NCUA Critical Infrastructure Division Warns of Russian Cyber Retaliation and Other Cybersecurity Threats
Commentary by Michael A. Kleinman
The National Credit Union Administration's ("NCUA") Critical Infrastructure Division (the "Division") briefed the NCUA Board on cyber threats facing credit unions. The Division stated that "the potential for Russian cyber retaliation resulting from the U.S.'s support of Ukraine is an imminent danger."
At the Board's Open Meeting, the Division explained that supply-chain risks, ransomware, COVID-19, cybercrime, geopolitical tensions and Russian cyber retaliation are all threats facing federally insured credit unions today. The Division also summarized the NCUA's efforts "to improve its information security examination program, which is being field-tested by the NCUA and some state supervisory authorities." The program was designed to scale the size and complexity of credit unions in its examinations of compliance with cybersecurity regulations, procedures and controls.
The NCUA encouraged all credit unions to measure their own cybersecurity programs and preparedness over time as threats and risks continue to evolve.
Commentary
Although the NCUA briefing "strongly encourages" credit unions to immediately report cyber incidents to the NCUA (and others), the NCUA did not join other federal banking regulators in adopting the new "Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers" rule (the "rule") (see previous coverage here and here) , which took effect on April 1, 2022. As a reminder, that rule requires banks primarily regulated by the OCC, the FDIC or the Federal Reserve Board to report certain computer-security incidents to their primary regulator within 36 hours of determining that such an incident has occurred, and contains a separate notification obligation for bank service providers to notify affected bank organization customers.