News

FFIEC report poses key questions about cybersecurity

Testing plans across business functions and with third parties will help FIs identify and manage gaps before cyber attacks occur, the council says.

November 4, 2014

This summer, Federal Financial Institutions Examination Council members piloted a cybersecurity assessment at more than 500 community institutions to evaluate the institutions' preparedness to mitigate cybersecurity risks.

Today, the FFIEC released its observations from the assessment in a five-page document, "FFIEC Cybersecurity Assessment General Observations."

According to the report:

Many financial institutions have business continuity and disaster-recovery plans and are able to call on third parties to provide mitigation services when incidents occur. Expanding these to incorporate cyber incident scenarios will improve financial institutions’ response capabilities. Additionally, testing plans across business functions and with third parties will help financial institutions identify and manage gaps before cyber attacks occur.

The report provides themes from the assessment and suggests questions that CEOs and boards of directors might consider when assessing their institutions' cybersecurity preparedness.

In addition to the report, the FFIEC issued a recommendation that financial institutions of all sizes participate in the Financial Services Information Sharing and Analysis Center as part of their process to identify, respond to, and mitigate cybersecurity threats and vulnerabilities.

The FS-ISAC is a non-profit, information-sharing forum established by financial services industry participants to facilitate the public and private sectors' sharing of physical and cybersecurity threat and vulnerability information.

"Participating in information-sharing forums is an important element of an institution’s risk management processes and its ability to identify, respond to, and mitigate cybersecurity threats and incidents," the FFIEC said in a statement of its recommendation.

Download "FFIEC Cybersecurity Assessment General Observations"

Download"Cybersecurity Threat and Vulnerability Monitoring and Sharing Statement"