NCUA ACET

An NCUA ACET audit typically involves the following key steps:

• Pre-Audit Preparation: Credit unions are expected to gather and organize relevant information regarding their cybersecurity risk management practices. This may include policies, procedures, risk assessments, incident response plans, and other relevant documentation.
• Introduction and Scoping: The NCUA examiners meet with the credit union's management to discuss the audit objectives, scope, and timeline. They may also request additional documentation and information specific to the credit union's operations.
• Assessment: NCUA examiners utilize the ACET tool to evaluate the credit union's cybersecurity risk management practices. The ACET evaluates the credit union's cybersecurity maturity across several domains, including governance and risk management, threat intelligence and collaboration, cybersecurity controls, external dependency management, and incident response and resilience.
• Examination Process: The NCUA examiners review the credit union's cybersecurity policies, procedures, and controls. They may conduct interviews with key personnel responsible for cybersecurity, such as the Chief Information Security Officer (CISO) or IT staff. The examiners assess the credit union's adherence to regulatory requirements, industry best practices, and the effectiveness of their cybersecurity controls.
• Findings and Recommendations: The NCUA examiners document their findings and provide recommendations based on the assessment. They may identify areas of improvement, potential vulnerabilities, or non-compliance with regulatory requirements. The credit union is typically given an opportunity to respond to the findings and develop remediation plans.
• Reporting: The NCUA examiners compile a report summarizing the audit findings, including any identified deficiencies, recommendations, and the credit union's response. This report is shared with the credit union's management and may be used by the NCUA for supervisory purposes.

It's important to note that the specific details of the NCUA ACET audit process may vary based on the individual credit union's size, complexity, and risk profile. Credit unions should consult the NCUA's official resources, such as the ACET User's Guide and other guidance documents, for more specific information and to stay up to date with any changes in the audit process.

Here are some general principles and recommendations related to network authentication that credit unions may consider:

• Multi-Factor Authentication (MFA): The NCUA ACET emphasizes the importance of implementing multi-factor authentication for network access. MFA requires users to provide multiple forms of identification, typically a combination of something they know (e.g., password), something they have (e.g., a physical token), or something they are (e.g., biometric data). MFA adds an extra layer of security and helps prevent unauthorized access even if one factor is compromised.
• Strong Password Policies: The NCUA ACET advises credit unions to enforce strong password policies. This includes requiring complex passwords that are difficult to guess, regularly changing passwords, and avoiding the use of easily guessable or common passwords. It's important to educate employees and members about creating and maintaining strong passwords.
• Privileged Access Management (PAM): The NCUA encourages credit unions to implement a robust privileged access management solution. PAM helps control and monitor administrative access to critical systems and resources. It includes practices such as implementing separate administrative accounts, regularly reviewing and updating access privileges, and employing logging and monitoring mechanisms for privileged activities.
• Account Lockout and Intrusion Detection: The NCUA ACET recommends implementing account lockout mechanisms to prevent brute force attacks, where an attacker attempts to gain unauthorized access by guessing passwords. Additionally, intrusion detection systems and security event monitoring can help identify and respond to suspicious activities, such as repeated login failures or unauthorized access attempts.
• Secure Remote Access: With the growing trend of remote work, the NCUA advises credit unions to implement secure remote access controls. This may involve using virtual private networks (VPNs), secure remote desktop protocols, or other secure remote access technologies. It's important to properly configure and monitor remote access solutions to mitigate the risk of unauthorized access or data breaches.
• User Awareness and Training: The NCUA recognizes the significance of user awareness and training in promoting strong network authentication practices. Credit unions are encouraged to provide cybersecurity awareness training to employees and members, emphasizing the importance of protecting their credentials and understanding potential risks associated with network authentication.

It's important to note that these recommendations are general guidelines, and credit unions should assess their specific risk profile and regulatory requirements when implementing network authentication controls. Keeping up to date with the NCUA's guidance and industry best practices is crucial for credit unions to maintain effective network authentication measures.

Network access control refers to the process of managing and securing access to a network by enforcing policies and controls that determine who can access the network and what resources they can access.

Here are some ways that NAC fits into the NCUA ACET:

• Risk Assessment: The NCUA ACET emphasizes the importance of conducting regular risk assessments to identify and evaluate potential risks to the credit union's systems and network. As a part of this process, credit unions should assess their network access control measures and identify any gaps or vulnerabilities that may exist.
• Policies and Procedures: Credit unions are advised to develop and implement NAC policies and procedures that align with their overall cybersecurity risk management program. This includes defining access controls for different types of users, devices, and applications, as well as establishing rules for network segmentation and perimeter security.
• Access Controls: The NCUA ACET recommends using access controls, such as firewalls, intrusion detection systems, and intrusion prevention systems, to help prevent unauthorized access to the network. Credit unions should configure these controls to enforce policies that limit access to only authorized users, devices, and applications.
• Identity and Access Management (IAM): IAM refers to the processes and technologies used to manage and control user access to systems and applications. The NCUA ACET advises credit unions to implement IAM solutions, such as identity federation and single sign-on (SSO), to simplify and secure access management. IAM solutions can help streamline user authentication, access provisioning, and de-provisioning processes.
• Continuous Monitoring: The NCUA encourages credit unions to implement continuous monitoring solutions that can detect and respond to potential security incidents and policy violations in real-time. This includes deploying network monitoring and logging solutions, as well as implementing security information and event management (SIEM) solutions that can aggregate and analyze security data from various sources.

By implementing NAC measures as a part of their overall cybersecurity risk management program, credit unions can help reduce the risk of unauthorized access to their network and protect sensitive data from compromise. The NCUA ACET provides a framework for assessing the effectiveness of these measures and identifying areas for improvement.

Endpoint risk mitigation focuses on securing individual devices, such as workstations, laptops, mobile devices, and servers, that connect to a network. Here are some aspects related to endpoint risk mitigation that may be considered within the NCUA ACET:

• Endpoint Security Controls: The NCUA ACET likely assesses the implementation of endpoint security controls, such as antivirus/anti-malware software, host-based firewalls, intrusion detection/prevention systems, and system patching practices. These controls help detect and prevent unauthorized access, malware infections, and other security threats.
• Device Configuration Management: Credit unions are expected to have processes in place to manage the configuration of their endpoint devices effectively. This includes ensuring that devices are configured securely and that unnecessary services, protocols, or software are disabled or removed to minimize potential attack vectors.
• Vulnerability Management: The NCUA ACET may assess how credit unions identify, track, and remediate vulnerabilities in their endpoint devices. This involves implementing vulnerability scanning and patch management processes to keep endpoints up to date with the latest security patches and software updates.
• Mobile Device Security: Given the prevalence of mobile devices in today's business environment, the NCUA ACET likely considers the security of mobile devices used by credit union employees. This includes enforcing secure configurations, implementing mobile device management (MDM) solutions, and ensuring appropriate access controls, encryption, and remote wipe capabilities are in place.
• Secure Remote Access: The ACET may address the security of endpoints used for remote access to the credit union's network. This involves implementing secure remote access solutions, such as virtual private networks (VPNs), and ensuring that endpoints accessing the network remotely meet the necessary security requirements.
• User Awareness and Training: The NCUA recognizes the importance of user awareness and training in mitigating endpoint risks. Credit unions are advised to provide cybersecurity awareness training to employees, emphasizing safe computing practices, identifying phishing attempts, and reporting security incidents.

It's important to note that the specific evaluation criteria and emphasis on endpoint risk mitigation within the NCUA ACET may vary. Credit unions should refer to the NCUA's official resources, such as the ACET User's Guide and other guidance documents, for detailed and up-to-date information on how endpoint risk mitigation is addressed in the assessment process.