Cybersecurity for Business Leaders

Because when ransomware locks your core system or a vendor breach exposes member data, the credit union faces regulatory scrutiny, legal liability, and lasting damage to member trust. Those are governance outcomes. The board’s job is not to manage firewalls; it is to confirm the program is funded, findings are being resolved, risk appetite is set, and reporting is honest.

No. Compliance confirms baseline adequacy. A credit union with a spotless NCUA examination record can still be breached tomorrow. Govern to actual risk and let compliance follow as a byproduct, not the other way around.

Business email compromise, ransomware, phishing, credential theft and account takeover, supply chain compromise, insider risk, cloud misconfiguration, and cyber-enabled payment fraud. Many successful breaches begin with a compromised credential or a clicked link, not a technically sophisticated exploit.

NCUA requires federally insured credit unions to report a reportable cyber incident within 72 hours of forming a reasonable belief that it occurred. For a third-party incident, the clock runs from the sooner of vendor notification or your reasonable belief. Vendor contracts must obligate prompt notification if you are going to reliably meet your own deadline.

NCUA reported that seven in ten cyber incidents credit unions filed in the first year of the notification rule involved a third-party vendor. And NCUA does not have direct supervisory authority over most vendors, so due diligence and ongoing oversight stays with the credit union. Vendor oversight is not optional.

Status of the highest-rated risks, any new risks identified, progress on active mitigation (with items at risk of missing targets), a summary of incidents and near-misses, and any risks where the board-approved acceptance posture should be reconsidered. If every metric is green every quarter, the reporting framework needs to be challenged.

Multi-factor authentication on privileged accounts and remote access is one of the highest-impact controls against credential-based attacks. But the more honest answer is that identity as a whole is where the fight starts and ends. Strong identity controls, privileged access management, and account lifecycle management matter more than any single tool.

Yes. Small businesses hold customer data, employee records, payment information, and access to money, which is exactly what attackers want. Many successful breaches begin with a compromised credential or a clicked link, not a sophisticated exploit.

For most businesses under fifty people, yes, if the provider is a good one. A single in-house IT person is one person with one set of skills and one point of failure. A capable MSP gives you a team and coverage that does not take a day off. The catch: a weak MSP is more dangerous than no MSP, because you believe you are covered when you are not.

Make them show proof every quarter: the last successful restore, who at their company has admin access to you, what critical patches are open, and what they would do in the first four hours if your email or backups were hit. A good provider welcomes the questions. A weak one gets uncomfortable, which tells you what you need to know.

MFA and unique logins for every technician, fast written notice of any security incident, your data and documentation transferable to you if the relationship ends, a named restore-time target for the systems that take payment and run payroll, the right to see proof on a fixed cadence, and no silent subcontracting. If it is not in the contract, do not sign.

Five things this week: turn on MFA everywhere money, email, or customer data lives; pin down your backups in writing with your MSP; freeze your credit and lock your mobile carrier account; write a one-page money rule that requires a callback for any payment change; and compare your insurance application to your MSP contract.

Not to start. Under about fifty people, the minimum viable program is the program: the risk you will not accept, who can move money, the first 24 hours of an incident, and a quarterly review. It lives in four documents: an incident card, a vendor list, an open-findings list, and proof of your last successful restore.

Never without legal counsel and sanctions screening. Paying certain sanctioned groups can itself violate federal law. Decide who holds that authority before an incident, not in the middle of one.