Home/Resources/Walk the house
Free guide · PDF

Walk the house.

Five places old access hides at a credit union or bank, and how to find it before it becomes a problem.

What’s inside

Five rooms, and the question to ask in each.

Access gets granted when someone needs it, but few processes take it away when that need ends. The guide walks through five places old access tends to hide, drawing on NCUA, FFIEC, and FDIC exam guidance and on incidents at real credit unions.

  • The former employee’s deskOffboarding usually covers the network and email. The gaps are in the hand-offs: HR to IT, IT to an outside firm, and the network login to the core, loan origination, and card platforms that keep their own user lists.
  • The promotion that kept its old keysWhen someone changes roles, the new access gets requested and the old access often stays, until one person can open an account and approve a loan on it.
  • The vendor keyThird-party accounts, what each one can reach, and whether the contract behind it is still active. Of the 1,072 cyber incidents credit unions reported to NCUA over one year, 742 involved a vendor.
  • The accounts that belong to no oneShared, generic, and service logins, and test accounts left from a core conversion. They are on no HR list, so a review organized by person walks past them.
  • The dormant accountStaff accounts nobody has used in months, and quiet member accounts. The question there is who can move money on them.

One question per room

Each room ends with a question you can put to your own team, such as: for everyone who left in the last 12 months, can you show when each of their accounts was removed, system by system?

Platform

Insight

See who has access across every system, certify it, and prove it to your examiner. The entry tier of the Provision platform.

Solution

User access reviews

One scheduled, documented review workflow with proof on every decision, so old access surfaces in the review instead of in an incident.