Requirements · Financial services
NCUA Security Program (12 CFR Part 748)
Credit union security program and customer information rules. 6 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
12 CFR Part 748 is the National Credit Union Administration’s rule on security programs for federally insured credit unions. It requires a written security program, including the information security program called for by the Gramm-Leach-Bliley Act and a response program for unauthorized access to member information. Since September 2023 it has also required credit unions to notify the NCUA of a reportable cyber incident within 72 hours.
Source: 12 CFR Part 748 (eCFR). NCUA in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A) 2 products
- Bank Protection Act (12 U.S.C. 1881 et seq.) and security program rules (12 CFR 208.61, 12 CFR Part 326, 12 CFR Part 748) 1 product
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B; 12 CFR Part 748 Appendix A for credit unions) 1 product
- NCUA Security Program and cyber incident notification rules (12 CFR Part 748) 1 product
- NCUA Security Program rules (12 CFR Part 748) 1 product
For what it requires of your organization, read the rule itself or ask your counsel. NCUA in the glossary.
Products
The 6 products that support it
ATM & Cash Logistics Optimizer
Predictive analytics for branch cash replenishment, minimizing idle cash holding costs (non-earning assets).
Lists:
- Bank Protection Act (12 U.S.C. 1881 et seq.) and security program rules (12 CFR 208.61, 12 CFR Part 326, 12 CFR Part 748)
Board Governance & Packet Portal
Encrypted iPad portal for Board minutes and voting, with "reading room" controls on downloading and printing non-public material. Access policy and vote validity remain your institution's.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B; 12 CFR Part 748 Appendix A for credit unions)
Endpoint Detection & Response
24/7 managed detection and hunting on teller workstations to reduce ransomware risk. Recovery, backups and notification decisions remain your institution's.
Lists:
- NCUA Security Program and cyber incident notification rules (12 CFR Part 748)
Security Awareness Training
Phishing simulations tailored to financial fraud (e.g., "Wire Transfer Request"), producing training evidence for examiners and cyber insurers. Premium decisions remain the insurer's.
Lists:
- NCUA Security Program rules (12 CFR Part 748)
Virtual Desktop Infrastructure
Secure remote workspaces designed to keep PII off loan officers' local laptops, under file, clipboard and print policies you approve. Access decisions remain yours.
Lists:
- NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)
Vulnerability Management
Authenticated scanning of the banking network on your schedule (e.g., weekly), supporting the GLBA Safeguards Rule's vulnerability-assessment requirement (16 CFR 314.4(d)(2)). Risk assessment and remediation remain the institution's.
Lists:
- NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.