Which managed security provider understands FFIEC and NCUA exams? The one whose evidence your examiner can read.

No such credential exists, so a provider that claims one is describing something the regulators do not issue. The NCUA states that it does not approve, endorse, or license any specific products, services, or vendors, and that credit unions remain responsible for verifying that any product, service, or vendor supports their needs. The FFIEC has no certification program for technology service providers. What the FFIEC Supervision of Technology Service Providers booklet tells an institution to review instead is the provider's service-level reports, audits, third-party reviews, internal control testing results, and other equivalent evaluations. Judge a shortlist on that evidence.

ABT is not directly examined by the federal banking agencies. The agencies decide which technology service providers to examine, selecting them on a risk basis under the program the FFIEC describes in its Supervision of Technology Service Providers booklet, and an examined provider's Report of Examination is released only to banks that were already its clients on the examination date, so it is not available to a bank choosing a provider. What that booklet tells a bank to review is the provider's service-level reports, audits, third-party reviews and internal control testing results, and ABT provides each of these: monthly service reporting, a SOC 2 Type 2 report under a mutual non-disclosure agreement, nightly testing of the institution's Microsoft 365 tenant against ABT's security baseline, and a booklet-by-booklet map of ABT's controls to the FFIEC IT Examination Handbook. ABT's standard terms acknowledge that ABT acts as a technology service provider to supervised institutions and commit ABT to cooperate reasonably, through the institution, with a lawful examination or information request concerning the services ABT provides.

Ask for four things, in writing. An independent audit report with its period and criteria stated, such as a SOC 2 Type II report. Monthly service reporting that shows what was monitored, what fired, and what was done about it. A map of the provider's controls to the FFIEC IT Examination Handbook that says which controls the provider runs and which stay with you. And written incident timelines for anything that happened during the period. Both the credit union safeguarding guidelines in 12 CFR 748 Appendix A and the interagency guidelines for banks tell the institution to review audits, summaries of test results, or other equivalent evaluations of its service providers, so these are the documents your examiner expects you to have read.

The automation is. At Guardian Contain and above, Microsoft Defender and Microsoft Entra ID Protection signals trigger pre-authorized automated containment that revokes a compromised session in seconds at any hour, 365 days a year, holidays included. ABT does not operate a staffed 24-hour security operations center. After hours, a two-engineer on-call rotation, a named primary and a documented secondary, both in the United States, answers through the ABT emergency support line. Guardian Respond adds ABT security engineers on covered incidents during business hours, and Guardian Resolve puts a human on the incident at any hour. Ask every provider on your list the same question in the same words: which part runs around the clock, and which part is a person.

At Guardian Contain and above, the containment is pre-authorized, so it does not wait for a phone call. When Microsoft Defender or Microsoft Entra ID Protection detects a risk signal such as compromised credentials or an anomalous sign-in, the affected user's sessions and refresh tokens are revoked through Microsoft Graph, Continuous Access Evaluation interrupts open sessions, and Conditional Access requires multifactor authentication or a password reset at the next sign-in. For credential compromise this happens in seconds. The detection is Microsoft's; the automation and the operating discipline behind it are ABT's. Write the list of pre-authorized actions into the contract with any provider you choose, so nobody is negotiating authority during an incident.

ABT's standard commitment is initial notice without undue delay and no later than 36 hours, and a detailed report within 72 hours, measured from ABT's determination that a confirmed incident affecting client data in ABT's possession or control has occurred. Your own clock is separate. A bank notifies its primary federal regulator no later than 36 hours after it determines a notification incident has occurred, and a federally insured credit union notifies the NCUA no later than 72 hours after it reasonably believes a reportable cyber incident has occurred. Because a bank's ceiling and ABT's standard ceiling are both 36 hours, a bank should write a shorter provider window into the contract, and ABT has agreed shorter windows in individual contracts. A credit union's 72-hour clock can start when a third party notifies it, so the same care applies.

You do, with ABT behind you. The institution owns the relationship with its examiner and owns every decision about notification, and ABT provides the technical facts those decisions rest on. ABT's terms permit examination by the client's federal and state regulators as to the services provided to that client, coordinated with the client where practicable, and during an active regulatory examination ABT cooperates on an expedited basis and makes its compliance reports and security questionnaire responses available. Ask every provider on your list who, by role, picks up the phone when your examiner has a question about their work.

Yes. ABT has completed a structured mapping of its Guardian security policies to the GLBA Safeguards Rule at 16 CFR 314.4: sixty-two policies mapped across its ten top-level requirements, each with the evidencing policy and a classification of what can be verified automatically from tenant data versus what requires management attestation. ABT also maintains a booklet-by-booklet map of ABT's controls to the FFIEC IT Examination Handbook. The booklets in scope for your next examination are scoped with you, because your examiner and your own risk assessment decide which ones matter for your institution this cycle.

ACET is your own measuring tool; the examination is the ISE. The NCUA states that in 2023 it implemented the Information Security Examination procedures to help standardize the examination of credit unions' information security and cybersecurity programs. It describes the Automated Cybersecurity Evaluation Toolbox as a voluntary tool that lets credit unions measure their own cybersecurity preparedness over time, and says the ACET maturity assessment is completely voluntary and introduces no new requirements or expectations. Keep using ACET if it helps your board see progress. Prepare your provider for the ISE.

The FFIEC did not publish a successor of its own. The FDIC told institutions that the FFIEC would remove the Cybersecurity Assessment Tool from its website on August 31, 2025, and named the NIST Cybersecurity Framework 2.0 and the CISA Cybersecurity Performance Goals among the newer government resources. The Federal Reserve's letter on the same statement also lists the Cyber Risk Institute's Cyber Profile and the Center for Internet Security Critical Security Controls. Ask a provider which of those frameworks it maps to, and how it would map to the one your board chooses.

Put three or four providers on the list that each work with banks or credit unions every day, then run the same ten questions past all of them: who watches at 3 AM, what they can do without calling you, who owns incident decisions, how fast they notify you, which independent audit report you can read, how their controls map to the FFIEC IT Examination Handbook, what evidence reaches you monthly, where their people work, which core and digital vendors they know, and what happens when you leave. If your institution runs on Microsoft 365, include ABT: a Tier 1 Microsoft Cloud Solution Provider serving more than 750 financial institutions since 1999, with a SOC 2 Type II attestation and its answers to all ten questions published on this page.

Guardian is priced per user per month on a published ladder. Guardian Foundation, the hardened tenant baseline plus Guardian Security Insights, is included at no additional charge when Microsoft licensing runs through ABT. Guardian Contain is $18, Guardian Respond is $27, and Guardian Resolve is $37 per user per month with licensing through ABT, or $21, $32 and $42 when licensing stays elsewhere. Each paid rung carries a 50-user monthly floor. Microsoft licensing is always its own line at Microsoft's price, and onboarding is quoted as a fixed project price per phase.

Microsoft 365 is the center of it, a scope your examiner can follow from end to end. ABT manages Microsoft 365 tenants and hosts Azure environments, and its security service is built on the Microsoft controls an institution already licenses: Microsoft Entra ID, Microsoft Defender, Microsoft Purview and Microsoft Intune. ABT's engineers also work directly against Jack Henry and Fiserv platforms and their developer interfaces in delivering core integrations. If your shortlist needs someone to run your branch network hardware or your core itself, ask about that scope directly with every provider, including ABT.