Technology That Disappears.Trust That Doesn't.

No. We support your compliance with security controls, monitoring, and documentation. Your board, management, and designated compliance and security officers own your compliance program.

Yes. We serve community and regional banks and credit unions across a range of sizes. What matters more than asset size is whether your institution has regulatory obligations, member and customer data to protect, and a team that needs dependable systems. If that describes your institution, the conversation is worth having. We'll give you a straight answer in your strategy session.

Pricing depends on the number of users and locations in your institution and the support you need. We'll walk through it with you in plain terms during your strategy session.

The 15-minute strategy session is always free. It's a conversation about your institution, your platforms, and your regulatory obligations. If it makes sense to move forward, we conduct an environment review: we map your systems, security posture, backups, and vendors against your regulator's expectations, and explain what we find in plain English. The scope of that review and any associated costs are agreed before we begin. From there, we build a plan with clear priorities and a timeline. Nothing starts until you approve it.

We work inside Microsoft 365 and alongside the core processing, online and mobile banking, card, and other platforms your institution uses. We manage the identity, access, devices, and network around those platforms, and we coordinate with the vendor when an issue is on their side. If you use something specific, ask us during your strategy session.

When something goes wrong, the sequence matters. Here is how VanderNet handles it:

1. 1Detection. Our 24/7/365 SOC monitors your environment continuously. An incident may be detected by our monitoring, reported by your team, or flagged by a vendor or provider.
2. 2Assessment. We determine the scope and severity of activity within your managed environment. Not every alert is an incident; not every incident is a breach.
3. 3Containment. Where action is needed, we work to contain activity within the environment we manage, isolating devices, suspending accounts, or blocking traffic depending on what we find.
4. 4Notification. Your designated contacts receive a clear update: what happened, what we found, what we did, and what comes next.
5. 5Recovery. Backups support recovery after a threat is contained. We restore affected systems or data in a prioritized order based on what your institution needs most.
6. 6Coordination. For incidents with broader implications, your executive team, compliance officer, legal counsel, insurance carrier, and vendors may need to be involved, and your institution may have regulatory notification obligations. VanderNet coordinates the technical response and provides the facts and timeline those parties need. Notification decisions remain with your institution.

Backups support recovery. They do not replace the containment and assessment steps that come first.

The deadlines depend on your regulator, and they are measured in hours. Banking organizations supervised by the OCC, the Federal Reserve, or the FDIC must notify their primary federal regulator as soon as possible and no later than 36 hours after determining that a notification incident has occurred. Federally insured credit unions must report a reportable cyber incident to the NCUA as soon as possible and no later than 72 hours after reasonably believing that one has occurred; that notice is an early alert and does not require a detailed incident assessment within the 72 hours. Separately, a bank service provider must notify affected bank customers as soon as possible after it determines it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services for four or more hours. Whether an event meets a threshold is a decision for your leadership, compliance team, and counsel. VanderNet provides the technical facts and timeline they need. State requirements and contractual obligations may differ. This is not legal advice.

The same layered security follows every user: secured devices, monitored access, phishing-resistant MFA, and support that answers whether your team is at a branch, in the back office, or working remotely.

When an examination request list or a questionnaire arrives, your technical safeguards are already mapped and documented. We provide your compliance and security officers with the system and vendor inventory, network architecture diagrams, access review records, patch and update records, control descriptions, recovery-test results, and risk findings that examiners and auditors ask for. We organize it before the deadline, not during it. If a request exposes a gap in your documentation, we help you identify what is missing and what it will take to address it.

Yes, and we plan the transition around your deadlines. Nothing changes until you approve it.

We can work alongside your existing IT person or team, or take over completely. Either way, we plan the handoff so your institution isn't left in the middle.

For updates we manage, we assess urgency, review potential impact, test where practical, and schedule deployment around your member-facing hours and critical work periods. General updates are held for 30 days. That window gives Microsoft and other vendors time to identify and withdraw updates that cause problems. Security-urgent patches follow an accelerated process and are not held. Where a software vendor controls its own release schedule, we help you assess the impact and coordinate the response. Nothing changes without your awareness, and critical periods are logged in advance so updates are not deployed before month-end or a holiday weekend.

We serve banks and credit unions across Missouri, Arkansas, Kansas, Oklahoma, and the Midwest.

We don't publish client names. Protecting confidentiality is part of the job. If you'd like to speak with a client, we can discuss that at an appropriate stage with their permission. In the meantime, we can walk you through what a typical engagement looks like and what documentation your compliance and security officers would receive. You can also read anonymized examples on our

case studies page.

That depends on your charter and your insurance. National banks and federal savings associations are supervised by the OCC, state member banks by the Federal Reserve, state nonmember banks by the FDIC, and federally insured credit unions by the NCUA. Banks are subject to the Interagency Guidelines Establishing Information Security Standards under the Gramm-Leach-Bliley Act; federally insured credit unions follow NCUA Part 748. State-chartered institutions also answer to their state regulator. VanderNet works with your compliance and risk professionals to identify which requirements apply to your institution. This is not legal or compliance advice.

The FFIEC retired the Cybersecurity Assessment Tool (CAT) on August 31, 2025. It chose not to update the tool and told supervised institutions they can refer directly to newer government resources, including NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals. It also noted that institutions may consider industry resources such as the CIS Critical Security Controls, and that any self-assessment tool an institution uses should support an effective control environment and be commensurate with its risk. The FFIEC does not endorse a particular tool, and the NCUA continues to offer its ACET to credit unions on a voluntary basis. VanderNet organizes controls and evidence around NIST CSF 2.0 and CIS Controls. Your regulator and compliance team determine what your examiners expect.

VanderNet is one of the vendors your institution oversees, and that oversight remains your institution's responsibility. We support it with documentation: our service scope, the systems and vendors in your environment, access review records, recovery-test results, and escalation contacts. In September 2026, federal regulators issued a proposal to revise their interagency third-party risk management guidance. As of October 2026, that proposal is not final. We follow regulatory guidance as it changes and work with your compliance team on anything that affects your documentation.

When a new employee joins, we coordinate device setup, account provisioning, access to the applications they need, and MFA enrollment before their first day. When an employee leaves, we work with your HR or operations contact to remove or suspend access to systems, applications, email, and member data on a defined timeline. Both follow a documented process, not ad hoc handling.

Your officers have access to the technical documentation that supports your compliance program: system and vendor inventory, access review records, patch and update records, control descriptions, recovery-test results, risk findings with remediation status, and escalation contacts. The cadence and format are agreed when we build your plan. Before an examination or audit, we organize the relevant documentation so your team is not assembling it under deadline pressure.

Federally insured credit unions must maintain a vital records preservation program under 12 CFR Part 749, updated effective July 16, 2026. The program covers identifying, storing, and being able to reconstruct the records needed to restore member services, with duplicate records kept at a separate location. VanderNet's backup and recovery testing supports that program with tested, offsite backups and documented recovery-test results. Your board and management own the program and decide what counts as a vital record.