The vulnerability of United States' financial institutions resulting from cybersecurity attacks continues to remain top of mind for credit union executives, professionals and most importantly the NCUA. Financial institutions remain vulnerable to cybersecurity attacks. As such, it is no surprise credit unions and the NCUA are focusing on efforts to manage the associated risks. It is critical to the success of these efforts that credit unions understand their legal requirements and, in particular, include cybersecurity as a key component of their due diligence in mergers and acquisitions. With a firm understanding of these requirements, credit union executives can enhance their due diligence process with questions yielding valuable data on the cybersecurity risks of their own organization and those they may wish to acquire.