Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
The NCUA examines how you manage your vendors. Coverbase helps you show your work.
NCUA guidance puts the responsibility for third-party relationships on the credit union, not the vendor. Coverbase runs the risk assessment, due diligence, and ongoing monitoring that examiners look for.
CoverbaseNCUA | vendor review
NCUA | vendor review
A core processor changes
Member service
Security evidence
New hosting
Agent work
01Read the change
02Recheck the controls
03Assign a reviewer
Review ready for the owner
The credit union decides the next step.
Who NCUA guidance applies to
It applies to federally insured credit unions (Supervisory Letter 07-01 and related due-diligence guidance). The NCUA does not have authority to examine or supervise third-party vendors or CUSOs directly, so the credit union remains ultimately responsible for managing those relationships. The NCUA's separate cyber incident rule (12 CFR Part 748) requires reporting a reportable cyber incident, including one at a third-party provider, within 72 hours.
What NCUA guidance asks of you
- 01
Risk assessment and planning
Understand the risk a relationship carries before you take it on. - 02
Due diligence
Review the vendor's background, business model, financial health, and contract terms. - 03
Monitoring and control
Keep oversight current for the life of the relationship; you stay responsible regardless of vendor involvement. - 04
72-hour cyber incident reporting
Notify the NCUA within 72 hours of reasonably believing a reportable cyber incident occurred, including on notice from a third party.
Defensible vendor diligence on a credit union's budget
You carry the responsibility without the ability to examine vendors yourself. Coverbase gives you the next best thing: thorough, documented diligence.
Evidence gathered for you
SOC reports, financials, and security documentation collected automatically and pre-reviewed for your team.Member data mapped
Know which vendors and CUSOs touch member data and how it's protected.Incident-ready records
Keep the vendor facts on hand for the 72-hour cyber incident clock.Examiner-ready reporting
Produce the documentation NCUA exams expect, on demand.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
NCUA oversight questions
Keep diligence and incident reporting distinct.
Does the 2023 Interagency Guidance for banks replace NCUA guidance?
No. The Federal Reserve, FDIC, and OCC guidance addresses their supervised banks; NCUA publishes guidance for credit unions.
Does every vendor incident require a 72-hour notice?
No. Part 748 applies to reportable cyber incidents. The timing depends on when you reasonably believe you have one or receive a qualifying third-party notice.
Can we use our own diligence criteria?
Yes. We work with the criteria you choose. Your credit union makes the risk and reporting decisions.