NCUA, right? I know of no regulatory requirement, but based on most bank's abysmal lack of controls in this area, I think it's a good idea.
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.