As for precisely what Obama said, his State of the Union cyber security language is here: “America must also face the rapidly growing threat from cyber attacks….Now, we know hackers steal people's identities and infiltrate private e-mails. We know foreign countries and companies swipe our corporate secrets. Now our enemies are also seeking the ability to sabotage our power grid, our financial institutions, our air traffic control systems. We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy.”

Which means: Yes, probably credit unions – as “financial institutions” – indeed are part of the “critical infrastructure” and, therefore, the White House is exhorting them to share cyber threat information with the U.S. government.

Realistically, however, Stella cautions that no credit union should expect a summons from the Department of Homeland Security anytime soon.

The nation's money center banks will get those invites and possibly a sprinkling of the largest credit unions will too. But, at least in the early days of this cyber security campaign, most credit unions will escape the scrutiny of the executive branch.

And do note, the executive order is clear that compliance with disclosure requests will be “voluntary” on the part of private sector entities.

Yet that does not mean inaction is a good idea, cautioned Jerry Irvine, CEO of security firm Prescient Solutions, who stressed that “financial institutions need to get their security ducks in a row.”

Irvine worried that if details leaked out about a cyber intrusion and the financial institution appeared to be ill prepared, “that could impact goodwill and reputation.”

Irvine's advice is to gear up to meet present industry best practices. That probably will be good enough, at least to evade cyber censure for unpreparedness, suggested Irvine.

Know however that the executive order is a kind of rough draft – “It's very vague,” shrugged Irvine. Within 240 days of its issuance, a draft of a cyber-security framework will be released for comment and within one year, a final version of the cyber security document will be released.

That document may of much more use in the way of specifics. Until then, said Irvine, a credit union that implements best practices can know it is doing just about the best it could.