlighted the Cyber Risk Institute framework.⁷ The NCUA's 2026 priorities letter, 26-CU-01, came out on January 14, 2026.⁸ It says examiners will review governance, vendor oversight and security controls around payment systems, with attention to fraud and cyber weaknesses.⁹ Nacha's fraud monitoring rule applied to every originating depository financial institution (ODFI) from March 20, 2026.¹⁰ The rule's Phase 2 was set for June 19, 2026, a federal holiday, so in practice it landed on Monday, June 22.¹¹

Will it work with your systems?

TEN Credit Union picked Bankjoy's digital banking platform, which includes the FraudSense real-time fraud prevention system.¹² We haven't yet reviewed how the cybersecurity vendors we track fit with any core.^C Before you buy a separate tool, ask your digital banking provider and your core what security monitoring is already in your contract, and who sees the alerts.

What other credit unions did

Michigan State University Federal Credit Union put AI screening on its calls and found $2.57 million in deepfake fraud exposure in a year.¹ TEN Credit Union chose a digital banking platform with real-time fraud prevention built in.¹²

What your examiner will ask

Under Part 748, a federally insured credit union must tell the NCUA about a reportable cyber incident within 72 hours of reasonably believing one occurred.³ That clock can start when a third party notifies you.⁴ If the incident is at a provider, you still notify members and the regulator, and Appendix B says the contract should require the provider to notify you as soon as possible.¹³ The NCUA does not certify or validate any vendor's compliance, so that diligence is yours.¹⁴ Have ready your vendor contracts, your incident response plan, your new framework mapping and your ACH fraud monitoring procedures.

What it costs

Expect pricing per device, per asset or as a monthly retainer, and ask each vendor for a written quote. B.D. Emerson puts a managed security operations center (SOC) retainer at $5,000 to $25,000 a month for organizations of 100 to 1,000 employees.¹⁵ One cost guide puts SOC costs for community banks under $1 billion in assets at $400,000 to $1.5 million.¹⁶ In the contract, pin down how service accounts, shared mailboxes and contractors count, since those definitions move the invoice more than the headline rate.¹⁷ We haven't seen public figures for setup time, so make the vendor commit to a go-live date in writing.

Food for thought

The Marquis Software breach touched 74 banks, and its disclosure was not complete until March 2026.¹⁸ Marquis later sued SonicWall.¹⁹ We think the next board question will be about your vendors' vendors, so start mapping who your providers depend on.