Each October, the awareness campaigns lean on the same habits: strong passwords, MFA, spotting phishing. They matter. But at a bank or credit union, every one of them sits on a more basic control. Fraud monitoring, incident response and vendor oversight all work from the same list of who has access. If that list is wrong, so is everything downstream.
This issue is built around that control: our new article on why access has become a board-level accountability, a five-question agenda item you can take into your next board meeting, and the frameworks and free tools worth having open while you plan for 2027.
Access governance is your first line of defense
In 2023, the FDIC and the Texas Department of Banking required a Texas bank to have its system access reviewed and ratified every quarter, with each ratification recorded in its board minutes. This September, NCUA’s Inspector General reported on a credit union that failed after a manager with sole access to its card system raised credit lines on her own family’s accounts.
In both cases, the record ends at the board. IT grants the access, but the board is accountable for it. The article walks through how that plays out under the three lines model, and why two exam changes this year make it more likely that you, not an examiner, will be the one to find an access problem:
- Banks. Starting November 2, a new OCC and FDIC rule limits formal matters requiring attention to problems that could cause material financial harm or break a banking law. Lesser issues become informal observations.
- Credit unions. NCUA says some well-run credit unions could now go up to 24 months between exams.
Agenda item: access governance
Copy this into your next board packet. Your board doesn’t need to review access itself. It needs management to answer these five questions, with evidence, at any meeting.
- Who has access to our critical systems? The core, wire and ACH, the card platform, online banking administration, and the network.
- When were those reviews last done, and by whom? By the managers who understand the access, with the results on record.
- What did the reviews remove? A review that never removes anything is a signature, not a control.
- What permissions does each person hold, and are duties separated? The person who approves wires shouldn’t be able to send them.
- How fast does access go away when someone leaves, changes roles, or a vendor contract ends? Measured, not assumed.
The test: if pulling these answers together takes a month of spreadsheets, screenshots and help desk tickets, the board is getting reassurance, not evidence. Bring the questions to your board this quarter, show what it takes to answer them, and put the cost of doing it properly in the 2027 budget while it’s still open.
Notes from ACU Ops & Tech
Last month we joined operations, technology and security leaders at America’s Credit Unions Operations and Technology Councils’ Conference, September 21–24 at Caesars Palace in Las Vegas. Thank you to everyone who caught our speed round on the main stage or stopped by the booth to talk access between sessions. Two of the week’s big themes kept leading back to the subject of this issue:
- Fraud prevention. Most of it starts with the same list: who can move money, change a credit line or open an account. The card-system failure in our feature article is a fraud story that began as an access story.
- AI adoption. Every new assistant, bot and integration is another identity with access to member data. It needs an owner and a place in the review, the same as a new hire.
If we met in Las Vegas and you’d like to pick up where we left off, the walkthrough below is the easiest way. For photos and highlights from the week:
Our ACU Ops & Tech recap on LinkedIn →Inside the speed rounds →Bobbie on the best part of the week →
Provision on the move
Two more stops before the year is out. If you’ll be there too, come say hello.
| Oct 19–21 | Jack Henry Connect 2026 Kansas City Convention Center · Kansas City, MO |
|---|---|
| Nov 3–5 | FIS Horizon User Group |
Save a time to meet us there →
The roundup
Free resources worth bookmarking, picked for teams that answer to both a board and an examiner.
Assessing your program after the FFIEC CAT
NIST Cybersecurity Framework 2.0
The FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions to NIST CSF 2.0 among its alternatives. Its Govern function, new in 2.0, is the natural home for board reporting on access.
CRI Profile
A financial-sector overlay of the NIST CSF, built by and for financial institutions. Its diagnostic statements and suggested evidence are useful when you need to show a board or examiner how a control actually works.
NCUA ACET (credit unions)
NCUA’s free, voluntary maturity assessment, now updated to incorporate CSF 2.0 content. The toolbox also includes CISA’s Ransomware Readiness Assessment.
NCUA 2026 Cybersecurity and Credit Union System Resilience Report
NCUA’s annual look at cyber resilience across the system, including the alerts it issued between May 2025 and April 2026. A quick way to see what the regulator is watching.
For your staff awareness campaign
CISA Cybersecurity Awareness Month resources
Ready-made tip sheets, posters, slides and social graphics your security or marketing team can rebrand for staff and members. CISA’s 2026 theme is “Securing the Next 250,” and the National Cybersecurity Alliance is running “Don’t Make It Easy for Them.”
From our library, for the board-deck backstory
What is a user access review?
The plain-language primer behind questions 1 through 3. Useful for directors who’ll be asking them for the first time.
Understanding the principle of least privilege at financial institutions
Why each person should hold only the access their job requires, and how that limits the damage from a single bad actor or compromised account.
What is RBAC?
How role-based access control makes questions 4 and 5 answerable, by tying permissions to roles instead of to individuals.
If you take the five questions to your board this month, we’d love to hear how it goes.
The Provision IAM team