Federally mandates that all federal credit unions develop an comprehensive internal security program. This program is designed to protect each credit union from robberies, burglaries, larcenies, and embezzlement; Ensure the security and confidentiality of member records, protect against anticipated threats or hazards to he security or integrity of such records, protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member; assist in the identification of a person who commits or attempts to commit such actions and protect against the destruction of vital records.

Safe guards designed by this program are intended to: (1) insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information that would result in substantial harm or inconvenience to any customer.

NCUA regulations require that federally-insured credit unions have a written security program designed to protect each credit union from robberies, burglaries, embezzlement, and assist in the identification of persons who attempt such crimes. Expanding the environment of protection to include threats or hazards to member information systems is a natural fit within a comprehensive security program. To evaluate compliance, the NCUA will expand its review of credit union security programs and annual certifications. This review will take place during safety and soundness examinations for federal credit unions and within the established oversight procedures for state-chartered, federally-insured credit unions. If a credit union fails to establish a security program meeting the regulatory objectives, the NCUA Board could take a variety of administrative actions. The Board could use its cease and desist authority, including its authority to require affirmative action to correct deficiencies in a credit union’s security program. 12 U.S.C. 1786(e) and (f). In addition, the Board could employ its authority to impose civil money penalties. 12 U.S.C. 1786(k). Finding that a credit union is in violation of the requirements of §748.0(b)(2) would typically result only if a credit union fails to establish a written policy or its written policy is insufficient to reasonably address the objectives set out in the proposed regulation.