The Federal Financial Institutions Examination Council (FFIEC) has recently developed a new tool to help U.S. financial institutions combat the increasing volume and sophistication of cyber attacks. To blunt threats to a financial institution’s computers, computer systems, electronic communications network and infrastructure, the FFIEC’s June 2015 Cybersecurity Assessment Tool is designed to help financial institutions identify their cybersecurity risks and determine their cybersecurity “maturity” across five “domains”.

The Cybersecurity Assessment Tool is consistent with FFIEC’s IT Examination Handbook, the National Institute of Standards Cybersecurity Framework, and industry accepted cybersecurity practices. The Tool provides institutions with a process to inform management about the institution’s risks and cybersecurity preparedness—thereby affording management the ability to adjust their institution’s risk profile and preparedness to appropriate levels.

The Tool is designed to serve as a measurable and repeatable assessment process and consists of two parts: [1] Inherent Risk Profile—the institution’s inherent risks before implementing controls; and [2] Cybersecurity Maturity—the institution’s current state of cybersecurity preparedness for each of the following “domains”: Cyber Risk Management and Oversight; Threat Intelligence and Collaboration; Cybersecurity Controls; External Dependency Management; and Cyber Incident Management and Resilience.

By reviewing the Inherent Risk Profile and the Maturity levels across the five domains initially and periodically (as significant operational and technological changes occur), management should be better equipped to either reduce the levels of risk or increase the level of controls in each of the domains. FFIEC makes note of the fact that the Tool is intended to complement, not replace, an institution’s risk management process and cybersecurity program.

FFIEC membership is comprised of the principals of the Federal Reserve Board, FDIC, NCUA, OCC, CFPB, and State Liaison Committee.

Tags: Federal Financial Institutions Examination Council, FFIEC
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Norman Roos Norman Roos

Norman Roos, a member of Robinson+Cole’s Business Transactions Group, concentrates his practice on transactional, regulatory, and technology matters relating to the financial services and real estate industries. He is also a member of the firm’s Financial Services Cyber-Compliance Team and advises financial institutions…

Norman Roos, a member of Robinson+Cole’s Business Transactions Group, concentrates his practice on transactional, regulatory, and technology matters relating to the financial services and real estate industries. He is also a member of the firm’s Financial Services Cyber-Compliance Team and advises financial institutions concerning data privacy and security matters, particularly in relation to policy planning and implementation.

Mr. Roos is counsel to the Connecticut Mortgage Bankers Association, Inc., and is president-elect of the American College of Mortgage Attorneys where he has served on the Board of Regents and as Connecticut State Chair. A member of the Connecticut Bar Association, Mr. Roos is Past Chair of the Financial Institutions Law Section. He has served on a number of Connecticut Law Revision Study Committees including those on Uniform Common Interest Ownership Act, Electronic Communications, Mortgagor Liability, and Electronic Recording of Land Records. Read his full bio here.

Read more about Norman Roos
Show more Show less
Related Posts
Clop Claims Zero-Day Attacks Against 130 Organizations
March 30, 2023
FBI, CISA + MS-ISAC Warn of LockBit 3.0 Ransomware
March 23, 2023
Threat Groups Using Translation Tools in Phishing Attacks
February 23, 2023