Cybersecurity Awareness Month Is Ending. What Should Your Credit Union Do Next? A 12-Month Cybersecurity Roadmap

Cybersecurity Awareness Month is coming to an end.

Your employees may have completed some training.

Leadership may have talked about ransomware.

The board may have discussed cybersecurity.

Maybe you reviewed multi-factor authentication, backups, vendors, Microsoft 365, or artificial intelligence.

That’s all good.

But November is coming.

And here’s the question I’d ask every credit union leadership team:

What happens next?

Because cybersecurity doesn’t operate on an October calendar.

Attackers aren’t going to pack up their laptops on November 1 and say:

“Well, Cybersecurity Awareness Month is over. See you next year.”

Cybersecurity Awareness Month should start conversations.

The other 11 months are when you turn those conversations into habits.

So instead of ending October with another checklist, let’s build something more useful:

A 12-month cybersecurity roadmap.

You don’t need to tackle everything at once.

You need to know your risks, identify priorities, assign responsibility, test your assumptions, and keep improving.

Here’s how I’d approach it.

Month 1: Identify Your Biggest Cybersecurity Risks

Start with the question we’ve used throughout this series:

What are our three biggest cybersecurity risks right now?

Not 37.

Three.

Maybe they’re:

• Phishing and social engineering
• Microsoft 365 account compromise
• Ransomware
• Aging technology
• Vendor access
• Backup and recovery weaknesses
• Unapproved AI use
• Privileged accounts
• Employee awareness

Your risks will depend on your environment.

The important thing is to prioritize.

For each major risk, identify:

The risk

The potential business impact

What you’re doing today

What needs improvement

Who owns the next step

Now you have somewhere to begin.

Month 2: Review Identity and Access

Next, look at the digital keys to your organization.

Who can access what?

Review employee accounts, administrator accounts, remote access, Microsoft 365 access, and appropriate vendor accounts.

Ask:

Is MFA being used appropriately?

Who has administrative privileges?

Do they still need them?

Are there old or unused accounts?

How quickly is access removed when someone leaves?

Are vendor accounts still necessary?

Remember the LOCK framework from earlier in our Cybersecurity Awareness Month series:

Limit Access. Observe Activity. Confirm Identity. Kill Unneeded Access.

One month focused on identity hygiene can uncover issues that have quietly accumulated for years.

Month 3: Test Your Employees

Now turn to your people.

Not to blame them.

To prepare them.

Run cybersecurity awareness training.

Use phishing simulations appropriately.

Talk about suspicious emails, text messages, phone calls, unexpected MFA requests, impersonation, and unusual financial requests.

Then make sure everyone knows:

How do I report something suspicious?

Remember the PAUSE framework:

Pay Attention. Ask Why. Urgency Is a Warning. Stop and Verify. Escalate.

Your goal isn’t to create employees who are afraid to click anything.

Your goal is to create employees who recognize when something deserves a second look.

Month 4: Test Backup and Recovery

Don’t just check the backup dashboard.

Prove you can recover.

Pick an important system or dataset and test it.

Document:

• What you tested
• When you tested it
• Whether recovery succeeded
• How long it took
• What problems appeared
• What needs to change
• When you’ll test again

Then compare the result with leadership’s expectations.

If leadership expects recovery in four hours and the test takes 14, you’ve learned something important.

That’s why we use the RESTORE framework:

Rank. Establish. Secure. Test. Organize. Review. Exercise.

Backups are important.

Recovery is the outcome you’re actually buying.

Month 5: Review Microsoft 365 Security

For many organizations, Microsoft 365 is part of the daily operation of the business.

Email.

Teams.

SharePoint.

OneDrive.

Employee identities.

That’s why it deserves its own security review.

Look at areas such as:

• Authentication
• Administrator privileges
• Account security
• Email protection
• External sharing
• Employee onboarding and offboarding
• Monitoring
• Access policies

Then ask:

If an employee’s Microsoft 365 password were stolen today, what else would stand between an attacker and our information?

The answer should be more than one thing.

Month 6: Review Critical Technology Vendors

Now look outside the credit union.

Which outside organizations have access to important systems or information?

Which vendors would cause the greatest disruption if they went offline?

Use the TRUST framework:

Technology. Risk. User Access. Security. Test and Track.

Start with your most critical providers.

Document:

What do they provide?

What can they access?

How is that access protected?

What happens if they’re compromised?

What happens if they’re unavailable?

Who owns the relationship?

When is the relationship reviewed?

Vendor management shouldn’t only happen when the contract is about to renew.

Month 7: Run an Incident Response Tabletop

Now we’re going to make everybody a little uncomfortable.

That’s okay.

Put leadership, operations, technology, and other appropriate participants around a table for 60 to 90 minutes.

Give them a scenario.

“It’s 8:07 Monday morning. Employees are reporting inaccessible files. Several systems are behaving strangely. Your technology team believes ransomware may be involved. What do you do?”

Then walk through the first 24 hours.

Who leads?

Who gets called?

What gets isolated?

How do employees communicate?

When are outside partners involved?

Who keeps leadership informed?

How do you operate if critical systems remain unavailable?

Remember the READY framework:

Recovery. Escalation. Access. Decisions. Your People.

A tabletop exercise isn’t about getting every answer right.

It’s about discovering the questions you haven’t answered yet.

Month 8: Review Your AI Policy

By now, there’s a good chance employees have encountered AI tools.

Some may already be using them.

Don’t pretend AI doesn’t exist.

Create guardrails.

Review:

• Approved AI tools
• Prohibited information
• Document-upload rules
• Human review requirements
• Vendor AI features
• Employee training
• Ownership of AI governance

Teach employees the STOP framework:

Sensitive. Tool. Ownership. Pause.

Before putting business information into an AI system, employees should know whether the information is sensitive, whether the tool is approved, how the information is being handled, and when they should stop and ask.

AI can create opportunities.

Good governance helps you pursue those opportunities responsibly.

Month 9: Review Detection and Monitoring

Now ask the uncomfortable question from Blog #9:

Would we know?

If an account were compromised, would we know?

If an unexpected administrator appeared, would we know?

If suspicious email activity occurred, would we know?

If a security tool stopped reporting, would we know?

If something happened at 2:13 Sunday morning, would somebody investigate?

Use the WATCH framework:

Watch. Alert. Triage. Contain. Hunt.

Technology can generate alerts.

Your cybersecurity program needs people and processes that know what to do with them.

Month 10: Put Cybersecurity in the Boardroom

Cybersecurity shouldn’t suddenly appear on the board agenda once a year.

Give the board a clear update.

Keep it understandable.

Discuss:

• Top cybersecurity risks
• Significant incidents or trends
• Progress on security projects
• Employee awareness
• Recovery testing
• Critical vendor risks
• AI governance
• Upcoming investments
• Next-quarter priorities

Remember the CARE framework:

Critical Risks. Accountability. Recovery. Evidence.

Board members don’t need to become cybersecurity engineers.

They need enough visibility to ask useful questions and provide oversight.

Month 11: Review Your Technology Roadmap and Budget

Cybersecurity decisions shouldn’t live in isolation.

They connect to your broader technology strategy.

An aging server can become a security problem.

An unsupported operating system can become a security problem.

A poorly planned cloud migration can create security problems.

Too many disconnected vendors can create security problems.

So look ahead.

What technology needs replacement in the next 12, 24, and 36 months?

What cybersecurity investments are planned?

Which projects can be combined?

Which expenses should be budgeted now rather than treated as emergencies later?

What major vendor contracts are approaching renewal?

The goal is to move from:

“Something broke. How much is this going to cost?”

to:

“We knew this was coming, and it’s already part of the plan.”

That’s a much healthier way to manage technology.

Month 12: Measure What Changed

Now we’re back where we started.

A year has passed.

Don’t simply start the checklist over.

Ask:

What improved?

Compare where you are today with where you were 12 months ago.

Did you reduce your biggest risks?

Did MFA coverage improve?

Were unnecessary accounts removed?

Did employees become better at reporting suspicious activity?

Did you successfully test recovery?

Did you complete an incident response tabletop?

Did vendor oversight improve?

Did you establish AI guidelines?

Did monitoring improve?

Did the board receive useful cybersecurity updates?

Then identify the next three priorities.

Cybersecurity isn’t a project you finish.

It’s a process you mature.

The 12-Month Cybersecurity Roadmap at a Glance

Here’s the whole year:

Month 1 — Risk: Identify your top three cybersecurity risks.

Month 2 — Identity: Review accounts, access, MFA, and privileges.

Month 3 — People: Train employees and test awareness.

Month 4 — Recovery: Test backups and critical system recovery.

Month 5 — Microsoft 365: Review identity, email, sharing, and security controls.

Month 6 — Vendors: Review critical third-party technology relationships.

Month 7 — Incident Response: Run a 60- to 90-minute tabletop exercise.

Month 8 — AI: Review acceptable use, data protection, and AI governance.

Month 9 — Detection: Determine whether you can recognize suspicious activity quickly.

Month 10 — Board: Provide a meaningful cybersecurity governance update.

Month 11 — Strategy: Align cybersecurity with your technology roadmap and budget.

Month 12 — Measure: Review progress and establish next year’s priorities.

That’s one meaningful cybersecurity conversation every month.

Not everything at once.

Just steady progress.

Add a Quarterly Leadership Rhythm

I’d also add a 60- to 90-minute quarterly technology and cybersecurity review.

Every 90 days, ask five questions:

1. What Changed?

New employees?

New technology?

New vendors?

New threats?

New regulations or expectations?

New AI tools?

2. What Are Our Biggest Risks?

Have the top three changed?

3. What Did We Complete?

Don’t only talk about problems.

Document progress.

4. What Needs a Decision?

Budget?

Vendor?

Project?

Policy?

Leadership support?

5. What Are Our Next Three Priorities?

Not 25.

Three.

Give each priority an owner and target date.

Then revisit them at the next quarterly meeting.

That’s how strategy stays alive.

Don’t Try to Fix Everything in October

One of the easiest ways to kill momentum is to create a list so large nobody knows where to begin.

You don’t need 42 cybersecurity projects.

Pick three improvements.

Assign three owners.

Set three dates.

Get them done.

Then choose the next three.

Consistency beats a giant cybersecurity plan nobody has time to execute.

Cybersecurity maturity is built through hundreds of small decisions made correctly over time.

From Awareness to Action

Over this Cybersecurity Awareness Month series, we’ve talked about:

The questions leadership should ask.

Building a security-minded workforce.

Protecting identities and Microsoft 365.

Preparing for ransomware.

Managing technology vendors.

Using AI responsibly.

Giving boards better cybersecurity visibility.

Testing backup and recovery.

Detecting suspicious activity.

Now those pieces need to become one strategy.

That’s the difference between cybersecurity awareness and cybersecurity management.

Awareness says:

“We should probably talk about this.”

Management says:

“Here’s what we’re doing, here’s who’s responsible, here’s when it’s happening, and here’s how we’ll know whether it worked.”

That’s where you want to get.

Final Thoughts

Cybersecurity Awareness Month gives us a reason to start the conversation.

The goal is to keep that conversation going long after October ends.

You don’t need to become a cybersecurity expert.

You don’t need to buy every new security product.

And you don’t need to fix everything tomorrow.

You need a plan.

Know your risks.

Protect your identities.

Train your people.

Test recovery.

Review Microsoft 365.

Understand your vendors.

Practice incident response.

Put guardrails around AI.

Monitor for suspicious activity.

Keep your board informed.

Build cybersecurity into your technology roadmap.

Measure your progress.

Then do it again.

Because cybersecurity isn’t really about October.

It’s about protecting your employees, your operations, your members, and the trust you’ve spent years building.

Twelve months.

Four quarterly reviews.

Three priorities at a time.

That’s a cybersecurity plan leadership can actually execute.

What Will Your Credit Union Do After Cybersecurity Awareness Month?

If the answer is:

“We’re not sure yet,”

that’s exactly where the conversation should begin.

At CTG, we help credit unions turn individual technology projects into a practical, long-term strategy covering cybersecurity, Microsoft 365, identity protection, employee awareness, ransomware preparedness, backup and disaster recovery, incident response, vendor risk, AI governance, infrastructure, budgeting, and technology planning.

For more than 26 years, CTG has helped organizations navigate technology change, backed by a team with more than 200 years of combined experience.

And because CTG takes a vendor-agnostic approach, the goal isn’t to start with another product.

We start with the questions that matter:

Where are you today?

Where are the biggest risks?

Where do you need to be?

What’s the practical path to get there?

Cybersecurity Awareness Month may be ending.

Your cybersecurity strategy shouldn’t.

Talk with CTG

Phone: 330-655-8144
Email: brett.harney@ctgusa.net
Website: ctgusa.net

Let’s take everything your credit union learned during Cybersecurity Awareness Month and turn it into a practical 12-month roadmap—one priority, one quarter, and one measurable improvement at a time.