Picture this: your exam is six weeks out. Your board asked last month whether the credit union has an incident response plan for ransomware. Someone found a document from 2021 and updated the date. Your payment processor switched core platforms in March and nobody has run a vendor risk assessment since. And somewhere in the back of your mind, you know the NCUA rolled out new examination procedures in 2023 that your team has not fully mapped your program against. This is not an unusual situation. It is, in fact, the situation many Montana credit unions find themselves in when an exam cycle approaches. The problem is rarely a lack of effort. It is usually that the regulatory landscape has moved faster than the program keeping up with it. This guide covers what has changed, what examiners are actively looking for in 2026, and where the most common gaps show up. If any of the above scenario sounds familiar, start here. What Governs IT Requirements for Credit Unions Two bodies set the framework for IT oversight at federally insured credit unions: the NCUA and the FFIEC. The NCUA (National Credit Union Administration) is the primary federal regulator for federally insured credit unions. It sets the specific regulations credit unions must comply with, conducts examinations, and publishes its supervisory priorities each January so credit unions know what examiners will focus on that year. The FFIEC (Federal Financial Institutions Examination Council) is an interagency body that includes the NCUA, FDIC, Federal Reserve, OCC, and CFPB. It publishes the IT Examination Handbook, a set of eleven booklets covering information security, business continuity, architecture, outsourcing, payments, and more. NCUA examiners use these booklets directly. When the FFIEC updates a booklet, credit unions feel it. The two frameworks are not separate. NCUA regulations reference FFIEC guidance. ISE examination procedures align with FFIEC booklets. In practice, you need both. The Information Security Examination (ISE): What Replaced the Old Framework For years, NCUA used the Automated Cybersecurity Examination Tool (ACET) as its primary IT exam framework. The ACET was suspended as an examination program in 2020 and formally replaced by the Information Security Examination (ISE), which has been in use since 2023 and continues as the standard in 2026. The ISE comes in three tiers based on asset size: SCUEP (Small Credit Union Examination Program) For credit unions under $50 million in assets. Focuses on compliance with Parts 748 and 749 of NCUA regulations, covering the core security program and records preservation requirements. Streamlined in scope, but not light on expectations. ISE Core For credit unions over $50 million in assets. Builds on SCUEP requirements with a risk-focused examination approach. This is where the bulk of cybersecurity governance, vendor management, and operational resilience controls are assessed. ISE Core+ Optional extended review elements for credit unions where specific risk factors warrant a deeper look. Examiners may apply Core+ controls based on what they find during scoping. The ISE aligns closely with NIST frameworks, Center for Internet Security (CIS) controls, and CISA guidance rather than NCUA regulations alone. Your information security program needs to be defensible against industry standards, not just internally consistent. NCUA Part 748: The Foundation Everything Sits On Part 748 of NCUA regulations is the baseline for credit union information security compliance. Two appendices matter: Appendix A: Guidelines for Safeguarding Member Information This is the operational core. It requires every federally insured credit union to maintain a written information security program covering risk assessment, risk management and control decisions, service provider oversight, testing, and board reporting. The board must receive an annual report on the status of the information security program. Appendix B: Cybersecurity Incident Response This outlines the member notification requirements when sensitive member information is compromised or could have been misused. In 2023, Part 748 was amended to add the 72-hour cyber incident notification requirement (covered in the next section). The compliance officer or president must also certify compliance with Part 748 requirements annually through NCUA’s CUOnline system. The 72-Hour Cyber Incident Reporting Rule Since September 1, 2023, all federally insured credit unions have been required to report qualifying cyber incidents to the NCUA within 72 hours of forming a reasonable belief that a reportable incident has occurred. What qualifies as reportable: Critically, the 72-hour clock starts when the credit union reasonably believes a reportable incident has occurred, not when the investigation is complete. The initial notification does not require a full incident assessment. It is an early alert, and the detailed analysis comes later. What also triggers reporting: If a third-party vendor notifies your credit union that their systems have been compromised in a way that affects your members or operations, your 72-hour window starts from the moment you receive that notification. This matters. In the first year of the reporting requirement, credit unions filed over 1,000 cyber incident reports. Roughly 70% of those incidents were traced back to third-party vendors. Vendor incidents are not an exemption. They are a reporting trigger. How to report: Via the NCUA Cyber Incident Credit Union Reporting portal, phone, or secure email to the NCUA’s designated point of contact. Most credit unions do not know exactly where their program stands until an examiner tells them. A TechStack Assessment gives you that picture before the exam does. See what the assessment covers. What NCUA Examiners Are Focused On in 2026 The NCUA’s 2026 supervisory priorities were published on January 14, 2026 and are more operationally specific than previous years. For IT and cybersecurity, here is what examiners are actively assessing: Board Cybersecurity Training and Engagement For the first time, examiners are making annual board cybersecurity training a named priority. Boards must move beyond passive awareness to active comprehension. Examiners are looking for evidence that board members have received structured cybersecurity education, not just a summary report from management, and that they understand enough to ask substantive questions and provide meaningful oversight. The NCUA has published dedicated guidance on board director engagement in cybersecurity oversight, and examiners reference