Cloud Hosting

The Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, and the Federal Deposit Insurance Corporations interagency paper, Sound Practices to Strengthen Operational Resilience, describes standards for operational resilience set forth in the aforementioned agencies existing rules. The paper also provides cybersecurity guidance for domestic banking organizations.

The guidance applies to banking organizations that have average total consolidated assets greater than or equal to:

Although this interagency paper is directed to the largest and most complex domestic banking organizations, small community banks can utilize this guidance to assess operational resilience, which is important for all banking organizations irrespective of their asset size.

The guidance comes at a time of unprecedented disruption which include technology-based failures, cyber incidents, pandemics, and natural disasters.

These disruptions, combined with growing reliance on third-party service providers, expose banks to operation risk.

Banks can use the guidance in this interagency paper to strengthen and maintain operational resilience with a comprehensive approach.

Top Takeaways for Banks

Appendix A: Sound Practices for Cyber Risk Management

To manage cyber risk and assess cybersecurity preparedness of its critical operations, core business lines and other operations, services, and functions, banks may choose to use standardized tools that are aligned with common industry standards and best practices.

Some tools banks can choose from include the FFIEC Cybersecurity Assessment Tool, the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security Critical Security Controls, and the Financial Services Sector Coordinating Council Cybersecurity Profile.

While the agencies do not endorse the use of any particular tool, here is a summary of the recommended sound practices for cyber risk management in their respective categories, aligned to NIST and augmented to emphasize governance and third-party risk management.

Recommended Sound Practices to Cyber Risk Management

Governance

Identification

Protection

Response

Recovery

Third-Party Risk Management

See original here:
Official Government Cybersecurity Guidance Offers Six Focus Areas for Banks of All Sizes - Lexology