Open Recommendations

Formally establish and clarify operational roles and responsibilities across offices for cyber threat information sharing and any delegation of authorities to determine when issues must be escalated.

Ensure timely finalization and implementation of recommendations identified in the after-action and lessons learned reports for cyberrelated incidents, including the draft ongoing operations after-action report and the draft pre-victim notification lessons learned report.

Document and implement internal data management protocols that ensure the appropriate sharing, assessment, and response of available cyber threat information.

Develop a process to assess credit unions’ and other stakeholders’ feedback on NCUA’s cyber threat information sharing and update information sharing processes to reflect any necessary changes.

Ensure the Office of Examination and Insurance provides timely updates to examination and supervisory guidance to address cyber risks.