Their breach is your exam finding

NCUA guidance expects due diligence proportional to the relationship's risk: deep review for the core processor and anything touching member data, lighter touch for the landscaping contract. That means risk-tiering your vendor inventory, defining what evidence each tier requires (SOC reports, security questionnaires, financials, incident-notification terms), and reviewing on a schedule you can prove.

The 72-hour incident reporting rule raised the stakes: a substantial cyber incident at your provider can trigger your reporting obligation. Contracts and intake processes have to make sure you hear about vendor incidents fast enough to comply.

We inventory and tier your vendors, build the per-tier evidence requirements and review calendar, remediate the contract gaps that matter (notification clauses, right-to-audit, data handling), and stand up intake for vendor incidents. Then we size the ongoing operation to your staff, or run it for you through Resident Engineering.