FFIEC IT Examination Handbook

Operational checklists aligned with FFIEC guidance for NCUA examination readiness

Overall Progress

89%

779 of 876 controls

Compliant

Booklets fully compliant

Gaps Identified

Booklets with open gaps

In Review

Booklets under review

Information Security

In Review

Core security controls, risk assessment, and security program management

View Checklist

Progress

91%

142 / 156 controls

Risk Domains

CIAOperationalCompliance

Primary Roles

InfoSec ManagerITCompliance

Review Schedule

Last: 12/15/2025

Next: 3/15/2026

Architecture, Infrastructure, and Operations

Gaps Identified

Network architecture, system hardening, configuration management, and operational resilience

View Checklist

Progress

77%

98 / 128 controls

Risk Domains

OperationalCIA

Primary Roles

ITInfoSec Manager

Review Schedule

Last: 11/20/2025

Next: 2/20/2026

Development and Acquisition

Compliant

SDLC security, secure coding practices, change management, and system acquisition

View Checklist

Progress

100%

94 / 94 controls

Risk Domains

CIAOperational

Primary Roles

ITInfoSec ManagerVendor Mgmt

Review Schedule

Last: 12/1/2025

Next: 3/1/2026

Business Continuity Management

In Review

BCP/DR planning, testing, incident response, and resilience program management

View Checklist

Progress

90%

78 / 87 controls

Risk Domains

OperationalReputational

Primary Roles

InfoSec ManagerExecIT

Review Schedule

Last: 10/15/2025

Next: 1/15/2026

Outsourcing Technology Services

Gaps Identified

Third-party risk management, vendor due diligence, contracts, and ongoing monitoring

View Checklist

Progress

79%

89 / 112 controls

Risk Domains

OperationalComplianceReputational

Primary Roles

Vendor MgmtInfoSec ManagerCompliance

Review Schedule

Last: 12/10/2025

Next: 3/10/2026

Retail Payment Systems

Compliant

ACH, debit/credit cards, online banking, mobile payments, and fraud prevention

View Checklist

Progress

100%

103 / 103 controls

Risk Domains

OperationalComplianceReputational

Primary Roles

ITComplianceInfoSec Manager

Review Schedule

Last: 12/5/2025

Next: 3/5/2026

Wholesale Payment Systems

In Review

Wire transfers, ACH origination, high-value payments, and authentication controls

View Checklist

Progress

95%

72 / 76 controls

Risk Domains

CIAOperationalReputational

Primary Roles

ITCompliance

Review Schedule

Last: 11/30/2025

Next: 2/28/2026

Supervision of Technology Service Providers

Gaps Identified

Critical vendor oversight, concentration risk, and technology service provider audits

View Checklist

Progress

81%

55 / 68 controls

Risk Domains

OperationalCompliance

Primary Roles

Vendor MgmtComplianceExec

Review Schedule

Last: 10/25/2025

Next: 1/25/2026

Management

In Review

Board oversight, governance structure, strategic planning, and examiner expectations

View Checklist

Progress

92%

48 / 52 controls

Risk Domains

ComplianceReputational

Primary Roles

ExecBoardCompliance

Review Schedule

Last: 12/20/2025

Next: 3/20/2026