Credit Union Penetration Testing for the NCUA Exam

Credit union penetration testing is how you show NCUA that someone independent tested your security. This page shows the rule that asks for testing, what NCUA says about its exam, and which of our services fit.

What does the NCUA rule say about testing?

NCUA Part 748, Appendix A carries the title Guidelines for Safeguarding Member Information. Section III.C.3 tells credit unions to “regularly test the key controls, systems and procedures” of their security program.

Your risk assessment sets how often and how deep you test. An outside company, or staff who do not build or run your security program, should run the tests or review them.

This rule covers federally insured credit unions. If your credit union has no federal insurance, the FTC Safeguards Rule applies to you instead.

What does the NCUA exam look at?

Since 2023, NCUA examiners have used the Information Security Examination, or ISE. NCUA says it helps make security reviews more consistent from one credit union to the next.

NCUA lists the FFIEC IT Examination Handbook among the resources behind its security exams. It says credit unions can use the handbook to match their security practices to FFIEC guidelines. NCUA's voluntary ACET self-assessment tool also maps each of its statements to practices in that handbook.

The handbook's Information Security booklet lists four ways to test your security (section IV.A.2). Penetration tests are one. The others are self-assessments, vulnerability assessments and audits. The booklet names network tests and social engineering tests as types of penetration tests (section IV.A.2(b)). Ask your examiner which tests they expect to see.

Which Red Raine Labs services fit?

Two of our services match the test types the handbook names.

• Network penetration testing starts from the internet, from inside your network, or both.
• Social engineering and phishing tests your staff. We run phishing tests, and we can talk about phone-based scenarios when we scope.

Red Raine Labs is owner-operated. The experienced tester who scopes your test also runs it and writes the report. Your board gets a plain summary. Your IT team gets every finding with proof and a fix. We can test your credit union from anywhere in Michigan, and most tests run from our side.

Related services and reading

• Bank penetration testing: the same rule in the federal bank guidelines.
• FTC Safeguards Rule penetration testing: the rule for credit unions without federal insurance.
• Pentest vs vuln scan: what each one tells you, and which one you need.
• How to prepare for a penetration test: a free checklist for scope, timing and rules of engagement.

Read the sources

Do not take our word for it. Read the rule and the exam pages yourself.

• NCUA: Guidelines for Safeguarding Member Information, 12 CFR Part 748, Appendix A, section III.C.3
• NCUA: Information Security Examination and Cybersecurity Assessment Program
• FFIEC IT Examination Handbook, Information Security booklet, section IV.A.2: Types of Tests and Evaluations