With the deadline rapidly approaching, institutions are making progress in the initial phases of preparedness: 57% of institutions have completed their risk assessment and 59% have formulated a plan to fill online banking security gaps, Guardian Analytics said.

Eighty-four percent plan to invest in new technology to address the enhanced expectations, however, most are not far along in technology implementation, the company said.

Only 43% of respondents said they actually purchased new technology solutions, but 49% intend to do so in the future, the study said.

In an effort to provide clarity on where institutions should start their layered security strategies, the FFIEC supplement outlined two minimum expectations against which credit unions and banks will be examined: the ability to detect and respond to suspicious activity at login and initiation of transactions in all accounts, and enhanced controls of administrative functions for business accounts.

Despite the specific language in the supplement, nearly half do not fully understand the minimum expectations, Guardian Analytics said of its respondents.

Forty-one percent were unable to identify anomaly detection as an FFIEC minimum expectation for layered security and 56% were unable to identify enhanced controls for business banking administrative functions, the study said.

The study indicated that when asked about the factors that determine prioritization for technology investments, respondents on average ranked level of protection as the most important driver for choosing a technology solution, followed closely by customer convenience.

Meeting minimum FFIEC requirements for layered security ranked the lowest.

NCUA Chairman Debbie Matz is currently chair of the multi-agency FFIEC, which issued the new guidance this summer.