News

FFIEC to debut cybersecurity self-assessment tool

Financial institutions will be able to use the tool to evaluate their readiness to identify, mitigate and respond to cyber threats.

March 19, 2015

The Federal Financial Institutions Examination Council has issued an overview of its cybersecurity priorities for the remainder of 2015. According to a press release, these include seven areas of focus stemming from last year's pilot assessment of cybersecurity readiness at more than 500 financial institutions.

Planned work includes the development and issuance of a self-assessment tool that financial institutions can use to evaluate their readiness to identify, mitigate and respond to cyber threats.

Additionally, the FFIEC will continue to improve its collaboration with other agencies and communicate on the importance of cybersecurity awareness and best practices among financial industry participants and regulators.

The council is currently working on the following:

• a cybersecurity self-assessment tool to assist institutions in evaluating their inherent risk and their risk management capabilities;
• incident analysis processes for gathering, analyzing, and sharing information during cybersecurity incidents;
• crisis management, including alignment, updating, and testing of emergency protocols to respond to system-wide cyber incidents in coordination with public-private partnerships;
• training programs for FFIEC member staff, covering evolving cyber threats and vulnerabilities;
• policy development — including an update of the Information Technology Examination Handbook — with a focus on risk management and oversight, threat intelligence and collaboration, cybersecurity controls, external dependency management, and incident management and resilience;
• a technology service provider strategy focusing on providers' ability to respond to growing cyber threats and vulnerabilities; and
• collaboration with law enforcement and intelligence agencies to share information on the growing cybersecurity threats and response techniques.

The FFIEC has published several resources to help financial institutions improve cybersecurity. These are available on the FFIEC website.