Foreword
I've spent twenty years running IT for small and mid-sized organisations, and the same pattern shows up everywhere. The problems that hurt a business are rarely exotic. They're a backup nobody tested, an admin account nobody owns, a server out of support, a licence nobody reviewed. Frameworks describe the destination well, but turning them into specific checks for real systems is where most efforts stall, so the checks never happen.
I put a process in place to close those gaps in the environments I was responsible for, then built Spectra Core so that IT teams and providers could run the same process themselves. This baseline sets out the controls behind that process, openly, so organisations, their IT providers and the bodies that represent them can use it and help improve it.
Christian W. Chu Fook
Founder, Spectra Core
linkedin.com/in/cchufook
Why this edition exists
A credit union holds its members' savings and runs the systems that let them get at their money. Most Caribbean credit unions do this with a small IT team or an outside provider, a core banking system that is either hosted by a vendor or a league or, as often, runs on the credit union's own servers but is managed by the vendor through remote access, a card programme run through a processor, and a handful of ATMs. The board is accountable for the technology risk in all of it, and increasingly has to show a supervisor, an external auditor or a cyber insurer that the risk is managed.
What the general baseline doesn't reach
The general IT Control Baseline covers what every small organisation must get right: access, patching, backups, the network, the server room. A credit union needs all of that and then some. Its most important system, core banking, is not an email platform or a file server, and the checks that matter on it are about dual control, segregation of duties, overrides and controlled change. It is usually managed by someone else, a vendor or a league service bureau, whether it sits in their data centre or in the credit union's own server room. Either way the credit union's risk is only as well managed as that provider's, and where the system is on the credit union's own servers, the split of duties between the two has to be written down and the vendor's remote access has to be controlled, because that access reaches every member account. Its members sign in to online banking from their own devices, so authentication and fraud monitoring reach outside the building. It issues cards, so the card schemes' rules reach it through its processor. It operates ATMs, which are computers standing in public places, stocked with cash. And when something goes wrong, there are notification duties to the regulator and to members that a law firm or an insurance broker does not have.
What this edition does
This edition keeps every general control and its ID, so a credit union, its IT provider and its league work from the same reference as everyone else, and adds what is specific to the sector. Five financial system types are added, and the general controls that apply to them gain standards for them. A third part adds controls for board oversight, providers and outsourcing, member-facing services, payments and cards, and ATMs. A regional annex collects the Caribbean particulars: who supervises credit unions in each territory, the data protection laws that set notification duties, and the operating conditions, from hurricanes to single-provider connectivity, that shape how some controls are met.
The approach is the same as the general baseline. Each control is checked system by system, so a system left out of an assessment shows up as a gap instead of being silently skipped. Recognised frameworks, including NIST CSF 2.0 and the CIS Controls, and the technology risk guidelines published by regional supervisors are used to confirm nothing important is missing, not as the starting point.
It is written for credit union boards and managers, the IT teams and providers who serve them, and the leagues and confederations that set expectations for their members.
How to use this baseline
From controls to standards
A control states what must be true. It doesn't say what to check on a particular system: that is what a standard does. Standards are written for each system type a control applies to, so the same control is checked separately on the email platform, the VPN and the firewall.
ControlWhat must be true, stated once.
StandardThe specific check on each system type the control applies to.
EvidenceWhat the check looks at, and keeps as proof.
GapA standard that isn't met. It gets fixed, or the decision not to fix it is recorded.
Two rules keep the library consistent. Every standard rolls up to a control. And every control that applies to a system type in the environment should have a standard for that system type; where one doesn't, the gap is visible rather than hidden. Controls won't match an audit report line for line, and no framework does: one control becomes several standards, and some standards cover operational practices no security framework asks about.
Reading a control
Each control shows its scope, Organisation-wide when it is met once for the whole organisation or System-specific when it is met for each system type it applies to; the system types; the number of standards behind it today; the evidence that shows it is met; and one or two of the standards that check it. The examples are a sample, not the full set: the complete library of standards is part of Spectra Core, and organisations using the baseline without it can write their own standards for each control, using the examples as a guide. Control IDs begin with SCB, the prefix of Spectra Core's baseline library, and never change. Standard IDs add the system type and a sequence to the control ID: SCB-ACC-03.EML.1 is the multi-factor authentication check on the email and collaboration platform.
System types
EMLEmail and collaboration platform
DIRDirectory and domain
NETNetwork devices: firewalls, switches, wireless
RMTRemote access: VPN and overlay networks
BKPBackup system
RMMIT provider's remote management tool
SRVServers and virtualisation hosts
ENDWorkstations and laptops
WEBMember-facing online services
LOBLine-of-business applications
DMSFile shares and document management
CAMVideo surveillance
TELTelephony
CBSCore banking system
LOSLoan origination and servicing
OLBOnline and mobile banking
CRDCard management and payment switch
ATMATMs and self-service kiosks
How Spectra Core supports the process
The baseline can be run with a spreadsheet and discipline. Spectra Core was built to make the process repeatable for internal IT teams and MSPs, with each role doing the part it is best placed to do.
EngineerKnows the systems. Is assigned standards by area of expertise, carries out the checks, and submits findings with supporting evidence such as screenshots.
Audit ownerUsually the IT manager or director. Sets up the audit, reviews the findings, marks each standard aligned or not aligned, sets risk levels and writes the recommendations.
LeadershipReceives the report, decides what to fix and when, and owns any decision not to.
1. Set upAudit ownerCreate an audit, or reuse a previous one's structure. Select the standards libraries for the parts of the environment being audited, including custom ones, and exclude anything that doesn't apply.
2. AssignAudit ownerAssign standards to engineers by expertise, or every standard to one IT generalist on a small team. Daily email reminders keep outstanding standards moving.
3. CheckEngineerEngineers carry out each check and submit findings with supporting evidence, working with the audit owner inside each standard.
4. ReviewAudit ownerThe audit owner reviews the findings, marks each standard aligned or not aligned, sets its risk level, and writes a recommendation for anything not aligned, with quotes or proposals attached where useful.
5. ReportLeadershipAn AI-generated executive summary heads a report shared securely with leadership, who can filter it by alignment status, impact and risk level, and print it.
Every standard carries a risk level, a review frequency and a plain-language rationale. Audits can be as focused as one area checked monthly or as broad as a full annual pass, so leadership sees a current picture rather than an annual snapshot. On larger teams the audit owner reviews the engineers' work; on small ones a single person can run the whole audit. The baseline can be used with or without Spectra Core.
More detail on what Spectra Core tracks and how it works: spectracore.io/how-it-works
Adoption and co-authorship
This edition is meant to be shared. It is licensed under CC BY 4.0, so no permission is needed to adopt or adapt it, only credit to Spectra Core. Credit union leagues, confederations and supervisors are invited to adopt it for their members, adapt it into a national edition, or co-author future versions. National editions keep the same control IDs, so a credit union, its IT provider and its league can work from a common reference, and the regional annex is the natural place for a league to add its territory's particulars. Spectra Core publishes and maintains the baseline; to discuss adoption or co-authorship, contact Spectra Core through spectracore.io.
What this edition covers
This is the first Credit Union Edition. It carries the 42 controls of the general baseline unchanged in meaning, adds five financial system types, and adds 29 sector controls in Part 3. The general controls are backed by standards in use in live environments. The standards added for credit unions, for the financial system types and the sector controls, are being built into the library and have not yet been run in a live credit union environment. Where one sits under a general control it is marked Credit union, so a reader can tell the edition's additions from the general baseline.
Part 1 · Security controls
ACC · 5 controls
Identity and access
Who can get in, how they prove who they are, and who has admin rights.
SCB-ACC-01Access is removed promptly when it is no longer needed: leavers' accounts are disabled, and stale accounts, remote access users and overlay network members are reviewed on a set cycle. System-specific System types DIR, EML, RMT, CBS Standards 4 + 1 credit union
Evidence Leavers matched to disable dates; dated reviews of stale accounts and remote access users.
Example standards
SCB-ACC-01.EML.1Are past employees' email accounts disabled?SCB-ACC-01.DIR.1Are stale directory accounts disabled?SCB-ACC-01.RMT.1Does everyone with VPN access still work for the credit union?SCB-ACC-01.CBS.1Are leavers' core banking users disabled on their last working day?Credit union
SCB-ACC-02The organisation approves who has access: group memberships, management console access and application permissions are reviewed and signed off. System-specific System types DIR, EML, NET Standards 4
Evidence The organisation's signed approval of group memberships, console access and application permissions.
Example standards
SCB-ACC-02.DIR.1Has the credit union approved the users in each directory group?SCB-ACC-02.NET.1Can only authorised users reach the management consoles of network devices?
SCB-ACC-03Multi-factor authentication is enforced for every user on email and cloud services, and on all remote access. System-specific System types EML, RMT, CBS, RMM Standards 2 + 2 credit union
Evidence MFA status for every user on each email, cloud and remote access service.
Example standards
SCB-ACC-03.EML.1Is multi-factor authentication enabled for every user on the email and collaboration platform?SCB-ACC-03.RMT.1Does the VPN enforce multi-factor authentication?SCB-ACC-03.CBS.1Is multi-factor authentication enforced for staff access to the core banking system?Credit unionSCB-ACC-03.RMM.1Is multi-factor authentication enforced on every IT provider and vendor account with remote access?Credit union
SCB-ACC-04Administrative rights are limited to named administrators: users work without local admin rights, default administrator accounts are disabled, and every admin account belongs to one person. System-specific System types DIR, EML, END, NET, CBS Standards 5 + 1 credit union
Evidence Accounts with admin rights, each named to one person; default admin accounts disabled.
Example standards
SCB-ACC-04.END.1Do users work without local administrator rights on their computers?SCB-ACC-04.DIR.2Is the built-in domain Administrator account disabled?SCB-ACC-04.CBS.1Does each vendor engineer use a named account on the core banking system, with no shared vendor login?Credit union
SCB-ACC-05Administrative and device credentials are strong, rotated on a set cycle and recorded securely: domain, local administrator, out-of-band management, network device and cloud administrator accounts. System-specific System types DIR, EML, NET, SRV Standards 7
Evidence Credential register showing rotation dates and secure storage for each admin and device account.
Example standards
SCB-ACC-05.SRV.2Are local administrator passwords on servers and workstations complex, unique, rotated and recorded?SCB-ACC-05.NET.1Is the admin password on each network device rotated and recorded?
PLT · 4 controls
Platform security
Supported, patched, consistently configured and protected systems.
SCB-PLT-01Systems run supported versions: operating systems, directory functional level, workstation hardware, telephony and line-of-business applications all have active vendor support. System-specific System types DIR, END, LOB, SRV, TEL, CBS, ATM Standards 5 + 1 credit union
Evidence Versions and vendor support status for each system.
Example standards
SCB-PLT-01.SRV.1Do all servers run a currently supported operating system?SCB-PLT-01.LOB.1Does every line-of-business application have a vendor support agreement?SCB-PLT-01.CBS.1Is the core banking system on a release the vendor still supports?Credit union
SCB-PLT-02Security updates are applied on a set cycle and measured: every device is in the patching policy, patch levels meet a set minimum, and firmware, agents and clients are current. System-specific System types CAM, LOB, NET, RMM, RMT, SRV, CBS, ATM Standards 8 + 1 credit union
Evidence Patch compliance against the set minimum; firmware, agent and client versions.
Example standards
SCB-PLT-02.SRV.2Is every Windows machine included in the patching policy?SCB-PLT-02.NET.1Is network device firmware on the latest stable release?SCB-PLT-02.ATM.1Is every ATM included in the patching policy and at the set patch level?Credit union
SCB-PLT-03A standard security configuration is enforced and checked for drift. System-specific System types DIR, END Standards 2
Evidence The configuration baseline and the latest drift check.
Example standards
SCB-PLT-03.END.1Are device management policies enforced on every computer?SCB-PLT-03.DIR.1Is reversible password encryption disabled in the directory?
SCB-PLT-04Endpoint protection (endpoint detection and response, or managed anti-malware) runs on every workstation and laptop with current definitions. Organisation-wide System types END Standards 2
Evidence Console report showing coverage and definition dates for every workstation and laptop.
Example standards
SCB-PLT-04.END.1Is endpoint protection deployed to every workstation and laptop?SCB-PLT-04.END.2Are endpoint protection definitions up to date?
NET · 3 controls
Network security
Segmentation, wireless and remote connections.
SCB-NET-01The network is segmented: corporate, guest, voice, remote access, surveillance, audio-visual and ATM traffic run on separate networks. Organisation-wide System types NET Standards 6 + 1 credit union
Evidence Network segment map showing each traffic type separated.
Example standards
SCB-NET-01.NET.2Is public Wi-Fi on its own network segment?SCB-NET-01.NET.4Is video surveillance on its own network segment?SCB-NET-01.ORG.7Do ATMs sit on their own network, separate from staff and guest networks?Credit union
SCB-NET-02Wireless networks use current encryption, and guest wireless is isolated from the corporate network. Organisation-wide System types NET Standards 2
Evidence Wireless configuration showing encryption and guest isolation.
Example standards
SCB-NET-02.NET.1Are public wireless networks on a separate subnet, firewalled from the corporate network?SCB-NET-02.NET.2Do private wireless networks use WPA3 encryption?
SCB-NET-03Remote access and site-to-site links use modern protocols and strong, rotated keys, and overlay networks are private. System-specific System types RMT Standards 4
Evidence Remote access and site-to-site configuration: protocol, key rotation dates, overlay network settings.
Example standards
SCB-NET-03.RMT.1Does the VPN use a modern protocol?SCB-NET-03.RMT.3Are site-to-site VPN keys rotated?
DAT · 2 controls
Data protection
Who can reach shared data, and the certificates that protect services.
SCB-DAT-01Shared data follows least privilege: file share and collaboration permissions are documented, audited and approved by the credit union. System-specific System types DMS, EML Standards 4
Evidence Permission documentation, the latest audit and the credit union's approval.
Example standards
SCB-DAT-01.DMS.3Has the credit union approved file share permissions?SCB-DAT-01.EML.1Has leadership approved the permissions on collaboration spaces?
SCB-DAT-02Certificates that protect services are recorded with their expiry dates and renewed before they lapse. System-specific System types WEB, OLB Standards 1 + 1 credit union
Evidence Certificate register with expiry dates and renewal records.
Example standards
SCB-DAT-02.WEB.1Are certificates recorded with their expiry dates?SCB-DAT-02.OLB.1Is the online banking certificate recorded with its expiry date and renewed before it lapses?Credit union
BKR · 5 controls
Backup and recovery
Backups that exist, work, sit off site, and recover within agreed times.
SCB-BKR-01Every system holding important data is backed up: servers, endpoints with critical data, cloud email and files, line-of-business data and device configurations. System-specific System types CAM, EML, END, LOB, NET, SRV, CBS, LOS Standards 11 + 1 credit union
Evidence Backup coverage showing each system and its last successful backup.
Example standards
SCB-BKR-01.SRV.3Are mission-critical servers protected by the backup system?SCB-BKR-01.EML.1Is every user included in the email and file backup?SCB-BKR-01.CBS.1Is the core banking database backed up at least daily, with transaction logs between backups?Credit union
SCB-BKR-02Backups are monitored and verified: recent jobs succeed, verification runs, and alerts are cleared. System-specific System types EML, END, SRV Standards 6
Evidence Backup job history, verification results and alert status.
Example standards
SCB-BKR-02.SRV.3Did the latest backup verification succeed?SCB-BKR-02.EML.1Have email and file backups succeeded on each of the last three days?
SCB-BKR-03Backups are kept off site for the agreed retention: copies replicate to a geographically separate location and retention meets the credit union's requirements. Organisation-wide System types BKP, EML, SRV Standards 3
Evidence Replication status to the off-site location; retention settings.
Example standards
SCB-BKR-03.BKP.1Are backups held in a geographically separate location?
SCB-BKR-04Recovery objectives are agreed with management and proven: recovery time and point objectives are defined, the recovery environment matches production, and a full failover shows systems recover within the objective. Organisation-wide System types BKP, CBS, OLB Standards 3 + 1 credit union
Evidence Agreed recovery objectives; the latest failover test showing recovery within them.
Example standards
SCB-BKR-04.ALL.1Are recovery time and recovery point objectives defined and agreed with management?SCB-BKR-04.BKP.1Has a full failover test recovered systems within the recovery time objective?SCB-BKR-04.CBS.1Has recovery of the core banking system been tested against its recovery time objective in the last twelve months?Credit union
SCB-BKR-05Critical processes can continue manually when a line-of-business system is offline. Organisation-wide System types LOB, CBS Standards 1 + 1 credit union
Evidence Documented manual procedures for each critical process.
Example standards
SCB-BKR-05.LOB.1Is there a manual process to keep working if a line-of-business system is offline?SCB-BKR-05.CBS.1Can tellers continue serving members when the core banking system is offline, with transactions posted afterwards?Credit union
AVL · 2 controls
Availability
Redundancy and spares so a single failure doesn't stop service to members.
SCB-AVL-01Critical infrastructure has no single point of failure: redundant directory servers, redundant storage, healthy clusters and dual internet connections. System-specific System types DIR, NET, SRV, CBS Standards 5 + 1 credit union
Evidence Redundancy status for directory servers, storage, clusters and internet connections.
Example standards
SCB-AVL-01.DIR.1Is a second domain controller in place and replicating?SCB-AVL-01.NET.1Does the internet connection fail over to a second provider?SCB-AVL-01.CBS.1Does the core banking system have no single point of failure in its servers, storage and database?Credit union
SCB-AVL-02Spare network hardware for each device type is kept on site. System-specific System types NET Standards 4
Evidence Spares list for each network device type, with location.
Example standards
SCB-AVL-02.NET.1Is a spare router kept on site?SCB-AVL-02.NET.2Is a spare switch kept on site?
PHY · 4 controls
Physical and environmental
The rooms, racks, cameras, access control and power that physical security depends on.
SCB-PHY-01Server rooms and racks are secured: equipment sits in dedicated rooms, racks are locked with keys controlled, and physical access rights are reviewed. Organisation-wide System types Organisation-wide Standards 4
Evidence Room and rack inspection; key holder list; dated review of physical access rights.
Example standards
SCB-PHY-01.ORG.3Are server racks locked, with keys secured?SCB-PHY-01.ORG.4Are physical access rights reviewed?
SCB-PHY-02Physical security systems work and are watched: cameras and recorders are online with adequate coverage, access-control systems are operational, and their logs are reviewed. Organisation-wide System types CAM, ATM Standards 5 + 1 credit union
Evidence Camera, recorder and access-control status; coverage check; log review record.
Example standards
SCB-PHY-02.CAM.2Are all cameras online?SCB-PHY-02.ORG.1Are access-control logs reviewed?SCB-PHY-02.ATM.1Do cameras cover each ATM's fascia and surroundings, with recordings kept for the required period?Credit union
SCB-PHY-03Critical equipment is protected from power loss: servers have enough UPS runtime and shut down cleanly, and a working generator is available. Organisation-wide System types Organisation-wide Standards 5
Evidence UPS runtime and shutdown test; generator test record.
Example standards
SCB-PHY-03.ORG.1Do UPS units give at least 15 minutes of runtime?SCB-PHY-03.ORG.5Is the generator working?
SCB-PHY-04Server and rack rooms are kept cool enough for the equipment. Organisation-wide System types Organisation-wide Standards 2
Evidence Temperature readings for each server and rack room.
Example standards
SCB-PHY-04.ORG.1Is the server room kept at 24°C or below?
AST · 1 control
Asset management
Knowing which devices exist and which hold critical data.
SCB-AST-01Devices are fully inventoried and managed: every computer appears in both remote management and device management, and endpoints holding critical data are recorded. Organisation-wide System types END Standards 2
Evidence Device lists from remote management and device management, reconciled; endpoints holding critical data recorded.
Example standards
SCB-AST-01.END.1Does every computer appear in both remote management and device management?
INC · 2 controls
Incident and problem management
A plan for incidents, and learning from recurring problems.
SCB-INC-01An approved, signed incident response plan exists. Organisation-wide System types Organisation-wide Standards 1 + 1 credit union
Evidence Signed incident response plan with its approval date.
Example standards
SCB-INC-01.ORG.1Is there an approved, signed incident response plan?SCB-INC-01.ORG.2Has the incident response plan been exercised in the last twelve months, including the regulator and member notification steps?Credit union
SCB-INC-02Tickets are reviewed for recurring issues, and their root causes are addressed. Organisation-wide System types Organisation-wide Standards 1
Evidence Dated ticket review with recurring issues and the actions taken.
Example standards
SCB-INC-02.ORG.1Are tickets reviewed for recurring issues and their root causes?
PEO · 1 control
People
What users are told about working safely.
SCB-PEO-01Users are reminded of safe working practices, such as where to save files and why it matters. Organisation-wide System types Organisation-wide Standards 1 + 1 credit union
Evidence Record of reminders sent to users.
Example standards
SCB-PEO-01.ORG.1Are users reminded where to save files?SCB-PEO-01.ORG.2Have staff who initiate or approve payments completed fraud awareness training in the last twelve months?Credit union
MON · 1 control
Security monitoring
Security monitoring by a dedicated service.
SCB-MON-01Security events on cloud services are monitored by a dedicated service. System-specific System types EML, CBS, OLB Standards 1 + 2 credit union
Evidence Monitoring service reports covering the period.
Example standards
SCB-MON-01.EML.1Is the email and collaboration platform monitored by a dedicated security service?SCB-MON-01.OLB.1Are security events on online banking monitored by a dedicated service?Credit unionSCB-MON-01.CBS.1Are core banking and online banking logs retained for the period the supervisor or card schemes require?Credit union
Part 2 · Operational practices
STD · 3 controls
Standardisation
Consistent naming, platforms and structures.
SCB-STD-01Systems and devices follow a documented naming convention. Operational System-specific System types NET, RMM Standards 2
Evidence Device and system lists compared with the documented convention.
Example standards
SCB-STD-01.NET.1Do devices follow the naming convention?
SCB-STD-02Hardware and platforms are standardised on approved, supported products. Operational System-specific System types EML, NET Standards 3
Evidence Inventory compared with the approved product list.
Example standards
SCB-STD-02.NET.1Are network devices standardised on the approved platform?
SCB-STD-03Directory, file and collaboration structures follow the credit union's departments. Operational System-specific System types DIR, DMS, EML Standards 5
Evidence Structures compared with the current department list.
Example standards
SCB-STD-03.DIR.2Is there a directory group for each department?
DOC · 1 control
Documentation
Documentation that lets anyone understand and recover the environment.
SCB-DOC-01IT documentation is complete and current: environment summary, server roles, applications, licences and install media. Operational Organisation-wide System types Organisation-wide Standards 5 + 1 credit union
Evidence Environment summary with its last-updated date; server, application, licence and install-media records.
Example standards
SCB-DOC-01.ORG.5Is the environment summary documented and current?SCB-DOC-01.ORG.4Are install media and licences recorded?SCB-DOC-01.ORG.6For each system the vendor manages on the credit union's own servers, is it written down which tasks the vendor does and which the credit union does?Credit union
CST · 2 controls
Licensing and cost
Licensing that holds up, and costs that are reviewed.
SCB-CST-01Software and services are properly licensed, with licence details recorded. Operational Organisation-wide System types Organisation-wide Standards 2
Evidence Licence records reconciled with installations and subscriptions.
Example standards
SCB-CST-01.ORG.1Is all office software legitimately licensed?
SCB-CST-02Recurring IT costs and subscriptions are reviewed and right-sized. Operational Organisation-wide System types Organisation-wide Standards 3
Evidence Dated review of recurring costs, with the changes made.
Example standards
SCB-CST-02.ORG.2Are connectivity invoices reviewed?SCB-CST-02.ORG.3Are endpoint licences matched to the number of users?
CAP · 2 controls
Capacity and health
Room to grow, and no errors quietly accumulating.
SCB-CAP-01Systems have capacity headroom and are free of recurring errors. Operational System-specific System types BKP, NET, SRV Standards 5
Evidence Capacity and error reports, with follow-up on anything outstanding.
Example standards
SCB-CAP-01.BKP.2Is backup storage below 80% full?SCB-CAP-01.NET.1Is the internet connection sized for the credit union?
SCB-CAP-02Core network services are correctly configured and kept tidy. Operational System-specific System types DIR, NET Standards 3
Evidence Dated checks of DNS, forwarders and WAN configuration.
Example standards
SCB-CAP-02.DIR.2Are stale DNS records removed?
FAC · 2 controls
Facilities
Server rooms and racks that are labelled, clean and documented.
SCB-FAC-01Server rooms and racks are labelled, clean and photographed. Operational Organisation-wide System types Organisation-wide Standards 6
Evidence Current photos and labelling checks for each server room and rack.
Example standards
SCB-FAC-01.ORG.1Are cables in server rooms labelled?
SCB-FAC-02Equipment runs on the correct electrical supply. Operational Organisation-wide System types Organisation-wide Standards 1
Evidence Electrical supply check against equipment requirements.
Example standards
SCB-FAC-02.ORG.1Is equipment on the electrical supply it needs?
SVC · 2 controls
Service quality
Issues tracked to resolution, and critical services under control.
SCB-SVC-01Open issues are tracked to resolution, with nothing long-standing. Operational Organisation-wide System types Organisation-wide Standards 1
Evidence Open issues list with age and owner; nothing past its target date.
Example standards
SCB-SVC-01.ORG.1Are there any long-standing open issues?
SCB-SVC-02Domain names and DNS zones are under controlled, documented management. Operational Organisation-wide System types Organisation-wide Standards 1
Evidence Registrar and DNS account list with named owners and renewal dates.
Example standards
SCB-SVC-02.ORG.1Are domain names and DNS zones under controlled, documented management?
Part 3 · Financial sector controls
GOV · 3 controls
Board oversight
What the board approves, receives and decides about technology risk.
SCB-GOV-01The board approves the information security policy at least annually, and the approval is minuted. Organisation-wide System types Organisation-wide Standards 2
Evidence The signed policy with its approval date; the board minutes recording it.
Example standards
SCB-GOV-01.ORG.1Has the board approved the current information security policy within the last twelve months?SCB-GOV-01.ORG.2Do the board minutes record the approval and any changes requested?
SCB-GOV-02A technology risk assessment is carried out at least annually and presented to the board. Organisation-wide System types Organisation-wide Standards 1
Evidence The dated assessment; the board paper or minute showing it was presented.
Example standards
SCB-GOV-02.ORG.1Has a technology risk assessment been carried out and presented to the board in the last twelve months?
SCB-GOV-03The board receives a technology risk report on a set cycle covering audit results, open gaps, incidents and dependence on single providers, and its decisions and accepted risks are recorded. Organisation-wide System types Organisation-wide Standards 2
Evidence Dated reports to the board; minutes recording decisions, deadlines and risk acceptances with the name of who accepted each.
Example standards
SCB-GOV-03.ORG.1Has the board received a technology risk report in the current cycle, and does it name the member services that depend on a single provider?SCB-GOV-03.ORG.2Is every accepted risk recorded with who accepted it and when it will be reviewed?
TPR · 5 controls
Providers and outsourcing
The organisations whose failure, breach or exit becomes the credit union's: core banking, cards, ATMs, telecoms, cloud and the IT provider.
SCB-TPR-01Every provider that runs a system or holds member data is on a register, with its contract, the data it holds, how critical it is to member service, and a named owner inside the credit union. Organisation-wide System types Organisation-wide Standards 2
Evidence The provider register with contract dates, data held, criticality and owner for each entry.
Example standards
SCB-TPR-01.ORG.1Is there a register of every provider that runs a system or holds member data?SCB-TPR-01.ORG.2Does each critical provider have a named owner inside the credit union?
SCB-TPR-02Due diligence is done and approved by management before a critical provider is contracted, covering its security, continuity arrangements, financial standing, where member data will be held and who its subcontractors are. Organisation-wide System types Organisation-wide Standards 1
Evidence A due diligence file for each critical provider; management's approval record.
Example standards
SCB-TPR-02.ORG.1Was due diligence completed and approved before each critical provider was contracted?
SCB-TPR-03Contracts with critical providers set out their security duties, notification of incidents within a fixed time, where member data is held and how it is returned and deleted on exit, the credit union's right to assurance or audit, and service levels. Organisation-wide System types Organisation-wide Standards 2
Evidence A contract clause checklist completed for each critical provider.
Example standards
SCB-TPR-03.ORG.1Does the core banking contract require the provider to notify the credit union of an incident within a fixed time?SCB-TPR-03.ORG.2Does each critical contract require return and deletion of member data when it ends?
SCB-TPR-04Each critical provider is reviewed at least annually: its independent assurance report or equivalent is obtained and read, and incidents in the period are reviewed with it. Organisation-wide System types Organisation-wide Standards 2
Evidence The dated review of each provider's assurance report; the provider incident log with the review notes.
Example standards
SCB-TPR-04.ORG.1Has the core banking provider's assurance report been obtained and reviewed in the last twelve months?SCB-TPR-04.ORG.2Were the provider's incidents in the period reviewed with the provider, with the outcome recorded?
SCB-TPR-05Each critical provider has a tested exit plan: what the credit union does if the provider fails or is replaced, with member data held or exportable in a usable form. Organisation-wide System types Organisation-wide Standards 2
Evidence An exit plan per critical provider; the most recent data export and its date; the test record.
Example standards
SCB-TPR-05.ORG.1Could member account data be retrieved in a usable form if the core banking provider stopped operating?SCB-TPR-05.ORG.2Has the exit plan for each critical provider been tested or walked through in the last twelve months?
MBR · 6 controls
Member-facing services
Online and mobile banking, fraud monitoring, and what members and the regulator are told.
SCB-MBR-01Members sign in to online and mobile banking with multi-factor authentication. System-specific System types OLB Standards 1
Evidence Multi-factor authentication enforced for every member login, with no exceptions by member type.
Example standards
SCB-MBR-01.OLB.1Is multi-factor authentication required for every member login to online and mobile banking?
SCB-MBR-02High-risk actions in online and mobile banking, such as adding a payee, raising a limit or changing contact details, require a second verification after sign-in. System-specific System types OLB Standards 1
Evidence Step-up verification configured for each listed action.
Example standards
SCB-MBR-02.OLB.1Do new payees, limit increases and contact detail changes require a second verification?
SCB-MBR-03Member login and transaction activity is monitored for fraud, with alerts routed to a named owner and acted on. System-specific System types OLB, CBS Standards 2
Evidence The alert rules; the named owner; a log of alerts and the action taken.
Example standards
SCB-MBR-03.OLB.1Are login and transaction fraud alerts routed to a named owner?SCB-MBR-03.CBS.1Were the fraud alerts in the period acted on, with the action recorded?
SCB-MBR-04Members are notified of logins from new devices and of large or unusual transactions. System-specific System types OLB Standards 1
Evidence The notification rules; samples of member notifications.
Example standards
SCB-MBR-04.OLB.1Are members notified of logins from new devices and of large or unusual transactions?
SCB-MBR-05Incidents affecting member data or member services are reported to the regulator and to affected members within the required time, under a written procedure with named owners and prepared templates. Organisation-wide System types Organisation-wide Standards 2
Evidence The incident response plan's notification section with time limits, regulator contacts and templates; records of past notifications.
Example standards
SCB-MBR-05.ORG.1Does the incident response plan say who notifies the regulator, within what time, and how?SCB-MBR-05.ORG.2Are member notification templates written and approved in advance?
SCB-MBR-06Member-facing online services are tested for vulnerabilities by an independent party at least annually and after major changes, and the findings are fixed or formally accepted. System-specific System types OLB, WEB Standards 2
Evidence Dated test reports; a record of each finding fixed or accepted.
Example standards
SCB-MBR-06.OLB.1Has online and mobile banking had an independent penetration test in the last twelve months?SCB-MBR-06.WEB.1Have the findings from the last test of the public website been fixed or accepted in writing?
PAY · 8 controls
Payments, cards and core banking
Payment instructions, card data, the systems that hold accounts and move money, and the vendors who reach into them.
SCB-PAY-01Payment instructions and changes to payee details received by email, phone or message are verified by a call back to a number already on file before anything is executed. Organisation-wide System types Organisation-wide Standards 2
Evidence The written call-back procedure; a sample of payments and payee changes with their call-back records.
Example standards
SCB-PAY-01.ORG.1Is every transfer instruction received electronically verified by a call back to a number on file before it is executed?SCB-PAY-01.ORG.2Are changes to member or supplier banking details verified by call back before they take effect?
SCB-PAY-02Outgoing payments above a set limit require dual control: one person initiates and a different person approves, with limits set per role. System-specific System types CBS, OLB Standards 2
Evidence Dual-control settings and limits on the core banking and online banking platforms; a sample of payments showing two different approvers.
Example standards
SCB-PAY-02.CBS.1Does every outgoing transfer above the set limit require approval by a second person?SCB-PAY-02.OLB.1Are business members' online payments above the set limit held for a second approver?
SCB-PAY-03Card scheme obligations are known and met: a written statement sets out which card activities and systems the credit union runs itself and which its processor, league or sponsor runs, every party that handles its card data holds a current PCI DSS attestation, and the credit union validates its own in-scope systems in the way its sponsor requires. Organisation-wide System types Organisation-wide Standards 2
Evidence The scoping statement; each processor's or league's attestation with its date; the credit union's own validation, where its sponsor requires one.
Example standards
SCB-PAY-03.ORG.1Is there a written statement of which systems and parties hold or handle the credit union's card numbers, and what each is responsible for?SCB-PAY-03.ORG.2Does every processor, league or switch that handles the credit union's card data hold a current PCI DSS attestation of compliance?
SCB-PAY-04Full card numbers stay in the processor's card system: the core banking system stores truncated or tokenised numbers, files exchanged with the processor travel over an encrypted channel rather than email, and none sit in file shares, mailboxes or ATM journals. System-specific System types CBS, EML, DMS, ATM Standards 2
Evidence The core banking system's card number storage setting; the channel used for card request and settlement files; a search of file shares, email and ATM electronic journals for card numbers.
Example standards
SCB-PAY-04.CBS.1Does the core banking system store only truncated or tokenised card numbers?SCB-PAY-04.EML.1Are card request lists and settlement files exchanged with the processor sent over an encrypted channel rather than by email?
SCB-PAY-05Access to core banking, loan and card systems matches each person's duties: roles are defined so that no one both initiates and approves the same transaction, and access is reviewed against current staff on a set cycle. System-specific System types CBS, LOS, CRD Standards 2
Evidence The role matrix; dated access reviews against current staff.
Example standards
SCB-PAY-05.CBS.1Has core banking user access been reviewed against current staff and their roles in the last quarter?SCB-PAY-05.LOS.1Can anyone both originate and approve the same loan on the loan system?
SCB-PAY-06Privileged actions on core banking, loan and card systems, such as overrides, reversals and parameter changes, are logged and reviewed by someone who cannot make them. System-specific System types CBS, LOS, CRD Standards 2
Evidence The privileged action log; the dated reviews and who carried them out.
Example standards
SCB-PAY-06.CBS.1Are overrides, reversals and parameter changes on the core banking system logged?SCB-PAY-06.CBS.2Is the privileged action log reviewed on a set cycle by someone who cannot make those changes?
SCB-PAY-07Vendor remote access to financial systems is enabled only for scheduled or requested work and disabled afterwards. System-specific System types CBS, LOS, CRD, ATM Standards 2
Evidence The record of when vendor access was enabled and disabled against the work requested.
Example standards
SCB-PAY-07.CBS.1Is the vendor's remote access to the core banking system enabled only for scheduled or requested work, and disabled afterwards?SCB-PAY-07.ATM.1Is the ATM servicer's remote access enabled only for scheduled work?
SCB-PAY-08Every vendor session on a financial system is logged, and the log is reviewed. System-specific System types CBS, LOS, CRD, ATM Standards 1
Evidence Session logs for the period; the dated review.
Example standards
SCB-PAY-08.CBS.1Is every vendor session on the core banking system logged, with the log reviewed?
ATM · 7 controls
ATMs and self-service
Cash machines and kiosks: the hardware, the network, the cash and the people who open them.
SCB-ATM-01ATMs are hardened against offline attack: hard disks are encrypted and booting from USB or other removable media is disabled. System-specific System types ATM Standards 2
Evidence The ATM inventory with disk encryption status and boot settings for each machine.
Example standards
SCB-ATM-01.ATM.1Is each ATM's hard disk encrypted?SCB-ATM-01.ATM.2Is booting from USB or other removable media disabled on each ATM?
SCB-ATM-02Communications between each ATM and the host are encrypted end to end with current protocols. System-specific System types ATM Standards 1
Evidence The encryption settings between each ATM and the host.
Example standards
SCB-ATM-02.ATM.1Is traffic between each ATM and the host encrypted with current protocols?
SCB-ATM-03Anti-skimming devices are fitted, and each ATM is inspected for skimming devices and tampering on a set schedule, with the inspection recorded. System-specific System types ATM Standards 2
Evidence The anti-skimming fit list; the inspection log per ATM.
Example standards
SCB-ATM-03.ATM.1Is an anti-skimming device fitted to each ATM?SCB-ATM-03.ATM.2Is each ATM inspected for skimming devices and tampering on the set schedule, with the inspection recorded?
SCB-ATM-04Each ATM's safe and top box are alarmed, and the alarms are tested on a set schedule. System-specific System types ATM Standards 1
Evidence Alarm configuration per ATM; alarm test records.
Example standards
SCB-ATM-04.ATM.1Are the safe and top box of each ATM alarmed, with a test recorded in the period?
SCB-ATM-05Cash replenishment and servicing of an ATM need two people, and both are recorded each time. System-specific System types ATM Standards 1
Evidence Dual-control records for each replenishment and service visit.
Example standards
SCB-ATM-05.ATM.1Do cash replenishment and servicing require two people, with both recorded each time?
SCB-ATM-06ATM keys, safe combinations and encryption key components are held by named custodians, encryption keys are loaded under dual control, and all are changed when a custodian leaves. System-specific System types ATM Standards 2
Evidence The key, combination and key-component register with custodian names and change dates against leaver dates; key loading records showing two custodians.
Example standards
SCB-ATM-06.ATM.1Are safe combinations changed when a custodian leaves?SCB-ATM-06.ATM.2Are ATM encryption key components held by separate named custodians and loaded under dual control?
SCB-ATM-07Fault, out-of-cash and tamper alerts from each ATM reach a named person at any hour. System-specific System types ATM Standards 1
Evidence Alert routing to named people; a sample of alerts with response times.
Example standards
SCB-ATM-07.ATM.1Are ATM tamper and fault alerts delivered to a named person around the clock?
Annex
Caribbean regional notes
The controls in this baseline do not change from one territory to another. What changes is who a credit union answers to, which laws set its notification duties, and the conditions under which some controls have to be met. This annex collects those particulars for the English-speaking Caribbean. A league adopting this edition is invited to replace it with a page for its own territory.
Who supervises credit unions
Credit unions in the region are registered under a Co-operative Societies Act or a dedicated credit union law, and supervised by a registrar, a financial services authority or the central bank, depending on the territory. Arrangements change, so the current supervisor should be confirmed with the league before it is relied on.
| Territory | Supervisor | Principal legislation |
|---|
| Antigua and Barbuda | Financial Services Regulatory Commission | Co-operative Societies Act |
| The Bahamas | Central Bank of The Bahamas | Bahamas Co-operative Credit Unions Act, 2015 |
| Barbados | Financial Services Commission | Co-operative Societies Act |
| Belize | Central Bank of Belize | Credit Unions Act |
| Cayman Islands | Cayman Islands Monetary Authority | Co-operative Societies Act |
| Dominica | Financial Services Unit | Co-operative Societies Act |
| Grenada | Grenada Authority for the Regulation of Financial Institutions | Co-operative Societies Act |
| Guyana | Chief Co-operative Development Officer | Co-operative Societies Act |
| Jamaica | Registrar of Co-operative Societies, with the Bank of Jamaica for prudential supervision | Co-operative Societies Act; Bank of Jamaica Act |
| St Kitts and Nevis | Financial Services Regulatory Commission | Co-operative Societies Act |
| Saint Lucia | Financial Services Regulatory Authority | Co-operative Societies Act |
| St Vincent and the Grenadines | Financial Services Authority | Co-operative Societies Act |
| Trinidad and Tobago | Commissioner for Co-operative Development, with prudential supervision by the Central Bank of Trinidad and Tobago proposed | Co-operative Societies Act |
Where a supervisor has published technology risk, cyber security or business continuity guidelines for the institutions it supervises, the controls in this baseline can be mapped to them by the credit union or its league. The baseline does not claim to satisfy any of them.
Data protection and breach notification
Most territories now have a data protection law, and several require notification of a personal data breach to the data protection authority, and in some cases to the people affected, within a fixed number of days. Where the law is in force the window is short, measured in days rather than weeks, which is why control SCB-MBR-05 asks for owners, time limits and templates to be settled in advance rather than worked out during an incident. The current requirement for each territory, and whether the law is yet in force, should be confirmed with the league or counsel. A credit union that is part of a group, or that uses a processor in another territory, may also be bound by that territory's law through its contracts.
Cards, payments and PCI DSS
PCI DSS applies through contract, not legislation. Visa and Mastercard bind the institutions that are their members, those members bind the processors and sponsored issuers they bring in, and the duty reaches a credit union for whatever systems and processes of its own store, process or transmit card numbers. The schemes require every issuer to comply, but an issuer that does not run its own card processing is generally not asked to validate its compliance to the scheme; what it must do is make sure every third party handling its card data is registered and validated. So the credit union's first duty is to know who those parties are and hold their attestations, and its sponsor decides what, if anything, it must show about its own systems.
Who they are depends on the model, and the region has four:
| Model | Who runs what | Where card numbers reach the credit union |
|---|
| Processor-issued | A regional processor runs the card management system, authorisation, embossing and PIN handling, usually drives the ATMs, and the cards are issued under a scheme membership the processor or a sponsor bank holds. The core banking system posts transactions through an interface. | The card-to-account link in the core banking system, settlement and dispute files, card request lists sent to the processor, instant-issue stations, ATM electronic journals, member service screens. |
| League switch | The league operates a debit switch and card service for its member credit unions, in the processor's place. | As above, with the league in the processor's place. |
| Self-run | A larger credit union runs its own card host or switch, connected to a national switch as a licensee or directly to the schemes. | Everywhere: the credit union is the processor and may itself be required to validate. |
| Direct to schemes | Where there is no national switch, or it has closed, debit transactions run over the international scheme networks through a processor. | As for the processor-issued model. |
For all but the self-run model the practical strategy is scope reduction: full card numbers stay in the processor's platform, the core banking system holds truncated or tokenised numbers, card request and settlement files move over an encrypted channel rather than email, and nobody keeps a spreadsheet of card numbers. A core banking system that holds no full card numbers, and the vendor that hosts it, fall out of scope. Operating ATMs keeps the machines and their encryption key custody in scope under PCI PIN, the sibling standard that governs PIN handling, which is why SCB-ATM-06 asks for key components held by separate custodians and loaded under dual control. Accepting card payments for loans or fees makes the credit union a merchant with its own self-assessment through its acquirer. Control SCB-PAY-03 asks the credit union to know its scope and hold every party's attestation; SCB-PAY-04 keeps card numbers out of its own systems.
Call-back verification (SCB-PAY-01) is the single most effective control against the payment fraud small institutions most often see: an instruction that appears to come from a member, a manager or a supplier, asking for a transfer or a change of banking details. It costs a phone call.
Operating conditions that shape the controls
Hurricanes. The season runs from June to November, and a direct hit can take out power, connectivity and road access for days or weeks. Off-site backups (SCB-BKR-03) need to be off island or in a hardened facility, not in the branch across town. Recovery objectives (SCB-BKR-04) should be tested on the assumption that the primary site is unreachable, and a hosted core banking provider's own hurricane plan belongs in the exit and continuity plan for that provider (SCB-TPR-05). Generator fuel, UPS runtime (SCB-PHY-03) and a tested plan for serving members offline (SCB-BKR-05) are the controls that decide whether the credit union opens the week after a storm.
Power. Supply quality varies, and outages are routine in some territories. Correct electrical supply (SCB-FAC-02), UPS runtime and clean shutdown (SCB-PHY-03) and spare hardware (SCB-AVL-02) carry more weight here than in most places.
Connectivity. Many territories have one or two providers and depend on a small number of undersea cables. A hosted core banking system is only as available as the link to it, so redundancy (SCB-AVL-01) should include a second connection by a different route, and manual continuation (SCB-BKR-05) assumes the link, not just the system, can fail.
Cash. Members use cash, and in many communities the credit union's ATM is the nearest one. ATM availability is a member service as much as a security matter, which is why alerting (SCB-ATM-07) sits alongside the protection controls.
Shared providers. Core banking is often hosted by a vendor or a league service bureau serving many credit unions. That concentrates risk in one provider, which is what the provider controls (SCB-TPR-01 to SCB-TPR-05) are for: a register, due diligence, contract terms, annual assurance and a tested exit plan. It also means the credit union must know which controls the provider meets on its behalf and get evidence of them rather than assume.
Vendor-managed systems on the credit union's own servers. Just as often the core banking system runs in the credit union's server room and the vendor manages it through standing remote access. The general controls for servers, backups, power and the network then apply to it as to any other server, and the credit union, not the vendor, is responsible for them. What falls between the two is the gap: who patches the operating system, who checks the backup, who watches the logs. A written split of duties (SCB-DOC-01) closes it, and the vendor's remote access, which reaches every member account, is controlled like any administrator's (SCB-PAY-07, SCB-PAY-08, SCB-ACC-04).
Small teams. Dual control and segregation of duties (SCB-PAY-02, SCB-PAY-05) are harder with five staff than with fifty. Where two people genuinely cannot be found for a task, the compensating control is a documented, independent review after the fact (SCB-PAY-06), and the board should know that is the arrangement (SCB-GOV-03).
Regional bodies
National leagues, the Caribbean Confederation of Credit Unions and the World Council of Credit Unions set expectations for their members and run shared services. They are the natural adopters and co-authors of this edition, and the bodies through which a national version of this annex would be maintained.
