Credit unions that last thought seriously about their NCUA IT exam a few years ago are likely working from an outdated picture. The framework examiners actually use has changed, the priorities have gotten more specific, and the tolerance for controls that exist on paper but aren’t documented, tested, or clearly owned has gotten considerably thinner.
The old Automated Cybersecurity Examination Tool, familiar to anyone who went through an exam before 2020, was suspended as an examination program years ago and formally replaced by the Information Security Examination, which has been the standard since 2023 and remains so today. Credit unions still preparing as though ACET is the framework in play are preparing for an exam that no longer exists in that form. Credit unions unsure where their current documentation stands can work with IT support in Charlotte to review their readiness against the current framework before the next exam notice arrives.
How the Current Exam Actually Works
The Information Security Examination isn’t one uniform review. It scales based on the credit union’s size and complexity. Smaller credit unions, generally those under $50 million in assets, fall under the Small Credit Union Examination Program, which focuses on core security program and records preservation requirements under NCUA regulations. Larger credit unions fall under ISE Core, a risk-focused examination where the bulk of cybersecurity governance, vendor management, and operational resilience gets assessed, with an optional ISE Core+ tier for credit unions where specific risk factors warrant a deeper look.
That structure matters for how a credit union should actually prepare, since the depth and focus of what examiners look for depends directly on which tier applies.
What Examiners Are Specifically Looking For This Year
The NCUA’s 2026 Supervisory Priorities, published in January 2026, are notably more operationally specific than in prior years. Board-level cybersecurity training is a named priority for the first time, with examiners looking for evidence that directors have received structured education, not just passive awareness briefings, and can demonstrate meaningful understanding sufficient to provide real oversight.
Beyond board training, examiners are also focused on IT risk assessments, vendor and third-party risk management, and whether a credit union’s incident response plan includes a tested notification workflow. The NCUA’s 72-hour cyber incident notification rule requires credit unions to notify the agency as soon as possible, and no later than 72 hours after reasonably believing a reportable cyber incident occurred, with the clock starting at reasonable belief rather than confirmed certainty, which is exactly why a rehearsed, documented process matters more than an informal understanding of the requirement.
Where Credit Unions Most Commonly Fall Short
Controls that exist but aren’t documented
A credit union often has more actually in place than it gives itself credit for. The recurring problem examiners find isn’t the absence of a control; it’s the absence of documentation proving that control is tested, current, and clearly owned by someone specific. An examiner can’t verify a control that exists only informally.
Board training that’s passive rather than active
Simply distributing a cybersecurity briefing to board members no longer satisfies what examiners are looking for. The 2026 priorities specifically call for evidence that directors have absorbed and can meaningfully engage with the material, not just received it.
Framework mapping left undone
Examiners increasingly expect a credit union’s security program to map to a recognized framework, such as the NIST Cybersecurity Framework 2.0 or CISA’s Cybersecurity Performance Goals, with that mapping actually documented rather than assumed.
Vendor and third-party risk left unaddressed
Third-party vendor relationships remain a significant area of scrutiny, since a credit union’s security posture is only as strong as the vendors it depends on for core systems and services.
What Preparation Actually Looks Like
| Area | What Examiners Expect to See |
| Board oversight | Documented, structured annual cybersecurity training with evidence of comprehension |
| Incident response | A tested notification workflow that meets the 72-hour reporting requirement |
| Framework alignment | Security program mapped to a recognized standard, with documentation |
| Vendor management | Ongoing third-party risk assessment, not a one-time onboarding check |
| Existing controls | Documented, tested, and clearly assigned to a specific owner |
The pattern across all five rows is consistent. Examiners aren’t only asking whether a control exists. They’re asking whether it can be proven, and proof requires documentation most credit unions haven’t kept as current as their actual practices.
Getting Ahead of the Next Exam
Credit unions preparing well in advance of an exam tend to start with an honest internal review: confirming which ISE tier applies, checking whether board training documentation would satisfy the 2026 priority, and verifying that the incident response plan has actually been tested rather than simply written and filed away. Working with a provider that understands both the technical and regulatory side of an NCUA exam can help a credit union close documentation gaps before an examiner finds them, rather than scrambling to produce evidence during the exam itself. Turn Your Blog Into a Revenue Machine
Walking Into the Next Exam Prepared, Not Reactive
The credit unions that come through an NCUA IT exam smoothly aren’t necessarily the ones with the most sophisticated technology. They’re the ones that treated documentation, board engagement, and vendor oversight as an ongoing discipline rather than a task revisited only when an exam notice arrives. Given how specific and operationally focused the 2026 priorities are, that distinction matters more this year than it has in some time.