CASE STUDY
Penn South Federal Credit Union
Building an Information Security Program to Support Regulatory Compliance and Operational Resilience
CLIENT
Penn South Federal Credit Union
ROLE
Information Security Officer
2018–2024
THE CHALLENGE
Penn South Federal Credit Union required a formal information security program capable of supporting regulatory requirements, managing technology risk, and protecting member information while maintaining day-to-day operations.
The credit union needed documented governance processes, business continuity capabilities, vendor oversight, and examination-ready documentation that could withstand regulatory scrutiny.
THE APPROACH
As Information Security Officer, I developed and maintained the credit union's information security governance framework while coordinating business continuity planning, disaster recovery preparedness, vendor risk management, and regulatory compliance activities.
The program focused on creating practical controls and documentation appropriate for a community financial institution while ensuring management visibility and regulatory readiness.
KEY DELIVERABLES
Information Security Governance
Information Security Policy
Acceptable Use Policy
Password Policy
Incident Response Procedures
Annual Information Security Reporting
Risk Management
Enterprise Risk Assessments
Vendor Risk Management Program
Third-Party Due Diligence Reviews
Risk Register Development and Maintenance
Business Continuity and Disaster Recovery
Business Continuity Plan
Disaster Recovery Plan
Recovery Procedures
Annual Testing Documentation
Management Reporting
Audit and Examination Support
Examination Documentation
Evidence Collection
Audit Preparation
Remediation Tracking
Board and Management Reporting
RESULTS
Supported six years of NCUA examinations
Established a documented information security governance framework
Created formal business continuity and disaster recovery capabilities
Implemented a structured vendor risk management process
Improved organizational security awareness
Reduced operational and compliance risk through documented controls and procedures
CLIENT TESTIMONIAL
"Brian Hammerstein built our information security, disaster recovery, and business continuity programs. He developed the policies, procedures, testing processes, and governance documentation required to support our operations and regulatory obligations. I would recommend him to any organization seeking assistance with information security governance, business continuity planning,"audit preparation, or regulatory compliance." — Rob Pillarz, President, Penn South Federal Credit Union
HOW HAMMERSTEIN LLC CAN HELP
The same services developed for Penn South Federal Credit Union are available on a fixed-fee basis for credit unions, community banks, housing cooperatives, nonprofits, and organizations without dedicated information security staff.
Schedule a free consultation to discuss your organization's information security, business continuity, disaster recovery, audit preparation, or vendor risk management needs.
(212) 255-2271