Appropriations don’t have to be listed as individual line items on the budget, but may be folded into other line items, such as technology/IT, training, etc. When changing, adding, or removing a product offering, management will consider information security costs. During the annual review of the information security and business continuity plans, management will consider the security risk posed by critical infrastructures, such as telecommunications, power, etc. Appropriate security measures, including training of staff, will take place. All elements of the programs will be coordinated throughout the entire credit union, so that all stakeholders (members, frontline staff, back office staff, management, and volunteers) in the institution will understand their roles in ensuring safety and security. Each year, the board will evaluate and approve this program and its strategy. The board has approved policies commensurate with risk and complexity that address the concepts of: Information technology risk management: any time the credit union utilizes information technology, it takes upon itself a degree of a certain type of risk. Policy addresses how to manage that risk. Threat information sharing: policy requires that the president and IT staff remain informed regarding threats. Information security: building upon the policies that address information technology risk management, the credit union’s policy specifies how to keep information secure. External dependency or third-party management: as a small institution, the credit union must rely on external or third parties for many cybersecurity functions. Policy addresses how those parties are selected and managed. Incident response and resilience. The responsibility of each staff member for information security. Asset Management As part of a secure program, the credit union will manage its IT assets in the following ways: The credit union will maintain an inventory of organizational assets, including: Hardware Software Data Connections Externally hosted systems Organizational assets are prioritized for protection based on the data classification and business value. Then, according to the cybersecurity controls section of the plan, those assets will be protected appropriately.
of allowing “shared” credentials (for example, an “admin” account that multiple people use), enforcing strong password requirements, etc. Review user access periodically for all systems and applications based on the risk to the application or system. Submit to the president of the credit union requests for changes to physical and logical user access, including those that result from voluntary and involuntary terminations. Have such changes approved by the president. Require and manage identification and authentication for access to systems, applications, and hardware. Provide that access controls include password complexity and limits to password attempts and reuse. Change all default passwords and unnecessary default accounts before system implementation. Require multi-factor authentication for members when accessing products or services. Use physical security controls to prevent unauthorized access to information systems and telecommunication systems. Encrypt all passwords in storage and in transit. Encrypt confidential data when transmitted across public or untrusted networks (e.g., Internet). Encrypt mobile devices (e.g., laptops, tablets, and removable media) that store confidential data. Use encrypted connections and multifactor authentication for remote access to critical systems by employees, contractors, and third parties. Put into place administrative, physical, or technical controls to prevent users without administrative responsibilities from installing unauthorized software. Utilize formal procedures to authenticate customers who request customer service (e.g., the call center). The controls required will vary depending on the risk of the transaction or request (wire transfer requests will have greater controls than a balance inquiry). Dispose of or destroy data according to documented requirements and within expected time frames. Restrict the use of removable media (removable hard drives, flash drives, etc.) to authorized personnel. Conduct independent testing (including penetration testing and vulnerability scanning) according to the risk assessment for external- facing systems and the internal network. Use antivirus and anti-malware tools to detect attacks. Audit or verify firewall rules at least quarterly. Use e-mail protection mechanisms to filter for common cyber threats (e.g., attached malware or malicious links). Monitor the environment for anomalous activities. Monitor and review customer activity that generates anomalous activity alerts. Review logs of physical and/or logical access following events.