TAMPA, Fla. – One size does not fit all when it comes to security. Dan Juneau, SVP for information security firm CastleGarde said security is a process not a product and credit unions should be wary of cookie cutter products. "People are spending thousands of dollars on policy templates that don't comply with the reg (Part 748). They may be good for security, but that's only one part of the process," said Juneau. He said some mom and pop security firms have simply discovered CUs and are now marketing their products to them. The problem is that they are not customized for CUs, but are for security in general. "They're taking these same templates and offering them to credit unions. There's some good security stuff in there, but it doesn't apply to the credit union," said Juneau. Juneau said CUs should understand that much of what they are required under Part 748 to include in their security policy, they probably already have – it's just scattered throughout various departments of the CU. "Write the policy based on what you're already doing. Typically you'll have only a few gaps left to fill in."