Credit unions serve over 140 million Americans—nearly half the U.S. workforce. Despite their strong community presence and trust-based mission, they’re facing the same sophisticated cyber threats as the largest banks—but often without comparable resources or staff.
This imbalance is becoming more apparent in boardrooms—and regulators are taking notice.
According to the National Credit Union Administration (NCUA), from the moment its cyber incident notification rule went into effect (September 1, 2023) through August 31, 2024, U.S. credit unions reported 1,072 cyber incidents. Alarmingly, 742 of these—nearly 70%—involved a third-party vendor.
Why Third-Party Risk Management (TPRM) Is a Board Priority
Credit unions rely heavily on third-party technology platforms, cloud services, and outsourced vendors to remain competitive and serve members efficiently. But this reliance creates a growing attack surface that is increasingly targeted by ransomware groups and other threat actors.
Unlike larger financial institutions, most credit unions operate with limited cybersecurity budgets, yet they are expected to meet the same regulatory standards and member expectations.
This makes a well-structured Third-Party Vendor Management (TPVM) program not just advisable—it’s essential.
A Practical Framework for Credit Union Boards
If your credit union already has a TPVM program—or leverages a platform to manage vendor risk—your board should ensure it is being reviewed, tested, and improved. If not, here is a foundational approach that meets regulatory expectations and strengthens cyber oversight:
1. Inventory Critical Applications and Vendors
Start with a complete list of all third-party vendors, cloud platforms, and managed services providers—especially those involved in core banking, payments, member data, or digital channels. Credit unions often have smaller IT footprints, so this list is manageable and essential.
2. Classify Vendors by Impact
For each vendor, assess whether they store, access, transmit, or process sensitive credit union data. Classify vendors as High (H), Medium (M), or Low (L) based on the potential impact of a cyber incident involving that vendor.
3. Use a Standardized Questionnaire
Whether through a SaaS platform (e.g., Shared Assessments) or a downloadable template from trusted sources, implement a cyber risk questionnaire for your vendors. At a minimum, High-impact vendors should complete one annually.
4. Evaluate Contracts and Review Assurances
Review your existing contracts with High-impact vendors. Ensure they include cybersecurity clauses, audit rights, and incident notification requirements. Be cautious of vendors who only offer a SOC 2 report or claim regulatory compliance—that’s one piece of the picture, not the whole program.
5. Request Remediation Plans Where Gaps Exist
If deficiencies are identified in vendor responses, request a remediation plan with deadlines. Follow up, and escalate unresolved issues through internal compliance or audit functions.
6. Establish a Cadence
- High-risk vendors: Review annually
- Medium-risk vendors: Review every two years
- Low-risk vendors: Monitor for change in impact classification
For Boards: What You Should Be Asking
As a board member, you don’t need to manage the technical details—but you must ensure these questions are being answered internally:
- Do we have a current inventory of third-party vendors?
- Which vendors have access to member data or core systems?
- How is vendor cyber risk being evaluated and remediated?
- Are we running a TPVM program internally, or leveraging a platform?
- Has our board or audit committee reviewed the program in the past 12 months?
Closing Thought: Cyber Risk Is a Shared Responsibility
Boards are not expected to implement cybersecurity controls—but they are expected to govern them.
Third-party vendors are now involved in nearly 7 out of 10 reported credit union cyber incidents.
If your institution has limited cybersecurity resources, start with the basics. A spreadsheet and annual review of a few key vendors is better than blind trust. You don’t need an expensive platform to build board-level assurance—you need a framework, visibility, and accountability.
And it starts with asking the right questions.
