Before a vendor connects to your core, you need clear answers to five questions: how it gets in, what it can touch, what data it keeps, how you’ll hear about an incident, and how the relationship ends. That’s vendor due diligence in one breath. The stakes are real. In the first eight months of the cyber incident reporting rule from the National Credit Union Administration (NCUA), about 73% of the incidents credit unions reported were tied to a third party (NCUA, June 2024).
Why Core Access Raises the Stakes
A vendor with a connection to your core holds a set of credentials that can read, and often change, member records. That’s the point of integration, and it’s also why the questions have to be sharper than a standard vendor review.
The numbers show where the risk sits. NCUA’s June 2024 report to Congress counted 892 cyber incidents reported between September 1, 2023, and May 1, 2024; about 73% were tied to a third party. One ransomware attack on a service provider in November 2023 affected 60 credit unions (NCUA, June 2024). Across industries, Verizon’s 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, a 60% increase over the prior year’s report (Verizon, May 19, 2026).
There’s a second reason the work falls to you. NCUA can’t examine the vendors credit unions rely on; its temporary authority expired at the end of 2001 (NCUA, Third-Party Vendor Authority). Its 2026 cybersecurity report warns that credit unions may lack visibility into vendor controls, and it points to limited service provider diversity and vendor lock-in as growing challenges (NCUA, June 2026).
The baseline expectation hasn’t changed. NCUA’s guidelines for safeguarding member information ask credit unions to use due diligence in selecting service providers, require them by contract to protect member information, and monitor them where risk calls for it (12 CFR Part 748, Appendix A). The sections below turn that expectation into questions you can put in front of any vendor.
Access and Privileges
Start with the connection itself. The goal is least privilege: the vendor’s integration can do exactly the jobs it was hired for, and nothing else.
A well-scoped integration uses a dedicated service account with only the permissions its job needs, and every call it makes is logged where your team can see it.
Ask every vendor:
- Which core functions will your integration use? Get the list in writing: the specific inquiries, transactions, and file maintenance it performs through the core’s supported interfaces, such as Corelation’s KeyBridge on KeyStone or Jack Henry’s SymXchange on Symitar. Anything not on the list shouldn’t be possible.
- Is access through a dedicated service account? Shared logins and borrowed staff credentials make it impossible to tell who did what.
- How do your people reach our data? Ask who on the vendor’s staff can access your production environment, whether multifactor authentication (MFA) is required, and whether remote sessions are approved and recorded.
- How fast can we shut it off? You should be able to disable the integration’s access in minutes, without waiting on the vendor.
- How often do you review access? People change roles. Ask how often the vendor recertifies who can reach your data, and whether you’ll see the results.
Data Handling and Encryption
Next, follow the data. Many integrations need only a slice of member information for a moment. Others store copies for months. You should know which one you’re signing up for.
- What member data do you store, and why? Ask for a data inventory by solution. If the vendor stores data it doesn’t need, ask it not to.
- Where does it live? Get the hosting provider, the locations, and any subcontractors that handle your data. Those subcontractors are your fourth parties, and their controls matter too.
- How is it protected? Ask how data is encrypted in transit and at rest, who manages the keys, and how backups are protected.
- What’s in test environments? Test and demo systems should run on demo data, never copies of live member records.
- How long is it kept, and what happens at the end? Ask for retention periods, and how the vendor will return or destroy your data when the contract ends, with written confirmation.
These answers belong in the contract, not just the questionnaire. NCUA’s guidelines expect credit unions to require, by contract, that service providers put safeguards in place that protect member information (12 CFR Part 748, Appendix A).
Monitoring, Logging, and Incident Response
Good access controls tell you who should be able to act. Logs tell you who did. Ask what the vendor logs, how long it keeps those logs, and whether your team can see them or receive alerts.
Then ask how quickly the vendor patches known vulnerabilities and when it last had an independent penetration test. Exploited vulnerabilities were the top way into breaches in Verizon’s 2026 report, at 31% (Verizon, May 19, 2026).
Incident response is where your contract meets your regulator. Under NCUA’s cyber incident rule, a credit union must report a reportable cyber incident as soon as possible and no later than 72 hours after it reasonably believes one occurred. That includes a disruption or unauthorized access caused by a compromise at a credit union service organization (CUSO), cloud provider, or other third-party data host. For a vendor incident, the deadline is 72 hours from the vendor’s notice or from when you reasonably believed an incident occurred, whichever comes first (12 CFR 748.1(c)).
The contract sets how fast your vendor must tell you about an incident; NCUA’s rule then gives you up to 72 hours to report it.
So ask each vendor:
- How fast will you tell us? Put a notice window in the contract, along with who gets called and what information comes with the call.
- What will you share during an incident? You’ll need facts quickly to decide whether the incident is reportable.
- Will you practice with us? A short tabletop exercise with your team and the vendor’s surfaces gaps before a real incident does.
Business Continuity and Change Management
Every vendor goes down eventually. The question is what your members and staff experience when it happens, and how quickly things recover.
- What happens when you’re offline? Ask what members see, what staff can do in the meantime, and whether transactions queue safely or are lost.
- What are your recovery targets, and when did you last test them? Get recovery time and recovery point objectives, plus the date and results of the last test.
- How do you handle core and product releases? Ask how the vendor tests against new core versions, how much notice you get before changes, whether you can test first, and how a bad release is rolled back.
- Are you financially sound? NCUA’s long-standing guidance expects credit union officials to review a vendor’s financial statements as part of due diligence (NCUA Letter 01-CU-20).
- Could we leave if we needed to? With NCUA naming vendor lock-in as a growing concern, ask what an exit would take: data formats, timelines, and the vendor’s help during a transition.
For a deeper look at recovery planning, see our post on disaster recovery strategies for credit unions.
Contract Terms and Ongoing Oversight
Due diligence doesn’t end at signature. NCUA’s guidance on third-party relationships expects contracts to address audit rights, data security and member confidentiality (including testing), service levels, default and termination, and business resumption, with periodic reports to officials (NCUA Letter 07-CU-13 and Supervisory Letter 07-01). Its earlier letter adds two practical steps: have your attorney review the contract, and name a staff member to monitor the vendor (NCUA Letter 01-CU-20).
Plan, due diligence, contract, monitor, and exit: the relationship stages described in 2023 interagency guidance, repeated as the relationship continues.
Those stages come from third-party guidance the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued in June 2023 (Federal Reserve). NCUA didn’t join that guidance, but the stages are a useful map for any credit union.
The rules around this work are shifting, so it’s worth watching. On September 11, 2026, NCUA joined the FDIC, the Federal Reserve, and the OCC in proposing principles-based third-party risk management guidance, with comments due 60 days after it’s published in the Federal Register (NCUA, September 11, 2026). The Federal Financial Institutions Examination Council (FFIEC) retired its Cybersecurity Assessment Tool on August 31, 2025, and pointed institutions to resources such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Performance Goals (FFIEC).
A Starter Vendor Security Questionnaire
Use this as a starting point, and adapt it to how critical the vendor is.
| Area | What to ask for |
|---|---|
| Access | A written list of core functions used; dedicated service accounts; MFA for vendor staff; how fast you can disable access |
| Data | A data inventory; hosting locations and subcontractors; encryption in transit and at rest; retention and destruction terms |
| Testing | Independent audit reports and the latest penetration test summary; vulnerability patching timelines |
| Logging | What’s logged, how long it’s kept, and how your team can see it |
| Incidents | Contractual notice window, contacts, and information to be shared; willingness to run a joint tabletop exercise |
| Continuity | Recovery time and recovery point objectives; date and results of the last recovery test |
| Change | Release notice periods; testing against core upgrades; rollback plan |
| Viability | Financial statements; client references on your core |
| Exit | Data return format and timeline; help during a transition |
How IMSI Helps
IMS Integration (IMSI) sits on the other side of these questions every day. Our solutions read from and write to Corelation KeyStone and Jack Henry Symitar (formerly Episys). Our Integrations page lists 60 third-party integrations, so we work inside core permission models and partner connections constantly.
That experience shapes how we answer due diligence:
- Specific answers about access. We’ll walk your IT and risk team through which core functions each IMSI solution uses and why, so you can match them to the permissions you grant.
- Answers in writing. We expect your questionnaire and will answer it directly, with our technical team involved.
- One partner for many workflows. Our solutions share one workflow engine, Workbox. That means one vendor relationship to review and monitor across account opening, lending, loan servicing, and back-office work.
- People who answer. IMSI has been founder-led since 2007. When your team has a question during a review or an incident, you reach the engineers who built the solution.
Frequently Asked Questions
What does NCUA expect for third-party vendor oversight? Due diligence when selecting a service provider, contract terms that require the provider to protect member information, and monitoring where your risk assessment calls for it. NCUA’s letters 01-CU-20 and 07-CU-13 add detail on financial review, contract terms, and reporting to officials.
Can NCUA examine our vendors directly? No. NCUA’s temporary authority to examine credit union vendors expired at the end of 2001, which is why credit unions carry the due diligence themselves.
Does an incident at our vendor count toward NCUA’s 72-hour reporting rule? It can. A disruption or unauthorized access caused by a compromise at a CUSO, cloud provider, or other third-party data host is reportable, and you have up to 72 hours from the vendor’s notice, or from when you reasonably believed it occurred, whichever is sooner.
Is the FFIEC Cybersecurity Assessment Tool still in use? No. The FFIEC retired it on August 31, 2025, and pointed institutions to frameworks such as NIST Cybersecurity Framework 2.0 and CISA’s Cybersecurity Performance Goals. NCUA’s own Automated Cybersecurity Evaluation Toolbox (ACET) remains available and voluntary (NCUA).
Want a vendor that welcomes these questions? Schedule a strategy call
Related reading
- Leveraging Secure API Integrations to Enhance Digital Banking
- Enhancing Disaster Recovery Strategies for Credit Unions
- Preparing for a Core Conversion: Reducing Migration Risk
This post is for general information and is not legal or compliance advice.
Patrick Arthurs is co-founder and Chief Software Architect at IMS Integration (IMSI), where he designs how IMSI’s solutions connect to credit union cores. He is a former VP of IT at Meadows Credit Union and holds a BS in Computer Engineering and an MS in Computer Science.
