CISSP AI Governance: What Examiners Really Ask

Credit union examiners are asking sharper questions about AI, and the NCUA has now named AI explicitly in its 2026 supervisory priorities. In this episode of CISSP Cyber Training, host Shon Gerber walks through what examiners are really looking for — and why "we bought an approved tool" isn't the same as having real AI governance.

Shon uses recent real-world incidents to make the case: OpenAI's alleged breach of Hugging Face credentials, Communications Federal Credit Union's rollout of Cynaptic AI for lending decisions, and a Pennsylvania community bank's shadow-AI breach caused by employees using unapproved chatbots. Shadow AI, he notes, is now the top driver of negligent insider incidents and adds roughly $670,000 to the average breach cost. Since examiners currently lack a single comprehensive model risk management standard, they lean on frameworks like NIST AI RMF and COSO to evaluate credit unions' AI programs.

The episode ties these gaps directly to the CISSP domains most exam candidates need to know: governance and board-approved policy (Domain 1), data classification and ownership (Domain 2), explainable security architecture (Domain 3), bias testing and assessment (Domain 6), and third-party AI vendor risk (Domain 7). Shon lays out practical governance requirements — named accountable owners, trigger-based model revalidation, contractual right-to-audit clauses, pre-deployment bias testing, and ongoing drift monitoring — and closes with the core lesson: compliance checkboxes without genuine oversight leave an organization just as exposed as having no AI controls at all.

Links

Podcast: CISSP Cyber Training Podcast

Related articles on NCUA AI governance for credit unions:

• NCUA – NCUA's 2026 Supervisory Priorities
• Nintex – NCUA is watching how your credit union is using AI... are you exam-ready?
• Consumer Financial Services Law Monitor – NCUA Issues Updated AI Resource Hub
• Cotribute – NCUA AI Readiness Guide for Credit Unions
• CU Web Training – NCUA AI Governance & Building an AI Inventory for Credit Unions
• Advisor Labs – NCUA AI Compliance: What Your Credit Union Needs to Build (Not Buy)