News

FFIEC sends strong message about end of XP support

October 7, 2013

The Federal Financial Institutions Examination Council agencies today issued a joint statement warning that the discontinuation of support for Microsoft Windows XP could present operational risks to financial institutions, technology service providers, and third-party support organizations. As of April 8, 2014, Microsoft will no longer provide regular security patches, technical assistance, or support for the XP operating system.

The FFIEC agencies said in the statement that they expect FIs and TSPs to identify, assess, and manage risks to ensure that safety, soundness, and the ability to deliver products and services are not compromised.

In its statement, the FFIEC provided a list of potential problems that might arise for those who continue to use XP:

degradation in the delivery of products and services;
application incompatibilities;
increased potential for data theft and unauthorized additions, deletions, and changes of data;
non-compliance with the requirements of the Payment Card Industry Data Security Standard.

The council advised that organizations affected by the discontinuation of support for XP should follow risk management processes consistent with guidance contained in the FFIEC Information Technology Examination Handbook. The FFIEC listed several important actions:

performing risk assessments;
selecting appropriate mitigations;
conducting appropriate planning;
monitoring and reporting.

FFIEC members include the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Consumer Financial Protection Bureau, and the State Liaison Committee.

The complete statement is available at the FFIEC website.

Read more about security.