20 Dec 2017

2017 12 5 Things to Consider Before Moving to the Cloud

Banks, Credit Unions, Technology Brendan McGowan 0 comment

5 Questions to Ask Before Moving to the Cloud

2017 12 5 Things to Consider Before Moving to the Cloud

The allure of having applications and systems hosted on a cloud network is appealing to community banks and credit unions as it allows them to eliminate servers, internal infrastructure, and applications that would typically have to be hosted inside the institution, as well as the associated support each one requires. As a result, many organizations are considering, or currently in the process of, moving to cloud-based systems.

While the cloud can certainly help streamline processes and increase bandwidth for bank staff, there are a number of details that community banks and credit unions should consider before making this transition, beginning with the cloud destinations or management types:

The Infrastructure Management Types

On Premise

All hardware is located on-site at the financial institution.

Co-Location

All hardware is housed at a third-party data center. This solves the issue of location.

Infrastructure as a Service (IaaS)

A cloud provider hosts the infrastructure components traditionally housed in an on premise data center, including servers, storage and networking hardware. It solves the issue of location + hardware storage.

Platform as a Service (PaaS)

A cloud computing model where a third-party provider delivers hardware and software tools to users over the internet. This model solves the issues of location + hardware + platform.

Software as a Service (SaaS)

A software distribution model in which a third-party provider hosts applications and makes them available to customers over the Internet. Some examples include Gmail, Facebook and Office365. This model solves the issues of location + hardware + platform + software.

Cloud services offer many benefits for financial institutions, including system standardization, centralization of information, the simplification of IT management and the built-in ability to stay current with technology updates and vendor software releases. For cloud services to be implemented successfully, financial institutions must understand the different types of cloud environments that are available and which one best meets the strategic objectives of their institution. Each bank has a unique corporate strategy that will guide how it moves to the cloud, what type of cloud solution is best for its environment and what specific technology assets should be moved to the cloud.

Here are five questions you should ask before making the decision to move to the cloud:

Which applications can we move to the cloud?

Evaluating which applications can be moved to the cloud and which vendors offer cloud-based solutions is really the first step. This will help organizations understand issues and elements that will be solved or created by the move to the cloud. For example, even with cloud-based solutions, financial institutions will still need to manage user work stations, security issues, connections to applications, and switches and routers, to name a few.

Everything You Need to Know About the Cloud Get a Copy

Does moving to the cloud fit with our corporate strategy?

Some organizations consider moving to the cloud simply because they think it is the right thing to do; however, there is no set path that all financial institutions must follow. Each bank has a unique strategy that is driven by its market situation, such as the desire to expand service offerings, open new branches, merge with another institution or even be acquired. Your corporate strategy informs your institution’s IT strategy and will guide you in choosing the management type that best fits your overall goal.

Is the connectivity at my bank strong enough to support cloud-based solutions?

Delays in loading cloud-based applications can be frustrating as well as costly. The increased use of cloud-based computing will place added demands on Internet speed and connectivity, making a strong connection critical for the success and health of the financial institution. This is a very important consideration when determining whether to move to cloud-based services. Confirming your institution has the proper connectivity will certainly help streamline this transition.

Are there additional security, risk and compliance issues to consider when moving to the cloud?

Moving to a cloud-based application will mean giving up some controls to the cloud vendor. When selecting a cloud vendor, evaluate their practices and strategies for user identity and access management, data protection, incident response and SOC 2 Type II documentation. You should have a solid vendor management program in place to verify that your vendors are compliant and are following the service agreement.

Will moving to the cloud save my institution money and cut down on IT costs?

Many financial institutions find that the transition does not translate to a lower price tag, and in-fact can result in the bank actually spending more. However, with this expense comes the simplification of IT management and the built-in ability to stay up to date with software releases. Migrating to the cloud commonly requires an organization to move from a capital expenditure (CAPEX) to an operating expenditure (OPEX) financial model, in which large capital outlays for purchase of servers, computers and networking hardware, are replaced by monthly, quarterly, or annual fees that an institution pays to operate the application.

An application hosted in the cloud does not require any major capital investments for the institution. While the monthly fee in the OPEX model may be higher than the hardware and software costs, it eliminates the responsibility and indirect expense of bank personnel having to maintain the IT infrastructure. Think of these pricing models in the same way as owning a car versus taking Uber. When you own a car, you are responsible for its general upkeep, paying for gas, cleaning the car, etc. When you take Uber you simply pay for the ride and the driver is responsible for the vehicle’s upkeep. While you may pay a little more for that Uber ride, you gain more free time to focus on activities you enjoy.

Working with a financial industry IT service provider, like Safe Systems, can help you with the decision-making process involved with moving to the cloud while ensuring the solution and applications are compliant and meet regulatory expectations. We work with each institution to create a plan, based on their goals and strategies, to determine what can and should be moved to the cloud. Ultimately, moving IT assets to the cloud enables your bank and IT executives to focus on the key capabilities that support your bank’s unique strategy.

2017 Community Bank Information Technology Outlook

Primary Research and Analysis of Your IT Priorities in 2017

14 Dec 2017

Banks, Compliance, Credit Unions Holly Hooks 0 comment

Importance of A Cybersecurity Risk Appetite Statement

As cybersecurity threats continue to increase in the financial services industry, banks and credit unions must work harder to meet regulatory expectations. Regulators are taking a deeper look at financial institution’s policies and procedures to ensure that these institutions can effectively safeguard confidential and non-public information. This includes ensuring financial institutions have a Board approved Cyber Risk Appetite Statement.

Regulators are not only looking to ensure financial institutions have a cyber risk appetite statement in place, but that it is being used to monitor and manage the institution’s cyber risk. In fact, risk appetite is mentioned more than 6 times in the FFIEC’s Cybersecurity Assessment Tool (CAT). The Overview for CEOs and Board of Directors released with the CAT by the FFIEC, states it is the Board or an appropriate Board committee’s responsibility to “engage management in establishing the institution’s vision, risk appetite, and overall strategic direction.”

What is Cyber Risk Appetite? Safe Systems’ Compliance Guru gives us a good working definition of risk appetite: “The amount of risk that an enterprise is willing to pursue and accept in order to achieve the goals and objectives of their strategic plan.” In other words, risk appetite is a decision by the Board and Senior Management that the residual risk level is acceptable. Residual risk is the risk remaining after controls have been applied. Before the Board can define a cyber risk appetite statement they must have clear understanding of the institution’s risk profile. This will allow them to clearly define their risk tolerance. This is then used to inform management’s decision making. For example before an institution begins offering a new service, management should validate that the amount of risk after controls have been applied (residual risk) are within the defined risk appetite. If not, management should determine if additional controls can be applied to bring the risk within acceptable limits or reevaluate the service.

Failure to have a cyber risk appetite statement not only puts a financial institution in risk of violating regulatory requirements but can also lead the institution to improperly manage its cyber risk. Defining your cyber risk appetite allows an institution’s Board of Directors to set the tone for risk management throughout the financial institution.

For more information, download our white paper, Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture.

Understanding the FFIEC’s CAT

How Your Institution Can Improve Its Cybersecurity Posture

06 Dec 2017

Banks, Compliance, Credit Unions Jamie Davis 0 comment

What Community Banks and Credit Unions Should Budget for in 2018

2017 Dec What Community Banks and Credit Unions Should Budget for in 2018

Many financial institutions are entering (or are already within) their 2018 budget season. While creating a budget is essential in helping you execute your strategy and plan for the future, any shortcomings, such as the ability to respond to changes in regulation or things you didn’t adequately plan for, can quickly derail your plans and force you to make critical trade-offs. As community banks and credit unions dive into this process, it is important to evaluate all areas and think outside the box on key IT, security and compliance budget items that are often overlooked. Since we work with more than 600 financial institutions just like yours, we are constantly researching what’s coming next, both from technology and compliance viewpoints and offer some points for consideration in your budgeting for 2018.

2017 started with several ransomware incidents and culminated mid-year with one of the largest breaches ever – directly impacting more than half of the adults in the United States– with the Equifax breach. Expect “Cybersecurity” and “Information Security” to be buzz words going forward for the next few years. No business wants to have a breach and no regulatory agency wants to sign off on a business’ processes only to have them be breached. Look for the regulatory agencies to start looking out for number one by putting pressure on you, the financial institution, to step up your cybersecurity efforts.

Per some studies, up to 90% of cybersecurity spending is directed towards securing the network, yet 72% of all breaches happen from the application level. This disconnect indicates that, while the money spent may prove effective on stopping perimeter exposure, it has likely left an unexpected weakness in overall protection.

Expect cybersecurity and added layers to be a focus over the next few years. The layers are often moving from the perimeter to the device level. Considering most breaches go unnoticed for 100-200 days, expect an emphasis on forensics and monitoring in the coming year(s) as well.

As you are setting budgets for 2018, here are some key line items for consideration:

Malware/Ransomware Layers: $1,500 – $5,000

Remember that 2016 and early 2017 were very heavy in malware, especially ransomware. While this seemed to cool off toward the end of 2017, experts expect this to be a major issue for the foreseeable future. The price will depend on the layers you select and how many you choose to add. You should really consider taking a more aggressive step in your fight against malware this year. If 2016 and 2017 taught us anything, it is that malware, and specifically ransomware, is back with a vengeance. More legitimate websites are unknowingly infected with malware and more emails are getting through with malware than in years past.

Malware has also evolved into a more aggressive threat. It’s no longer characterized by simple aggravating popups and sluggish computers, but is now encrypting all of the data on your machine, rendering it unusable. It’s gathering credentials of users, or even sometimes gathering documents and information on the machines themselves. Safe Systems has had more calls from both customers and non-customers about aggressive malware in 2016 than in years past and that trend looks to continue.

Financial institutions should evaluate their current layers, their effectiveness, and what they can do to enhance their cybersecurity posture. This may mean more/different end user training, DNS Filtering, or actual implementation of anti-ransomware toolsets. Whatever course you choose, know that the battle to protect your data is real, and it is as important as ever.

Cybersecurity Policy and Incident Response Testing: $4,000 – $7,500

Cybersecurity preparedness does not start or end with the Cybersecurity Assessment Tool (CAT), but it does play a role. Examiners will be looking at this for at least acknowledgement that you understand cybersecurity is a real issue and you are working on addressing it. We still speak with institutions who have done little to nothing with the CAT. With the current risk environment constantly escalating, regulators are unlikely to continue to let this slide.

Strengthen Your Strategy: Why a Layered Defense is the Best Choice for Your Bank’s IT Security Program

Learn why a single layer of security, such as antivirus, is no longer enough in the current risk environment.

Honey Pots: $2,500+

A security professional at a major security conference earlier this year referenced baiting and monitoring for criminal activity as one of the most effective measures to know if you have been compromised. Often referred to as “honey pots,” this refers to decoys set up to look interesting to anyone “snooping” around. With a solid solution in place, your institution could know of an intruder within minutes instead of the estimated 100-200 days noted above. If Target or Equifax had used similar solutions, they would likely have not been compromised or damaged to the extent that they were.

Robust Vendor Management Solution: $2,500 – $5,000

With financial institutions delivering more products via third-party vendors than ever before, regulators are looking for a thorough vendor management program that ensures that all vendors are being reviewed regularly. For the average community bank, the process to properly perform vendor due diligence and vendor management has become too cumbersome. An automated solution provides a more efficient, cost effective way to address this. This also ties into the cybersecurity preparedness. As data has moved outside the institution, it’s more important than ever to make sure your vendors are keeping your data safe.

New and Replacement Technology: $500 – $10,000

Be sure that all products your vendors are “sun setting” are budgeted to be updated or replaced. Also, ensure that key applications and settings are updated to the latest best practices, including:

Expired in 2017 and should be replaced or upgraded

Windows Vista
Symantec Endpoint 10.x
Microsoft Office and Exchange 2007
Backup Exec 2015
Adobe Acrobat XI

Expires in 2018 and should be replaced or upgraded

ESXi/vCenter 5.5 expires 9/19/2018

Training: $500 – $1,500

Information security is an issue that not only affects your institution, its employees and Board of Directors, but also extends to your customers. In fact, FFIEC guidelines now expect you to enhance the training programs you may already have in place. This is an area where many institutions could make a lot of improvement for the fewest dollars. Employees, via intent or mistake, are often the starting points for the breaches many institutions face. A single employee has been blamed for much of what happened in the Equifax breach. Make sure your employees and customers have access to the appropriate training commiserate with their needs. Information security knowledge and understanding affects all employees at some level, so ensure that your budget includes the appropriate training for each type of employee.

Vendor and User Conferences: $1,000 – $1,800

It is important to stay up to date with the latest features and industry changes. An effective way to achieve this is to attend a vendor conference or user group event. Make sure to budget for key vendor conferences as an educational and vendor management function.

Some careful forethought in the budgeting process today can prevent you from having to make difficult decisions and trade-offs next year. With more than 20 years of service in the financial industry, working with more than 600 institutions, and actively managing 20,000+ devices, Safe Systems has gained a unique perspective on what is important to financial institutions and to the regulators that oversee them. We encourage you to leverage our expertise as you develop your strategic plans and budgets for the coming year.

29 Nov 2017

Banks, Compliance, Credit Unions Jamie Davis 0 comment

Combatting Cybercrime: Change Your Cybersecurity Mindset to Enhance Your Institution’s Strategy

Targeting Employees - How to Prevent Phishing

Cyber-attacks are becoming more sophisticated as cyber criminals find alternative ways to target financial institutions and their data. Most recently, there has been an increase in phishing scams that specifically target bank employees, attempting to obtain sensitive information such as usernames and passwords. The ultimate goal is to trick bank employees into clicking on links or opening attachments that redirect them to fake websites where they are encouraged to share login credentials and other personal information.

With access to your employees email accounts, cyber criminals have the ability to read your bank’s critical information, send emails on your employees’ behalf, hack into the employee’s bank and social media accounts, and gain access to internal documents and customer financial information. This can result in both financial and reputational risks for the institution and its employees.

To help protect your institution’s data, here are two key ways to prevent phishing scams and increase security for your community bank or credit union:

Employee Training is the Number One Priority

Without proper training, it is very easy for employees to fall victim to a variety of email phishing scams. Financial institutions must have a policy of on-going testing and training to ensure employees understand security procedures and are equipped to identify phishing emails and other security threats. It is also important to establish a security culture within your organization to ensure that all employees recognize that they have a personal responsibility to safeguard against breaches.

Community banks and credit unions can also leverage an outside security company to conduct security training and checks to verify how employees interact with suspicious emails. This allows network administrators to look at different levels of risk based on whether an employee ignored the email, opened the email, or clicked the link and provided information. After conducting this test, the administrator can then use that opportunity to educate employees on what happened during the test, explain how the system was compromised, and provide applicable advice on how to recognize these types of attacks in the future.

Stop Email Phishing Attacks with Multifactor Authentication

A proven way to protect your bank’s network is to implement multifactor authentication, which requires more than one method of authentication to verify a user’s identity for a login or other transaction. This security option is designed to make it more difficult for cybercriminals to access bank accounts and other sensitive information.

While there are different ways to implement multifactor authentication, the three basic elements that can be used in this process include:

Something the user knows, like a password or PIN;
Something the user possesses, like a smart card, token or mobile phone; and
Something the user is (i.e., biometrics), such as a fingerprint or retina scan.

Many of our customers rely on Safe Systems SafeSysMail O365 hosted email solution, which provides them the option to turn on dual-factor authentication to increase the layers of security. When an employee tries to login to their email account, they would first type in their username and password. Then, as a second factor, they would use a mobile authentication app, which will generate a code or PIN to enter on the screen and would then be given access to the account. Implementing multifactor authentication is a powerful step toward preventing hackers from gaining access to accounts even if a password or security answer is stolen.

To combat today’s cyber threats, financial institutions must stay up to date on the latest phishing strategies and verify that the security policies and solutions in place can reduce potential threats. It is also vitally important that employees understand the types of attacks they may face, the risks, and how to address them. Implementing a combination of employee training and multifactor authentication strengthens your institution’s security strategy and can make the difference when (not if) cybercriminals attempt to hack into your employee accounts.

08 Nov 2017

Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

Your 2018 Plan: Identifying Top IT Priorities for Community Banks & Credit Unions

To help small financial institutions get a better understanding of what their peers are spending and planning for technology, compliance and security, we survey community banks and credit unions across the country annually. Last year, our 2017 Community Bank Information Technology Outlook Survey provided valuable data including top IT priorities, IT challenges, security concerns and compliance issues.

Looking Back at 2017

Looking back at last year’s survey, bankers and credit union executives were acutely focused on:

Cybersecurity was one of the greatest security challenges for 2017 according to 94% of respondents.
Nearly 77% of respondents claimed they were spending more on technology than they had in the past.
Banks found it challenging to keep pace with the rapid rate of technological change that is influencing and impacting the banking industry.
71% of respondents reported outsourcing their network management and 63% outsourced their IT support.
Compliance issues were top-of-mind as many community banks indicated that regulators were more aggressive as examiner expectations and demands continued to increase. This resulted in approximately 59% of participants spending more on their IT and compliance needs headed into 2017.

What Has Changed

What are community banks and credit unions evaluating most headed into 2018? In this year’s survey, we will focus on compliance and security concerns, IT management issues, vendor management, audit and exam preparation and implementation of new services, among others. Each year, the data we gather provides valuable peer data from financial institutions across the country t0 use as guidance for their own key IT, compliance and security decisions in 2018 and beyond.

We hope you will participate in the 2018 survey by visiting http://info.safesystems.com/2018-community-bank-credit-union-it-outlook-survey. By completing the survey you will receive access to this comprehensive year-end report. Your anonymous responses will be aggregated to provide detailed graphs, charts and plenty of insight amongst your peers in the community financial industry.

01 Nov 2017

Are Regulations Killing Community Banks and Credit Unions?

Banks, Compliance, Credit Unions Jamie Davis 0 comment

Are Regulations Killing the Community Bank and Credit Union?

Are Regulations Killing Community Banks and Credit Unions?

Community banking has been an essential part of the financial backbone of the United States for over a century. Community bankers have funded the ideas and dreams that helped launch countless businesses across the country – businesses that sometimes grew to employ thousands of local residents and generate millions for local economies.

For many banks and credit unions today, the commitment to serve the local community is still very real. The mega banks are often looking for a “mega” deal and not the small business loan that a local company needs to get started. As a result, community banks and credit unions are vitally important to small and medium sized businesses that are often ignored by larger institutions.

Herein lies the problem, because over the last decade, the number of community banks has decreased by 27% while credit unions have decreased by 40%. Some of this, of course, is attributable to the Great Recession, but of the nearly 2,000 banks that have disappeared, only about 500 were shut down during the down turn, meaning the majority of the decline is not entirely based on this specific event. So, if the economic calamity of the last decade is not entirely to blame, what is?

While there are several factors that have led to the decrease in smaller institutions, one has had perhaps the most significant impact: the increase in regulatory requirements. Regardless of location and size, small community banks are subject to largely the same regulations as larger institutions. Regulatory agencies are continuously changing and increasing guidance around a variety of issues, including cybersecurity, vendor management, and disaster recovery, among others. The increase in regulatory requirements does two things:

It Creates a Challenging Environment to Run a Community Financial Institution

For many community banks and credit unions, meeting new regulatory requirements takes a considerable amount of time, effort and knowledge to execute successfully. Small community institutions that manage this function internally often struggle to keep up with the ever-changing regulatory landscape and provide the proper documentation to examiners. Without the right compliance expertise, it can be very difficult to ensure the institution’s processes and procedures are in line with federal regulations.

It Increases Operational Costs

Each new regulatory guidance, update, change, and interpretation requires additional expertise and more employee resources. It’s a never ending cycle. The last decade has brought about an increase in compliance changes including: the Patriot Act, the Bank Secrecy Act (BSA), new information security regulations and more requirements for lending and liquidity. All of these changes have increased compliance spending and forced institutions to redirect valuable employee time away from customer service and more revenue generating activities.

In the past, the core vendor has been the one to fill in the gaps between what banks can manage internally and areas where they required outsourced help. Historically, the core vendors helped community banks and credit unions with tasks to support everything from teller functions, to lending, to direct mail, as well as provide services such as remote deposit capture and mobile banking. Today however, many core vendors are very large and not agile enough to stay on top of the consistent changes in regulatory guidance.

This pressure in the market is forcing institutions to either hire additional in-house talent to keep up with all the new regulatory expectations or look beyond their core providers for outsourcing regulatory and compliance needs. Many that have tried to fill the gap with additional in-house expertise find that recruiting and training qualified staff to manage regulatory requirements demands considerable time and energy from a bank’s management team, which redirects valuable resources needed to support customers and banking operations.

So what’s the answer? The future of community banking depends on community financial institutions surviving in this new regulatory environment. The reality in today’s market is that the task of meeting all requirements laid out by regulatory agencies is becoming too much of a challenge for banks and credit unions – and even their trusted core providers — to manage alone. Working with a trusted IT and compliance partner that specializes in regulatory compliance can provide your institution with the regulatory expertise and knowledge to successfully meet compliance goals and provide the best banking experience to your community.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

25 Oct 2017

Banks, Credit Unions, Security Jamie Davis 0 comment

Top 4 Security Threats Your Financial Institution Faces Today & How To Protect Yourself

The financial services industry continues to be heavily targeted by cyber-attacks because of the sensitive financial data that institutions hold. Hackers, in turn, recognize one of the greatest potential avenues for financial gain is in targeting financial institutions, enabling them to either commit fraud themselves or sell the information to a third-party. What is most troubling is that cyber criminals have displayed new and advanced levels of sophistication, knowledge and ambition in 2017 – a year characterized by a series of extraordinary attacks, including malware threats, credit and debit card breaches, phishing attempts and data breaches.

Some of the most common security threats financial institutions are facing today include:

Ransomware

Ransomware has established itself as one of the leading cyber threats with instances increasing by 44 percent last year. In fact, according to the 2017 State of Malware Report by Malwarebytes, ransomware was the favored method of attack used against businesses in 2016. Recent FBI statistics also indicate that hackers successfully extorted more than $209 million in ransomware payments from businesses and financial institutions in Q1 2016, and the business of ransomware is now on track to become a $1 billion per year crime.

Lack of Third-Party Vendor Security

While a financial institution might have the right security systems and policies in place to protect itself and its customers from a cyber-attack, its third-party providers and vendors may not have the same level of security and diligence. This creates a major vulnerability for the financial institution and risks Federal Financial Institutions Examination Council (FFIEC) compliance issues.

Insider Threats

Often, all it takes is a disgruntled employee or ex-employee to release valuable security information and compromise system and data security. Additionally, cyber criminals are increasingly realizing success through bribery as a means to entice bank employees to give up their login credentials or other security information, allowing direct access to internal systems.

Lack of Employee Training and Security Expertise

Cyber-attacks are often able to outpace cyber-defense due to a shortage of qualified cybersecurity personnel and the limited IT staff bandwidth to stay abreast of a continually evolving security landscape. Employee testing and training is critical for banks and credit unions to decrease vulnerabilities and ensure staff — at all levels — understand their roles and responsibilities in protecting against security threats. Until this learning gap is resolved, financial institutions will continue to struggle to efficiently manage cybersecurity threats.

Combating Security Threats & Protecting Customer Data

To adequately protect against cyber threats, financial institutions should ensure that every device on the network has up-to-date antivirus software, adequate firewall protections and that all patches are up-to-date as a minimum requirement.

In addition, financial institutions should also employ a strategy that places many uniquely tailored layers throughout their networks, from the end-user to the Internet to establish a secure IT environment. Adding preventive, detective and responsive layers to IT security strategy will help strengthen an institution’s approach and build an effective security foundation. Proactively protecting customer data will always be more cost effective than falling victim to malicious activity.

For more information, download our white paper, “Ransomware and the Evolving Security Landscape of Today’s Financial Institution.”

11 Oct 2017

Banks, Technology Christine Ray 0 comment

Blue Ridge Bank Improves IT Network Management Process with Safe Systems’ NetComply One Solution

Blue Ridge Bank Improves IT Network Management Process

Financial institutions rely on technology and their IT personnel to maintain hardware and software and ensure that all systems are functioning optimally when needed. The IT department is also responsible for monitoring an array of on-going network activities like updating antivirus protection, conducting IT network management, efficient patch management, and ensuring email security, to name a few.

As a result, the network administrator position has become one of the most important within financial institutions. However, some community banks only have one person running their IT departments, putting the bank at risk if that person goes on vacation, gets sick, changes jobs, or goes on extended leave.

Blue Ridge Bank, a $112 million institution based in Walhalla, South Carolina, knows about this scenario all too well following the departure of its long-time IT administrator back in December 2016. Following his departure, the bank recognized the need to decentralize the management of its network system by finding a partner with the right expertise and knowledge to efficiently and effectively maintain its system.

Solution

The bank sought a trusted technology partner that clearly understood IT and compliance processes for financial institutions and had the expertise to monitor and manage the network efficiently. The bank’s new CEO had previous experience working with Safe Systems while at another bank and recommended they contact the outsourced IT provider. The bank chose to partner with Safe Systems and utilize its NetComply® One IT network management solution.

“Partnering with Safe Systems was an easy decision for us. We liked that the system could increase our network’s performance and maintain compliance with regulatory requirements while also maintaining patch management, qualified alerting, and reporting,” said Eva McGowan, senior vice president and chief operating officer at Blue Ridge Bank. “In addition, the 24/7 monitoring feature that alerts us of any anomalies, unauthorized devices connected to the network, server issues, or any power issues has been a huge time saver for our institution.”

Result

Blue Ridge Bank reported a seamless implementation process of NetComply One and reports that its staff is very pleased with the user-friendly interface. Safe Systems loaded the system on all of the bank’s workstations and servers remotely, and provided thorough training on NetComply One to help the staff understand what to look for and how to manage any network issues that might arise.

Since implementing NetComply One, Blue Ridge Bank has realized significant improvements in the overall management of the network. The bank’s in-house staff no longer has to manage patches manually, monitor workstations, or troubleshoot network issues on daily basis, allowing them to focus on more revenue-generating activities for the bank.

“NetComply One has truly been a game changer for our bank by helping us to achieve our technology and compliance goals and better serve our customers,” said McGowan. “Our Safe Systems strategic advisor has made helpful recommendations on how our bank can improve our processes; implement new technologies and services; and stay abreast of all emerging regulations and trends in the industry. Partnering with Safe Systems has been a terrific experience for our bank.”

7 Reasons Why Small Community Banks Should Outsource IT Network Management

This is a free white paper that addresses key issues smaller financial institutions face when managing their networks and the benefits of outsourcing these tasks to a provider who offers IT network management solutions exclusively tailored for community banks.

04 Oct 2017

Banks, Compliance, Credit Unions Darren Bridges 0 comment

What Is RegTech and Why Is It Important for My Organization?

What is RegTech and Why is it Important for My Organization

The financial services industry is continually evolving, especially when it comes to regulatory and compliance changes. The number of regulatory changes a bank has to manage on a daily basis has increased from 10 in 2004, to 185 in 2017. To stay abreast of these changes more than a third of financial firms continue to spend at least a full work day each week tracking and analyzing regulatory changes, according to recent research by Thomson Reuters. Regulatory compliance efforts have become a resource consuming, expensive inefficiency within financial institutions, which has led to the development of a new technology product category: regulatory technology, or RegTech.

What is RegTech?

A relatively new term, RegTech, refers to a set of companies and solutions that address regulatory challenges through innovative technology. RegTech is a subset of FinTech that focuses on technologies that facilitate the delivery of regulatory requirements more efficiently and effectively than traditional compliance processes.

RegTech helps financial services organizations automate compliance tasks and reduce operational risks associated with meeting regulatory requirements and reporting obligations. In addition, the technology empowers organizations to make informed choices based on the actual data provided through the system. This data highlights the actual compliance risks the organization faces and how it mitigates and manages those risks.

Why is RegTech Important?

The relationship between compliance and technology is nothing new; however, it is becoming more important as the sheer number of regulatory changes rises along with an increased focus on data and reporting. U.S. financial institutions now spend more than $70 billion annually on compliance, and the market for regulatory and compliance software is expected to reach $118 billion by 2020.

Key Benefits of RegTech to Financial Institutions:

Reduced cost of compliance efforts by simplifying and standardizing compliance processes and reducing the need for manual intervention
Increased flexibility and growth opportunities due to the efficiency gains RegTech solutions provide;
Data analytics enables regulatory information to be analyzed, helping organizations proactively identify risks and issues and remedy them in an efficient manner;
RegTech enables risk and control frameworks that can be seamlessly linked.

Attributes of RegTech Solutions

Due to the complexity and momentum of regulatory changes, RegTech solutions must be customizable and easy to integrate into a variety of environments. No two institutions are alike but properly designed RegTech solutions should help to guide institutions to a better overall compliance posture.

RegTech solutions are usually cloud-based, providing the ability to maintain, manage and back-up data remotely, while ensuring all data is secure in a cost-efficient manner. The level of agility that cloud-based solutions offer ensures a high level of security and control over an institution’s compliance data. Overall, the technology is designed to reduce implementation time, enabling financial institutions to spend more time focusing on revenue-generating activities.

What do regulators think of RegTech?

Regulators around the world have been encouraging the adoption of RegTech. Many RegTech solutions enable financial institutions to not only streamline their reporting, but also have better oversight of their data. This makes it easier for regulators in the event they need to review time-sensitive information.

The need to ensure compliance and regulatory requirements are met has spawned new activity in the financial services arena. The use of technology to help streamline and automate the time-consuming processes of monitoring compliance and regulatory changes, risk monitoring and regulatory reporting will continue to gain momentum as regulations evolve and regulators expectations grow. RegTech solutions are quickly becoming standard operating tools for all financial organizations.

Safe Systems has combined compliance and technology to create RegTech solutions for financial institutions for over 25 years.

27 Sep 2017

Banks, Credit Unions, Technology Jamie Davis 0 comment

Debunking the Top 5 Myths about Outsourced IT Network Management Systems

To manage complex IT networks, bank and credit union IT administrators need the proper tools to monitor the network, maintain patches, apply anti-malware, and troubleshoot network issues effectively. With constant technological change and increasingly strict regulatory guidelines, many community financial institutions struggle to efficiently administer these tasks and meet examiner expectations.

To counter these mounting pressures, community financial institutions are, or should be, looking for ways to more efficiently manage their networks. Often, outsourcing this function and the underlying IT operations proves to be the most effective and efficient solution, but some financial institutions are hesitant to outsource or have misconceptions when it comes to outsourcing their IT needs.

Some of the top myths about outsourcing IT network management include:

Outsourcing is too expensive

While it is true that outsourcing can be expensive, the benefits have proven to consistently outweigh the cost. Outsourcing IT network management removes routine, repetitive tasks for your staff so your team can work on higher value projects, and distributes the work to ensure you maintain business continuity. Additionally, an outsourced provider typically has certified engineers who will monitor devices, maintain patch updates, and help you resolve complex issues, even when your employees are away from the office.

A local provider is better because they can come to our location to fix a problem

It is simply no longer necessary for IT partners to be onsite to manage a network. In fact, it may be difficult to find a local vendor with the banking technology and regulatory expertise required to meet examiner expectations.

An experienced outsourced IT services provider can help your institution recover quickly from unexpected business outages in your community. If a disaster does occur, local providers actually add a level of risk as they could also be out of service as well, increasing your recovery time and putting your organization at risk. The right IT partner understands the nuances of the financial services industry and can provide uninterrupted service, no matter the distance or circumstance.

Without a bad exam, everything must be okay

Regardless of location and size, small community banks and credit unions are under most of the same regulations as larger institutions, forcing a small IT staff to be well-versed in all regulatory guidance from cybersecurity to disaster recovery to meet examiner expectations. Auditors and examiners expect thorough documentation to prove that the institution’s daily practices match its defined policies and procedures. Financial institutions should not wait for a negative review finding to take a proactive approach to network management. Working with service providers that have dedicated staff and experts who understand the financial industry’s regulatory requirements and best practices ensures the required planning and reporting is completed in a timely manner.

Outsourcing replaces the institution’s IT personnel

There are hundreds of tasks that a small IT staff must complete on a regular basis to keep the bank’s operations running efficiently. Many community financial institutions have limited in-house resources dedicated to IT network functions. If a critical staff member goes on a vacation, is out sick, or leaves the bank, it can be difficult for the institution to manage the network effectively and maintain compliance.

Outsourcing helps to augment the bank’s current staff to act as an extension of the IT team. An IT partner can provide bank IT employees with more time to work on strategic projects, support front-line employees and focus on other revenue-generating activities. With an outsourced IT service provider, financial institutions gain an entire team of IT professionals equipped with advanced technology experience to support their IT needs. The staff is empowered, not replaced.

It’s better to do everything with the core provider

Without a doubt, the core banking platform is central to all financial institutions. However, you may be taking unnecessary risk by relying on them for all your needs. An IT services provider can help alleviate the stress by evaluating the infrastructure of the bank without bias, and eliminating the unnecessary hardware, processes and tasks, helping with overall management and ongoing cost. Whether it be network management, security, or compliance, it is unlikely your core will match the expertise a specialized partner can offer. Network management providers offer unbiased advice, while also diversifying your risk.

Many financial institutions struggle with choosing the right solutions partner. Smaller institutions in particular can benefit from outsourcing or partnering with a provider who offers network management solutions exclusively tailored for community banks and credit unions. Having a system in place that offers key features such as patch management, third party patching, antivirus, hardware and software inventory management, vulnerability remediation, and compliance-focused reporting to verify that your financial institution’s network is adhering to your policies and procedures is critical in today’s environment.   

Safe Systems’ NetComply® One IT Network Management service is designed to help ensure community financial institutions operate even more efficiently, securely and compliantly, while also decreasing costs, increasing performance, and improving an organization’s overall compliance posture. NetComply One streamlines your IT strategy and sets you up for success. Safe Systems’ IT network management solution was built using experience from managing IT networks for more than 300 financial institutions. Safe Systems’ combined years of banking knowledge and regulatory expertise allows us to truly understand banking IT operations, the unique platform configurations of financial institutions as well as the enhanced regulatory requirements.   

For more information, read our white paper, “Dispelling 5 IT Outsourcing Myths within Financial Institutions.”

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

13 Sep 2017

Banks, Credit Unions, Technology Marshall Jones 0 comment

The Importance of Network Management Systems in Community Banks and Credit Unions

SKIP AHEAD:

Key Components of a Network Management System for Financial Institutions
Benefits of Outsourcing the Oversight of Network Management Systems
Compliance Considerations for a Network Management System
Service Provider Considerations

The Importance of Network Management Systems in Community Banks and Credit Unions

The advancement of mobile phones, Wi-Fi, remote deposit capture, virtual infrastructures, shared storage and the growing demand from customers to have 24/7 access to their financial lives has changed the business of banking. These changes have shifted the objectives of running a community financial institution away from simply needing to manage money and provide loans to include managing data and the IT networks that carry this information. From the teller line and the loan origination system, to the phone and alarm systems, most modern institutions are highly interconnected and must have a strong IT network infrastructure to offer a variety of services to their customers and keep operations running smoothly.

To ensure all systems are continuously functioning, it is important to monitor hardware and software for failures, viruses and malware, and stay up to date on required maintenance functions. Many IT professionals utilize network management systems to help streamline this process and more efficiently perform their day-to-day functions. A network management system is a set of hardware or software tools that allow an IT professional to supervise and manage the individual components of a network within a larger network management framework. These systems help to provide a deeper understanding of the network and all important applications to help improve performance and ensure security. Having a centralized solution in place that automatically reviews the network, sends alerts, issues tickets, and provides support and reporting for servers, workstations, network routers, switches, software and other devices is an integral and critical function in financial institutions today.

Key Components of a Network Management System for Financial Institutions

To help ensure community financial institutions operate more efficiently, securely and compliantly, IT professionals should implement a network management system designed specifically for financial institutions to further decrease costs, increase performance, and improve their compliance posture.

Some key components of a network management system include:

Top 3 IT Management Worries for CEOs in Banking - Get a Copy

Network Device Discovery — the ability to identify what devices are present on a network;
Network Device Monitoring — the ability to monitor at the device level to determine the health of network components and the extent to which their performance matches capacity plans and intra-enterprise service-level agreements (SLAs);
Network Performance Analysis — the ability to track performance indicators such as bandwidth utilization, packet loss, latency, availability and uptime of routers, switches and other Simple Network Management Protocol (SNMP) enabled devices;
Intelligent Notifications – the ability to configurable alerts that will respond to specific network scenarios by paging, emailing, calling or texting a network administrator;
Mobile and Cloud Support – the ability to offer mobile and cloud support is important for the financial industry because users require 24/7 access to their financial data no matter where they are;
Integration – the ability to easily integrate with a variety of technologies in place at the institution and work seamlessly together;
Automated Intelligence – the ability to eliminate the need for IT staff to directly administer challenging and time consuming tasks such as patch management, anti-malware updates, and reporting. Automating these functions saves time while ensuring all patches are up to date. It also reduces the device exposure through server hardening;
Centralized Monitoring Console – should include remote control access and monitoring capabilities;
Dual Factor Authentication — enabling secure log-in to the system;
Enhanced Reporting Functions — featuring reporting based on FFIEC requirements for IT audits; and
Security services — to protect the institution servers.

All of these features provide IT professionals with greater visibility into the network, increased security of the bank’s servers, and time-saving automation to streamline processes and focus on more valuable tasks. Community banks and credit unions are able to keep up with updates and changes to the system through alerts that notify IT personnel when there is a change or threat to the network. In addition, many network management systems are designed with compliance in mind to account for updates to banking regulations and changes as they occur. This allows financial institutions to stay ahead of the curve and ensure adherence to all regulatory requirements.

Benefits of Outsourcing the Oversight of Network Management Systems

Success Story: Peoples Bank of Georgia - Get a Copy

While the evolution of network management systems has made many processes and procedures more streamlined and efficient, the management of network management systems has also become a full-time, demanding responsibility. A financial institution’s IT staff must understand the ever-growing complexity of IT operations and applications, continuously changing regulatory requirements and FFIEC compliance guidelines. IT network administrators must be familiar with the challenges presented by overseeing networks that extend through multiple environments and must also understand concepts such as application delivery optimization and data analytics.

Even though the list of duties and level of complexity has grown substantially in recent years, many community financial institutions still rely on one or two-person staffs to manage all of the institution’s IT operations. Finding, training, and retaining qualified staff to manage an IT network can also demand considerable time and energy from a bank’s management team, which redirects valuable resources needed to support customers and banking operations.

With these mounting pressures, community financial institutions are, or at least should be, looking for ways to more efficiently manage their networks. Often they determine outsourcing this function and the underlying IT operations is the most effective and efficient solution. Community banks and credit unions can benefit in many ways from outsourcing with a provider who offers IT network management solutions exclusively tailored for community financial institutions and are also able to act as an extension of their organization and help augment internal IT resources. Such partners bring knowledge, additional resources and compliance expertise to help community banks and credit unions control and manage their complex IT environments and operate in today’s financial services arena with a greater degree of confidence.

An IT network management provider who is specialized in the financial services industry truly understands the evolving complexity of community banks’ IT operations and will have the knowledge to do an in-depth review of institution’s network environment. The provider can offer additional support in co-managing IT operations, providing financial executives with the assurance that their institution’s IT network is functioning efficiently, optimally, securely, and is in compliance with industry regulations.

A technology service provider can also help consolidate, automate and manage many of the administrative functions that are so time-consuming for in-house staff. Automating patch management and reporting saves bank IT administrators a great deal of time. In addition, providing financial executives the ability to receive live information for diagnostic or reporting purposes, as well as remote access to the network not only saves time and improves efficiencies, but also helps meet the responsibilities of financial IT managers for documenting the environment for regulators.

Compliance Considerations for a Network Management System

Regardless of location and size, banks and credit unions are all subject to largely the same regulations, which are continually changing. Meeting expectations and adequately preparing for an exam are top concerns for many financial institutions. The entire exam process, from preparation to providing accurate responses to reviewing and remediating findings, can be an extremely time-consuming and stressful process to complete. A network management system can help ensure community financial institutions increase efficiencies by automating the myriad of tasks associated with exams and regulatory requirements, and produce custom reports based on FFIEC requirements. Network management systems designed with compliance in mind are able to account for updates to banking regulations and changes as they occur, which allows financial institutions to stay ahead of the curve and ensure adherence to all regulatory requirements.

In addition, due to the volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council (FFIEC) designed the Cybersecurity Assessment Tool (CAT), which plays a major part in helping financial institutions identify risk and understand their cybersecurity preparedness. The CAT provides a clear set of standards to ensure an institution’s network systems are managed efficiently and compliantly. Network management systems help organizations comply with the CAT by offering protections such as risk identification, network border protection, inventory of assets, auditing of the network, dual-factor authentication, and remote access. Failure to comply with FFIEC guidelines puts a financial institution at risk of doing poorly on exams, being written up for not following protocols, and spending large amounts of time correcting violations, which can all lead to reputational damage and loss of revenue.

The New Era of RegTech

Building Compliance into Your Financial Institution’s Processes

Service Provider Considerations

Selecting an IT services provider is challenging and many financial executives struggle with choosing the optimal solution to work with — and truly benefit — their organization. When looking for a technology service provider, some areas to consider include:

Does the provider offer flexibility in their support services that align with your organization’s IT needs?
Does the technology service provider have knowledge and expertise of all the regulatory requirements of financial institutions?
Are their support center staff and system engineers well-versed in network and security technologies, as well as understand the unique technical requirements of your core banking platform and ancillary applications?

Financial institutions rely heavily on technology to deliver financial services to their customers and members. Delivering the right solutions in a timely and cost-effective manner can be a challenge for some. Resources are limited, the top talent is hard to find, and at the same time, network management systems continue to evolve and change, and security risks and examiner expectations continue to grow. Partnering with companies that can provide the tools and resources necessary for financial institutions to help manage technology and reduce burdens, provides greater visibility of the network management system as well as the documentation needed to verify the institution is adhering to regulations.

Ultimately, network management systems that are designed exclusively for community financial institutions can assist in taking the pressure off of increased examiner expectations and the increase in technology complexity. These systems enable community banks and credit unions to thrive in the complex world of banking by continuing to provide the hands-on attention to customers and members that set community financial institutions apart from the competition.

23 Aug 2017

Banks, Compliance, Credit Unions Chuck Copland 0 comment

Disaster Recovery Planning: How to Prepare Your Bank for Fall Storm Season

Disaster Recovery Planning - How to Prepare Your Bank for Fall Storm Season

The potential damage that storms can inflict underscores the importance of Business Continuity Planning and disaster preparation, especially for local community banks and credit unions. A single disaster event, be it a hurricane, tornado, earthquake, severe thunderstorm, etc., has the potential to devastate communities by disrupting thousands of businesses and organizations and impacting millions of lives. While disasters do not take any seasons off, historically some of the worst storms actually hit during the fall months. A lack of proper planning and preparation could be particularly devastating for a financial institution impacted by a fall storm, as their customers will expect prompt access to their money in the aftermath of such an event. Moreover, regulators have expectations of their own, and financial institutions could face poor examination scores, fines, or increases in FDIC insurance costs. But who has the time to undertake such a big project? BCP/DR planning is especially challenging for smaller community financial institutions who often lack the staff and resources of larger institutions.

It is imperative that financial institutions have a solid Business Continuity Plan (BCP) and Disaster Recovery (DR) procedures in place and are able to implement them, as required by Federal Financial Institutions Examination Council (FFIEC) guidelines. These plans are instrumental to make sure that people, process, and technology elements are all properly coordinated to efficiently recover from disasters or business interruptions. In a disaster situation there is a stark difference in the reaction from financial organizations who have a disaster plan in place and those that do not. A solid and actionable BCP can literally be the difference between a temporary outage, and an institution closing its doors forever.

Preparing for Fall Storms

Aside from having a BCP and associated DR plan in place and the skills necessary to execute those plans, there are several additional steps your financial institution can take to adequately prepare for storms, natural disasters, and any other business outages, including:

Evaluating all backups and ensuring any redundant equipment critical to recovery is up-to-date and working;
Utilizing Uninterruptable Power Supplies (UPS) for short-term outages in power or preemptively shutting down servers and all IT equipment in anticipation of an extended outage;
Ensuring that the server room is locked with separate key access and that all equipment and sensitive documentation is otherwise secure if facilities must be vacated for an extended period;
Validating the procedures outlined in BCP/DR plans through functional testing; and
Ensuring that employees, vendors, and customers are aware of the proper communication protocols and contacts through educational efforts.

Common Issues and Solutions

Banks and credit unions that try to manage their own technology solutions, including backups, email, and server management, often get mired in day-to-day operational concerns. This leaves precious little time for the institution to make plans for potential disasters. The result is often a plan that does not truly consider all the processes and functions that go into running the business. This can leave significant gaps in recovery capabilities that might remain hidden to internal stakeholders without proper testing.

These issues can be avoided by working with an IT service provider who understands the unique needs each financial institution has when preparing for and recovering from a natural disaster. To ensure your institution is prepared for storm season and doesn’t run into the common issues mentioned above, partner with an IT service provider that offers the following:

Recovery plan testing on an annual basis;
Remote and secure back-ups;
Compliant data recovery practices; 
Readily available staff and engineers; and 
Proactive communication.

Fall storms and natural disasters cannot be prevented, but proactively knowing where to go, who to contact, and what critical functions to restore first can provide confidence when responding to a disaster. Developing, implementing, and regularly testing disaster recovery procedures as part of your business continuity plan is crucial in today’s banking environment. At Safe Systems we have been working with banks and credit unions for more than 20 years. Our proven experience enables us to provide the services and assistance necessary to help our customers weather the storm with minimal business interruption.

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture

15 Aug 2017

Banks, Compliance, Credit Unions Jamie Davis 0 comment

Bank Compliance: How to Efficiently Respond to IT Exam Findings

Bank Compliance How to Efficiently Respond to IT Exam Findings

Community banks and credit unions have grown accustomed to the strenuous review processes of regulatory agencies on their practices and procedures. These reviews are designed to help ensure the stability of the organization and the adherence to laws and regulations and are thorough in scope. As a result, preparing for an exam can be an extremely time consuming and stressful process to complete and, for many institutions, providing accurate responses to the review findings in a timely manner can be quite a challenge.

Upon the completion of the on-site visit, the reviewing agent will provide the financial institution with his or her findings in a review report or a notice. This report requires a response from the bank or credit union outlining the institution’s plan for correcting or improving specific findings from the review. Some proven tips for writing a response include:

Make your responses clear and concise
Respond directly to the finding and recognize any recommendations the reviewer suggests
Outline specific actions that the financial institution commits to take to correct the finding
Assign who is directly responsible for the implementation and oversight
Exclude information that is not pertinent to the finding or its corrective action plan
Provide a specific — and realistic — timetable for implementation.

Typically, a regulatory agency will not revisit the findings again until the next review. It is up to the financial institution to address each point and provide the proper documentation to show these items have been corrected before the next meeting. For example, if the bank’s antivirus was listed as out of date on the findings report, the institution would have to update each machine, run a report, and include this information in the findings package to be reviewed by the regulatory agency during the next visit. To complete the process efficiently, banks must keep up with who is in charge of each specific action item, when the item is due for completion, and which reports should be included in the findings package.

Organize Your Efforts to Complete Review Findings

Safe Systems’ Audit Trail application helps financial institutions efficiently respond to the reviewing agent’s feedback and ensure each finding is completed in a timely manner. The application allows the user to input review findings into the system, customize reporting fields, assign each finding to specific team members and include due dates to ensure all updates are completed. This allows banks to automate the review finding process as opposed to a manual process such as a spreadsheet, providing a more effective, centralized way to address this complex project.

The Audit Trail application also allows the user to attach relevant documents and reports to each finding, making it easier to verify that each item has been corrected. In addition to this, all documents are housed in one centralized location to avoid reliance on one person for documents and reports usually stored on an individual computer. The document library helps to reduce the risk of data loss due to computer failure and ensures that all important information is readily available to complete the findings package.

Responding to review findings can be challenging, time consuming and stressful! However, working with Safe Systems can provide your financial institution with the right tools to keep this process organized and meet regulatory expectations. Streamlining this process helps community banks and credit unions improve on IT and compliance procedures in a timely manner and effectively demonstrate how the institution has addressed the reviewing agent’s feedback.

08 Aug 2017

Banks, Compliance, Credit Unions Jamie Davis 0 comment

How to Beat IT Exam Stress and Boost Efficiency for Your Bank

External audits and exams have become a fact of life for financial institutions of all sizes. Community banks and credit unions undergo strenuous reviews of their procedures and practices anywhere between six and 18 times a year. While these reviews are designed to help ensure the stability of the organization and the adherence to laws and regulations, preparing for these events can be an extremely time consuming and stressful process to complete.

Most reviews consist of two phases – preparation and findings. At the beginning of the process the reviewing agent typically sends financial institutions a list of items that they want to review, certain areas they plan to examine and items they plan to discuss with the organization. This list normally includes a number of reports and documentation the financial organization must prepare ahead of the review and provide to the reviewing agents before the on-site visit. Some only require a handful of reports to prepare up-front, but others can request more than 60 different reports. Some of the reports and information that may be requested include:

Organizational Charts
Financial Reports
Business Continuity Plans
Disaster Recover Plans and Test Results
Vendor Management Policies
Security Policies

Often there is one person in charge of the review and they must work with each department to gather information by the designated due date. All files must then be stored in a central location, follow the template the reviewing agents have requested and be in a format that can be transmitted securely to the requesting party. Gathering all this information and ensuring all documents are complete and accurate can be a challenging task for smaller community banks and credit unions with limited in-house resources and staff.

Streamline the Pre-Exam Preparation Process

The Safe Systems’ Audit Trail™ application is designed to help financial institutions efficiently manage the preparation process. The application allows the user to import a variety of file types and formats, utilize the field matching wizard, and easily standardize items across the system despite the varied nature of the templates provided by the different agencies. To eliminate the mundane task of collecting the same documentation over and over, the application allows you to pull system reports directly from a variety of other Safe Systems’ services housed in theSafe, and store them in a central library so they are easily accessible the next time you need them.

All preparation reports are housed in the Audit Trail solution, meaning there is no duplication of documents; reports do not need to be saved in various folders; and the financial institution has peace of mind in knowing the most accurate and up-to-date information is sent to the reviewing agent. In addition, once all the preparation documents have been completed, a preparation item package is created in the form of a zip file, which makes it easier to input all the documents designated for the review into the reviewing agent’s delivery system. A report or manifest of documents attached to each audit is created, giving the financial institution a record of each review.

Preparing for an audit or exam can certainly be a headache! However, working with Safe Systems can provide your financial institution with peace of mind by ensuring you are well prepared and can feel confident for any upcoming review. Safe Systems provides financial institutions with a trusted resource and technology advisor, leading to a seamless and time efficient preparation process.

02 Aug 2017

Banks, Compliance, Credit Unions, Security, Technology Safe Systems 0 comment

How to Stay Vigilant with Technology and Compliance Issues During the Summer Vacation Months

For many community banks and credit unions, keeping up with the ever-changing regulatory requirements and expectations can be a challenge, especially during the summer months when employees are taking time off to enjoy the warm weather and travel for summer vacations. The Federal Deposit Insurance Corporation (FDIC) actually encourages mandatory vacation time for bank employees of all levels. However, this can be a challenging time for many community institutions that have a small staff and rely on key individuals to make sure all activities related to technology, compliance and regulatory requirements are completed. So, what happens when the person(s) responsible for these crucial aspects of the institution goes on vacation?

Many financial institutions are turning to IT and security service providers to act as an extension of their organization and help augment internal technology and compliance resources. The right third-party solution provider can serve as a true partner and work alongside current staff to manage the technology, compliance and regulatory aspects of the institution. When the technology or compliance staff is out or unavailable, outsourcing select business processes helps fill the personnel gap and provide added stability for the institution and peace of mind to all. 

A service provider can help automate and manage many of the administrative functions that normally fall to the technology or compliance department, making it less daunting for employees to take time away from the office. These service providers can automate technology functions that are required to stay vigilant with compliance and security procedures, such as patch management and reporting, vulnerability remediation, proactive network monitoring and issue resolution, vendor management, business continuity planning, cybersecurity, and compliance-focused documentation and reporting.

The right service provider should offer your financial institution full support for the demands of today’s technology, compliance and regulatory requirements. At Safe Systems we understand the complexity of community bank and credit union operations and the associated regulatory expectations. With more than 20 years of service in the financial industry, working with more than 600 institutions, and actively managing 20,000+ devices, Safe Systems has gained a unique perspective on what is important to financial institutions and to the regulators that oversee them. We want to provide you with assurance that your institution is functioning securely and is in compliance with industry regulations at all times; but, especially when your institution’s key technology or compliance personnel are out of the office.

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture

26 Jul 2017

Banks, Compliance, Credit Unions Holly Hooks 0 comment

Top 4 Missing Declarative Statements in the FFIEC’s Cybersecurity Assessment Tool

Top 4 Missing Declarative Statements in the FFIECs Cybersecurity Assessment Tool

With the heightened risk of cybersecurity attacks for financial institutions, many community banks and credit unions are completing the Federal Financial Institutions Examination Council’s (FFIEC) Cybersecurity Assessment Tool (CAT) to assess their cybersecurity preparedness, determine their next steps to strengthen their maturity and better meet examiner expectations. The assessment consists of two parts, Inherent Risk Profile and Cybersecurity Maturity. The Inherent Risk Profile assesses the risk posed by Technologies and Connection Types, Delivery Channels, Online/Mobile Products and Technology Services, Organizational Characteristics, and External Threats. Then, Management evaluates the Cybersecurity Maturity level for five domains.

According the FFIEC’s Cybersecurity Assessment Tool Overview for Chief Executive Officers and Boards of Directors, “Cybersecurity Maturity includes statements to determine whether an institution’s behaviors, practices, and processes can support cybersecurity preparedness.” Declarative statements within each domain are assessed on maturity levels ranging from baseline to innovative. Financial institutions determine “which declarative statements best fit the current practices of the institution. All declarative statements in each maturity level, and previous levels, must be attained and sustained to achieve that domain’s maturity level.”

Since the introduction of the CAT in 2015, we have been assisting community banks and credit unions with completing this process. Based on our experience, which consists of more than 100 reviews of the CAT to date, we have identified four declarative statements that community financial institutions are struggling to complete:

Domain 4 – External Dependency Management – Connections

Data flow diagrams are in place and document information flow to external parties.”

According the FFIEC’s Information Security Handbook, “these diagrams should identify hardware, software, and network components, internal and external connections, and types of information passed between systems.” Regulators are looking for financial institutions to demonstrate solid understanding of where data is going and what type of data is being transmitted to third-parties.

Domain 1 – Cyber Risk Management and Oversight – Training and Culture

“Customer awareness materials are readily available” (e.g., DHS’ Cybersecurity Awareness Month materials)

Customer awareness materials, according to the FFIEC Information Security Handbook, are used to “increase awareness of the fraud risk and effective techniques customers can use to mitigate the risk.” These materials should “consider both retail and commercial account holders.” It is important for community banks and credit unions to communicate effective risk management strategies to their customers. The declarative statement references the US Department of Homeland Security’s website. The Stop.Think.Connect Toolkit has resources Financial Institutions can utilize to provide awareness material to customers.

Domain 3 – Cybersecurity Controls – Preventative Controls

“Domain Name System Security Extensions (DNSSEC) is deployed across the enterprise.”

DNSSEC is a technology developed to digitally ‘sign’ data to ensure it is valid and from a trusted source. By enabling this, an institution would be less susceptible to DNS spoofing attacks. However based on the experience of Safe Systems engineers, DNSSEC may cause issues throughout an organization’s systems. There are other technical tools financial institutions can implement that will enable them to meet the spirit of the statement without deploying troublesome tactics.

Domain 1 – Cyber Risk Management and Oversight – Oversight

“The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.”

Regulators are looking to ensure financial institutions have a cyber risk appetite statement in place that has been approved by the Board. In fact, risk appetite is mentioned more than 17 times in the CAT. Cyber risk appetite is an assessment of how much cybersecurity risk management is willing to accept to meet the goals and objectives of the institution’s strategic plan. To read more on how to develop a cyber risk appetite, visit the Compliance Guru Blog.

Financial institutions should review their current CAT responses, specifically the declarative statements in the Baseline maturity level that have been answered “No” or that they are struggling to complete to determine if there is a way to implement a compensating control. Adding in compensating controls may allow them to answer the question in the affirmative and ensure the institution is in compliance with regulatory requirements.

For more information, please download our white paper, Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture.

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture

20 Jul 2017

Banks, Compliance, Credit Unions Christine Ray 0 comment

Lumbee Guaranty Bank Streamlines Cybersecurity Processes with Safe Systems’ Cybersecurity RADAR Application

The number of cyber-attacks directed at financial institutions of all sizes is continuing to grow and cybersecurity experts expect the trend toward increasingly sophisticated cyber-attacks to continue. Community banks and credit unions are prime targets for cyber criminals due to the sensitive data they house. As consumers and businesses continue to use electronic devices such as computers, tablets, and smartphones to perform financial transactions online, vulnerabilities continue to increase. A cyber breach can be devastating due to the costly ramifications, not to mention compromised customer confidence and reputational damage.

As a result of this heightened risk of cybersecurity attacks, regulators are heavily scrutinizing bank processes to verify that these institutions can effectively safeguard sensitive financial information. While not yet a requirement, the FFIEC’s Cybersecurity Assessment Tool (CAT) serves as the key guidance used to determine whether an institution is adequately prepared for a cybersecurity incident and in full compliance with federal regulations. In response, many banks and credit unions are now completing the assessment to assess their cybersecurity posture, determine their next steps to strengthen cybersecurity processes and better meet examiner expectations.

While completion of the assessment has proven itself beneficial, many financial institutions find the 100+ page assessment to be too cumbersome of a task to successfully manage and fully understand. As a result, they decide they need to find a more efficient way to complete the assessment, understand their level of risk and make improvements to their IT environment.

This was the case for Pembroke, N.C.-based Lumbee Guaranty Bank. To ensure his institution maintained compliance, Austin Maynor, Information Security Officer at Lumbee Guaranty Bank, manually filled out the CAT with the help of a spreadsheet, but quickly found this process to be an extremely time-consuming project to complete. He determined the bank needed a solution that could give them a better understanding of where they were in terms of cybersecurity preparedness and where they needed to be in order to maintain compliance.

Streamlined CAT Completion Solution

As a long-time customer of Safe Systems, the bank decided to implement the Cybersecurity RADAR™ solution, a cybersecurity product that combines compliance expertise with an Enhanced Cybersecurity Assessment Tool (ECAT) application. The solution allows staff to quickly generate reports, document notes and save examination results to review each year.

For Lumbee Guaranty Bank, Cybersecurity RADAR streamlined the process of filling out the CAT and helped the bank improve its cybersecurity processes. With the automated application, Lumbee Guaranty Bank significantly reduced the amount of time spent completing the CAT from days to less than 4 hours. In addition, Safe Systems’ evaluation of the bank’s responses helped clearly illustrate to the bank where they were in regards to compliance and baseline expectations.

“The Cybersecurity RADAR solution has been a great addition to our bank, helping us gain meaningful operational efficiencies while continuing to grow and strengthen our cybersecurity program. We are grateful to have a true partner like Safe Systems helping us navigate the latest compliance guidelines and effectively streamline our most important processes.”

For more information, download our cybersecurity case study, “Lumbee Guaranty Bank Streamlines Cybersecurity Processes.”

Lumbee Guaranty Bank Streamlines Cybersecurity Processes

Learn how they increased cybersecurity preparedness and streamlined the CAT

12 Jul 2017

Banks, Compliance Jamie Davis 0 comment

How to Better Understand Your Bank’s Results from the CAT

The Federal Financial Institutions Examination Council (FFIEC) published the Cybersecurity Assessment Tool (CAT) in June 2015 to help financial institutions better identify and evaluate their cybersecurity risk awareness and readiness. The tool consists of a comprehensive set of questions to evaluate the cybersecurity risk of a financial Institution and is designed to encourage consistent analysis, evaluation, and examination of cybersecurity risks for financial institutions.

The CAT essentially consists of two parts, 1) Inherent Risk Profile and 2) Cybersecurity Maturity. The Inherent Risk Profile identifies the institution’s inherent risk before security measures have been implemented. It is a stage approach in which, once the Inherent Risk Profile has been determined, financial institutions then focus their attention on the Cybersecurity Maturity section.

Successful completion of the CAT for Inherent Risk and Cybersecurity Maturity provides financial institutions with practical insight in two specific areas:

Risk Grade

Completion of the Inherent Risk Profile gives financial institutions a risk grade in each potentially vulnerable security area, such as payments, teller processes and online banking operations. This gives the financial institution insight into how examiners are likely to see their relative risk exposure.

Gap Analysis

Completing the Cybersecurity Maturity section helps financial institutions form a gap analysis to better identify missing controls and process. To increase the level of cybersecurity maturity, financial institutions should continually implement changes and monitor their progress, and the gap analysis is the first step in this process.

The CAT also enables financial institutions to review their Inherent Risk Profile in relation to their Cybersecurity Maturity results, which will indicate if they are aligned. As one might expect, as inherent risk rises, an institution’s maturity level should also increase. However, an institution’s inherent risk profile and maturity levels will change over time as threats, vulnerabilities, and operational environments change, making it necessary for institutions to complete the CAT periodically or when making adjustments to their organizations.

It is important to note that while there are online tools available to complete the CAT, the key is in making those results actionable, which may require third-party expertise. That is why Safe Systems developed the Cybersecurity RADAR solution which combines compliance expertise with an Enhanced Cybersecurity Assessment Tool (ECAT) application to help document notes for examiners, create reports and maintain an up-to-date record of the assessment. Safe Systems also provides a knowledgeable team to provide expert advice and support to ensure a more streamlined assessment process.

The CAT is now the baseline many auditors are using, so completing it (and more importantly, understanding the results) enables financial institutions to address cybersecurity risks and meet examiner expectations with confidence. Working with a trusted IT partner enables financial institutions to realize significant operational efficiencies in its CAT assessment reviews and reporting, leading to a better understanding of regulatory expectations to help enhance their cybersecurity posture. Safe Systems can help financial institutions manage their cybersecurity program in a more time-efficient manner to ensure they meet their compliance needs.

For more information, please download our white paper, Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture.

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture

28 Jun 2017

Banks, Compliance, Credit Unions Darren Bridges 0 comment

The CAT Isn’t Mandatory, So Why Should We Complete It?

The CAT Isn’t Mandatory, So Why Should We Complete It

Due to the increasing volume and sophistication of cyber threats financial institutions are facing, the Federal Financial Institutions Examination Council (FFIEC) developed the Cybersecurity Assessment Tool (CAT) to help institutions identify their risks and determine their cybersecurity preparedness with a repeatable and measurable process. The CAT helps financial institutions weigh specific risks such as gaps in IT security, versus controls or solutions aimed to prevent, detect and respond to these threats and determine areas for improvement. Each institution is then responsible for identifying its own risk appetite and establishing its desired level of maturity. Using the CAT, financial institutions can understand where their security practices fall short and how to effectively address those gaps.

When the CAT was initially released in 2015, it was promoted as a free and optional tool available to financial institutions to help assess their cybersecurity preparedness. However, regulatory agencies including the Federal Deposit Insurance Corporation (FDIC) and the National Credit Union Administration (NCUA) have announced plans to incorporate the assessment into their examination procedures. Today, many examiners are using the tool to assess an institution’s cybersecurity readiness and have already begun to issue citations to financial institutions that have lapses or are not meeting expectations.

Even though the CAT is voluntary, all financial institutions are required to evaluate inherent risk and cybersecurity maturity in some way, which requires a robust assessment program. Completing the CAT is a good way to prepare for audits since the guidelines provide community banks and credit unions with detailed information on the federal government’s expectations for cybersecurity preparedness. The CAT enables financial institutions to identify vulnerabilities, fill in security gaps, and demonstrate a stronger security posture before the examination begins.

In addition to meeting examiner expectations, completing the CAT benefits financial institutions by helping them:

Determine whether controls are properly addressing their identified risks
Identify cyber risk factors and assessing cybersecurity preparedness
Make more informed risk management decisions
Demonstrate the institution’s commitment to cybersecurity and
Prepare the organization for an upcoming audit.

When using the CAT correctly, it can provide a cost-effective methodology to help improve security, instill client trust, and avoid losses from a breach. For it to provide the greatest positive impact it should be completed periodically on an enterprise-wide basis, as well as when significant operational and technical changes occur. Completing the CAT helps community banks and credit unions understand the key risks they face and what controls they need in place to protect the institution’s data, leading to increased knowledge of regulatory expectations and a stronger, more compliant cybersecurity program.

For more information, please download our complimentary white paper, Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture.

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT: How Your Institution Can Improve Its Cybersecurity Posture

21 Jun 2017

Banks, Credit Unions, Technology Chris Banta 0 comment

Safe Systems’ Security Baseline Service Automates Server Hardening for a Secure Server Operating Environment

Safe Systems Security Baseline Service Automates Server Hardening for a Secure Server Operating Environment

In today’s technological landscape, where every computing resource is online and susceptible to attack and malicious activity, server hardening is an important process for financial institutions to have in place. Every day servers are targeted by harmful malware, ransomware, and other malicious attacks.

The best defense against these threats is to ensure that server hardening is a well-established practice within your community bank or credit union. Server hardening is the process of enhancing server security through a variety of means, which results in a more secure server operating environment due to the advanced security measures that are put in place during the hardening process.

One challenge financial institutions face is that running and maintaining server hardening services strains the resources of a limited IT staff. Banks and credit unions are already swamped with ensuring their servers are secure, which includes examining vulnerability assessment reports, fixing numerous findings, troubleshooting services, and addressing patch management, antivirus, and other activities on an ongoing basis.

To help streamline this time-consuming but essential process, Safe Systems designed its unique Security Baseline Service to work with its NetComply® One IT network management service to help automate the server hardening process. The Security Baseline Service leverages aggregate vulnerability scan data and remediates vulnerabilities across the service’s customer base. The service implementation includes a testing phase and ticketing notification to alert the institution of remediated vulnerabilities to help alleviate attacks and ensure networks are secure and up to date.

The Security Baseline process includes:

Remediation of emerging security vulnerabilities
Vulnerabilities identified by Safe Systems’ and its partners, which includes:

Evaluating commonly found vulnerabilities on a monthly basis
Determining significance of vulnerabilities
Writing remediation procedures for significant commonly found vulnerabilities

Monthly remediation across all subscribed devices
Ticket generated detailing remediation application results
Comprehensive report detailing individual fixes
Remediation of vulnerabilities outside our sampling group available upon request at an hourly rate

Many of the vulnerability findings banks receive are often related to software issues that are addressed by updates or patches that pass Safe Systems’ testing procedure and then seamlessly executed on a daily basis. To ensure compliance, these patches and processes are implemented based on the FFIEC’s patch management guidelines outlined in the 2016 Information Security Booklet.

Financial institutions utilizing Security Baseline also benefit from the prolonged testing period Safe Systems uses to verify that Service Packs and new Windows builds will work with existing software. This ensures updates will be supported by the networks and any new features introduced will not cause problems for the institutions. The extra level of testing helps banks and credit unions avoid unnecessary IT challenges and network issues, reducing downtime and freeing up IT staff to focus on more pressing activities.
At Safe Systems, our goal is to reduce the amount of time internal IT staff must spend on time consuming activities such as examining vulnerability assessment reports, troubleshooting services and patch management issues. We are constantly working to create automation to provide the best experience to our customers and ensure all networks are secure and in compliance with government regulations.

7 Reasons Why Small Community Banks Should Outsource IT Network Management

14 Jun 2017

Banks, Credit Unions, Technology Kai Xu 0 comment

Stay Ahead of the Curve! Windows 10 Updates Your Institution Needs to Know

Many financial institutions have just recently converted to Windows® 10, the latest operating system from Microsoft™ that was released July 29, 2015. Unlike previous versions of Windows, Windows 10 receives ongoing updates from Microsoft through a staggered update process that involves build numbers (Branch Releases) and regular build update (Branch Release) intervals to sustain the security of its signature product. These updates increase the build number and should be treated as a new operating system install, meaning that, as the build numbers increase, Microsoft will stop supporting older build numbers of Windows 10. To put this in context, the initial Windows 10 Release Build Number was 1507 and Microsoft is now releasing build 1703.

Knowing key dates in a product’s lifecycle helps organizations make informed decisions about when to upgrade or make other changes to software. Microsoft ended support in May 2017 for build number 1507, which means it no longer provides automatic fixes, updates, or online technical assistance for this version. Without Microsoft support, financial institutions will no longer receive important security updates that can help protect PCs from harmful viruses, spyware, and other malicious software that can steal information and infect networks. Because of this, we recommend systems be upgraded before they reach their end of life whenever possible.

To better understand the Microsoft upgrade schedule, here is a chart from Juriba that outlines the Windows 10 Branching Release Updates and End of Life Support Timeline:

Windows 10 Timeline

Technical Issues with New Releases 

While a steady stream of build releases are great for resolving major issues and do provide a continuous flow of new features, the problem is that they pose a huge burden for in-house system administrators and IT professionals. These individuals are left deploying an often-insurmountable series of new builds and updates to machines both locally and remotely. While the updates are designed to increase security and address bugs in the system, they can be quite large and cumbersome to install. These large downloads have resulted in hung downloads, hung installations, download delays, and more. Microsoft addressed this issue by releasing the Universal Update Platform (UUP), designed to reduce download size for build updates. Recently, however, the ability to capture the UUP download files and convert them into an ISO was not working correctly. There is also the risk of data loss as some applications have proven to have compatibility challenges. Certain updates have also proven to kick machines off the domain and network servers and cancel out anti-virus and malware programs.

Staggered Update Plan

To help alleviate these issues and make the update process more seamless, we recommend implementing a staggered update plan. This approach helps reduce risk and minimize negative effects on productivity by not affecting an entire department or service. For example, implement the update on one or two teller machines, leaving a few untouched as to not affect the entire teller operation. This approach also gives you time to make improvements as needed and test for security issues while enabling the financial institution to operate its teller department.

Enlisting a Trusted Advisor

It is best for financial institutions to keep up with the latest technology, especially when it comes to keeping systems protected from malware and viruses that could lead to the equivalent of a virtual, modern day heist. As a trusted advisor exclusively serving financial institutions, Safe Systems is available to help along every step of the way. We have worked with more than 600 financial institutions and monitor more than 20,000 devices, and we understand the many considerations that go into providing secure, reliable IT. Safe Systems’ experts work directly with your team to better understand and tailor a solution specific to your needs. Please reach out to Safe Systems if you need assistance with your Windows 10 upgrade.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

07 Jun 2017

Credit Unions, Technology Scott Galvin 0 comment

5 Questions Credit Unions Need to Answer about WAN

From offering your members the service options they are looking for, to keeping up with regulatory demands, to ensuring day-to-day operations in a reliable and efficient manner, today’s credit union is asked to understand more about technology than ever before.

One area of technology that presents its own significant set of challenges is telecommunications. The telecom industry can be difficult to master for several reasons: First, despite the fact that it’s comprised of newer technology, it remains an “old school” industry with legacy players like AT&T and Verizon leveraging old fashioned, relationship selling vs. arming consumers with information and allowing them to select the best product for them.

Another reason is the pace with which the industry changes. From mergers and acquisitions, to technology advances and proliferation, one has to be plugged into the telecom industry on a full-time basis to really understand all of the available options. The result is that all of this churn and lack of visibility makes it difficult to design a telecommunications plan to serve and grow with your credit union’s technology needs. But where to start? Below are five questions to help guide you when building out your telecom plan:

What Are Your Credit Union’s Technological Needs Beyond Simple Bandwidth?

While bandwidth is the obvious factor that has always been considered, there’s more to think about than how fast your data moves when working to provide the best experience possible. Making sure you are built to withstand carrier outages, physical connection issues, and remote user connectivity (in addition to any unique needs that may be required by your service offerings) are all key considerations for your credit union to undertake.

What Are The Current Offerings in Your Area?

The pace with which technology is advancing and infrastructure is being installed requires you to evaluate all vendors in your immediate area to ensure you are making the best decision for your institution. It is wise to give the smaller telecom carriers consideration too as they can often offer a more competitive rate for the very same infrastructure that the larger providers are trying to sell you. Culturally, another reason to consider these smaller providers is the very same reason that a consumer should consider your credit union versus a mega-institution. This doesn’t imply you should move forward without doing your research into all providers, large and small, but don’t write any off immediately as you may risk giving up real value.

How Can Your Institution Reduce Risk?

As you develop your telecom plan, make sure that you are incorporating multiple technology platforms and providers into it. By varying your technologies and leveraging multiple providers, you effectively guard against outages of carriers and infrastructure. You may even wish to consider having the various connectivity points run to different ends of your locations to further guard against instances of digging crews taking your connectivity down all at once. Additionally, be sure to evaluate connectivity to each location from a business continuity standpoint, and be sure to consider broadband options in this process as they can provide some of the greatest value on the market today.

What Technologies Should Be Insourced vs. Outsourced?

Bandwidth can be expensive, especially if you are in a rural location without the benefit of multiple competitors for your business. Depending on your needs and your options, it may make more sense to employ internal technologies such as WAN acceleration instead of paying the price to add more bandwidth, a recurring cost that you will assume monthly. Other items to consider include use of a firewall and dual factor authentication to allow ease of access for remote users within a secure environment.

Should Your Credit Union Monitor and Manage Equipment Internally Or Outsource?

Both your communication equipment (i.e., routers and managed switches) and your security equipment (i.e., firewall) should be monitored 24/7 and managed in order to receive updates and ensure configuration changes are made properly. Additionally, you should consider whether this is a task that is best handled by internal personnel or outsourced to a managed service provider with established processes.

If you are looking to design a telecommunications plan for your credit union, Safe Systems has seasoned WAN and telecom engineers that will guide you throughout the process of choosing WAN carriers and the proper equipment to best fit your institution’s unique needs. There are a lot of choices, and we can ensure you get the right solution for your current and future technology requirements.

25 May 2017

Credit Unions Holly Hooks 0 comment

Stay Compliant! 3 Areas Your Credit Union Should Focus on to Better Meet Regulator Expectations

Credit unions establish relationships and partnerships with third-party providers to meet strategic objectives, enhance member services, and manage competitive pressures. When a credit union actively manages its third-party relationships, the institution can then provide a wide range of potential benefits to its members.

However, third-party relationships also come with a high level of risk for financial institutions, making it crucial for them to have a solid vendor management program in place to effectively manage their vendors. A number of regulatory agencies including the National Credit Union Administration (NCUA) provide guidance to help credit unions evaluate the risks of working with third-party providers and understand examiner expectations related to their vendor management processes.

In a Supervisory Letter, the NCUA identified the following 3 concepts that credit unions should address and examiners should ensure are commensurate with the credit union’s size, complexity, and risk profile:

Risk Assessment and Planning

Before entering into a new third-party relationship, credit unions should determine whether the relationship complements their overall mission and philosophy. The credit union should evaluate the risks and benefits of outsourcing this process with the risk and benefits of keeping it internal. An explanation of how the relationship relates to the credit union’s strategic plan, long-term/short-term goals, objectives, and resource allocation requirements should all be documented. The credit union should conduct an initial risk assessment that includes the evaluation of enterprise risks including compliance, strategic, and reputation.

Due Diligence

Conducting thorough due diligence includes demonstrating a strong understanding of a third party’s organization, business model, financial health, and program risks. To ensure the proper risk controls are in place, credit unions must understand a prospective vendor’s responsibilities and all of the processes involved. Examiners should evaluate if the credit union’s due diligence process includes background checks, examining the third-party’s business model, the determination of how cash flows move between all parties in the proposed third party arrangement, financial and operational controls, contract evaluation and accounting considerations.

Risk Measurement, Monitoring and Control

Credit unions must establish ongoing expectations and limitations, compare program performance to expectations, and ensure all parties are fulfilling their responsibilities. Credit unions should develop policies and procedures detailing the responsibilities of the credit union and third-party including management oversight and reporting. On-going monitoring of controls over the third-party relationship should be implemented to mitigate risks.

Reduce Risk, Increase Compliance with Vendor Management Software

Regulations repeatedly make it clear that the use of third-party vendors or service providers does not reduce the responsibility of your credit union to ensure that data is safe, secure and complies with all applicable laws, regulations and security best practices. While it is more important than ever for credit unions to manage their vendors, many struggle with the best way to efficiently and successfully accomplish this. Until recently, most credit unions had only a handful of managed vendors, which could be tracked manually via a spreadsheet. While this may have worked in the past, regulators’ expectations today are much more sophisticated.

To comply with NCUA regulations, every credit union must be able to provide proper documentation on the ongoing monitoring and management of its vendor management program. Automating vendor management functions not only saves your staff time but also helps to ensure the institution is in compliance with regulatory requirements. An automated vendor management solution is an effective tool to help credit unions reduce risks and improve examination results.

For more information, please download our white paper: Why Automation is the Answer to Credit Unions’ Vendor Management Challenge.

Why Automation is the Answer for Credit Unions’ Vendor Management Challenge

How confident are you in the management of your vendors?

23 May 2017

Banks, Credit Unions Christine Ray 0 comment

Carolina Alliance Bank Enhances Compliance Posture with Safe Systems’ Vendor Management Solution

Vendor management has taken on an increased level of importance as regulators are now more heavily scrutinizing how banks manage their third-party vendors. In response, many community banks and credit unions are looking for more efficient, effective ways to monitor their outsourced vendors, protect themselves from associated risks, and maintain overall compliance.

For South Carolina-based Carolina Alliance Bank, manually monitoring vendors through a spreadsheet simply became too time-consuming and cumbersome a task for its staff. The bank sought a proven solution that could help streamline vendor management processes and enable them to more efficiently manage contracts, renewals and other critical activities. As a long-time customer of Safe Systems, the bank determined that implementing this industry-specific, automated vendor management solution was the most cost-efficient method to control and manage the risks associated with its third-party providers.

Improved Compliance and Streamlined Processes

Using the manual spreadsheet method, it was sometimes difficult for the bank’s staff to provide the level of vendor reporting that regulators required. In contrast, Safe Systems’ Vendor Management solution enabled Carolina Alliance Bank to more easily provide the proper documentation to examiners and in doing so, clearly demonstrate that bank staff are properly reviewing and monitoring vendors on an on-going basis.

Furthermore, the bank is now able to centralize all documents in one location where staff and management can easily access them to provide detailed information for audit purposes and executive summaries for board review. Through this level of intelligent automation, paired with Safe Systems’ compliance support, the bank has significantly reduced the amount of time spent on vendor management processes, which has freed up resources to focus on additional revenue-generating activities for the bank.

“Since we switched over from a manual to automated process, we’ve received nothing but great feedback from regulators,” said Judy Price, Vice President at Carolina Alliance Bank. “Working with Safe Systems has enhanced our ability to meet regulatory requirements and provide ‘top of the line’ technology to our staff and customers. They are truly a valued extension of our team.”

For more information, download our vendor management case study, “Carolina Alliance Bank Improves Vendor Management Process.”

17 May 2017

Compliance, Credit Unions Darren Bridges 0 comment

Evaluating and Selecting Third-Party Vendor Relationships – What your Credit Union Needs to Know

Choosing a Credit Union Vendor

The majority of credit unions rely on third-party service providers for specialized IT services and technology that improve the overall quality and efficiency of the organization and for mission-critical software and hardware to actually run their business. As such, third-party providers have become an essential component of day-to-day operations, but it is important that credit unions understand the operational and reputational risks they assume if they do not select and manage these relationships and providers appropriately.

Some of the potential risks of using a third-party service provider include:

Compliance risks including violations of laws, rules or regulations or non-compliance with policies and procedures;
Reputational risks including dissatisfied members or regulation violations that lead to public enforcement actions;
Operational risks including losses from failed processes or systems, or losses of data that result in privacy issues;
Transaction risks including problems with service or delivery; and
Credit risks if a third-party is unable to meet its contractual obligations.

To help eliminate some of the risk that comes when working with third-party providers, there are several steps a credit union should take and processes that should be put into place before entering into an agreement with an outsourced provider. Before entering into a third-party relationship, credit unions should:

Determine whether the relationship complements their credit union’s overall mission and philosophy;
Document how the relationship will relate to the credit union’s strategic plan;
Design action plans to achieve short-term and long-term objectives;
Perform proper due diligence on all vendors;
Assign authority and responsibility for new third-party arrangements; and
Weigh the risks and benefits of outsourcing business functions with the risks and benefits of maintaining those functions in-house, if possible.

Once a vendor is selected, credit unions should:

Adopt risk management processes to coincide with the level of risk and complexity of its third-party relationship;
Implement an effective risk management process throughout the life cycle of the relationship including: plans that outline the credit union’s strategy, identification of the inherent risks of the activity, and detailing of how the credit union selects, assesses, and oversees the third-party;
Have written contracts that outline the rights and responsibilities of all parties;
Implement a process for ongoing monitoring of the third-party’s activities and performance;
Have a contingency plan for terminating the relationship in an effective manner; and
Have clear documentation and reporting to meet NCUA regulations and requirements.

Following all of these steps and ensuring third-party relationships are managed correctly can be a time-consuming, often cumbersome responsibility for credit union staff. In response, credit unions are looking for ways to more efficiently perform due diligence and manage their outsourced vendors, protect themselves from risk, and maintain NCUA compliance and requirements. Credit unions often determine that implementing an industry-specific and automated vendor management program is the most cost-efficient method to control and manage these risks. When implemented correctly, automated vendor management solutions can save a tremendous amount of time and money, reduce risks and eliminate potential compliance issues.

For more information please download our white paper, Why Automation is the Answer to Credit Unions’ Vendor Management Challenge

Why Automation is the Answer for Credit Unions’ Vendor Management Challenge

How confident are you in the management of your vendors?

10 May 2017

Compliance, Credit Unions Chuck Copland 0 comment

Six Ways to Strengthen your Credit Union’s Vendor Management Program

Credit unions rely on third-party providers to offer specialized services and technology assistance to keep their operations running smoothly and help improve the overall quality and efficiency of their organizations. Vendor management has always been an important issue for credit unions, but with increased scrutiny from the NCUA, they now run greater risk of getting fined for not adequately managing their third-party vendors. In response, many credit unions are looking for ways to more effectively manage their roster of outsourced vendors while protecting themselves from the associated compliance risk.

Here are six steps to more efficiently monitor and manage third-party providers, ultimately strengthening a vendor management program:

Perform Thorough Due Diligence

The due diligence process ensures that a credit union has a consistent and reasonable approach to vetting its vendor relationships — especially if the vendor is providing a core business function or has access to personal confidential information. It’s not enough to perform due diligence during the initial vetting stage. Conducting diligence throughout the relationship, especially with mission-critical vendors, is essential to avoid being blindsided. Properly vetting and managing vendors will reduce risk for the credit union, while also ensuring all FFIEC and NCUA regulations and requirements are met.

Develop Consistent Risk Assessment

To properly assess risk exposure for vendors/services, establish consistent criteria to appropriately weigh the risk each poses to the credit union. This will help you grade or designate a level of criticality and risk for each service and each vendor. For example, will a vendor have access to private member data? Will it operate with our core system? The criticality will have a significant impact on the review process, as a more critical service or vendor will ultimately require more due diligence to be performed.

Incorporate Vendor Management into the Business Continuity Plan

If a credit union does not thoroughly analyze its vendors as part of the business continuity planning (BCP) process, it opens itself up to the risk of extended downtime. It is crucial for credit unions to know exactly how they are going to recover if their vendor goes down. Business Continuity/Disaster Recovery capabilities should be reviewed to determine if they align with the credit union’s Recovery Time Objectives. Regulators expect and mandate that credit unions have alternative procedures and processes in place in the event of disruption of service from a mission-critical provider.

Board of Director Involvement

The responsibility for properly overseeing outsourced relationships and the risks associated with that activity ultimately lies with the credit union’s Board of Directors and its senior management. It is typically the Information Security Officer (ISO), or sometimes the CIO or CTO, who is responsible for communicating with the Board and helping manage the process. In order to effectively communicate the need for comprehensive vendor management to the board, the ISO must first thoroughly understand exactly what examiners are looking for. NCUA’s Supervisory Letter 07-01 is designed to help credit unions better understand and manage the risks associated with outsourcing. This should not be a one-way line of communication. Board members are expected to understand the process and risks clearly enough to provide a credible challenge to the ISO when appropriate.

Monitor and Control the Vendor Relationship

Proper Vendor Management is cyclical. Staying abreast of important key dates, contract changes and upcoming vendor reviews and contract renewals is a key step in a vendor management program. Not doing so can end up costing you significantly, not to mention the added burden of inefficiencies if the process is not handled well.

Implement an Automated Vendor Management Solution

Many credit unions are looking for ways to more effectively manage their outsourced vendors, protect themselves from the risk, and maintain FFIEC compliance. Oftentimes, credit unions determine that implementing an industry-specific and automated vendor management program is the most cost-efficient method to control and manage these risks. Implementing automated vendor management solutions saves a tremendous amount of time and money, reduces risks and also eliminates compliance headaches. Moreover, an automated solution helps hold vendor managers accountable to a process that often gets “put on the backburner.” A complete vendor management system also ensures your Board of Directors and management are notified of all of the critical activities and actions required to effectively monitor a third-party relationship, ensuring all risk assessments, controls reviews and documentation are up-to-date.

Leveraging the skills and experience of third-party service providers can help credit unions better meet their members’ needs while accomplishing their strategic goals. Those that implement a solid vendor management program — and actively manage those relationships — will have the greatest level of success.

04 May 2017

Banks, Compliance Tom Hinkel 0 comment

Why Enterprise Risk Management is a Key Part of Establishing a Strong Compliance Culture

Assessing and managing enterprise risk is crucial for the success of today’s financial institutions, and whenever new ventures are considered, this involves weighing the benefits of the new ventures, such as new programs, vendors, and initiatives, against the strategic, reputational, operational and regulatory risks that might be involved in taking on that venture.

As an example, many community banks and credit unions may have already implemented (or are looking to implement) mobile banking and mobile capture to remain competitive with larger financial institutions. Before moving forward with the initiative however, the bank must go through several stages to ensure it truly understands the enterprise risks involved. At the conceptual stage, the bank wrestles with the question of whether or not to move forward with the initiative. If the bank chooses not to do it, it may lose business to a competitor who offers this service. If it elects to move forward with the initiative, what then are the assumed risks and what are the next steps in mitigating these?

Four Enterprise Risks

Before implementing a new initiative at the bank, financial institutions should evaluate four main categories of enterprise risk:

Reputation risk – The risk that negative publicity regarding an institution’s business practices can adversely affect the financial institution’s ability to establish new relationships or services, as well as affect its ability to continue servicing its existing relationships.
Strategic risk – The importance that this process holds in the context of the overall enterprise. In other words, how important is the execution of the process to achieving the goals and objectives of the institution’s overall strategic plan.
Regulatory/Legal risk – The risk arising from potential violations of, or nonconformance with, laws, rules, regulations, prescribed practices, or internal policies and procedures.
Operational risk- Simply put, operational risk is the risk that the processes supporting the initiative fail. Practically speaking, this includes the extra overhead, or additional burden, that alternative procedures, practices and personnel required for manual or alternate methods (the work-arounds) of performing the processes add to the normal day-to-day operations. Operational risk should also consider the potential relocation of personnel from their primary job duties which could, in turn, result in reputational risk.

Of note is that adequate management of enterprise risk continues for as long as the initiative is in place at the institution.

What Can Banks Do To Improve Enterprise Risk Management?

Financial institutions can ensure that enterprise risks are addressed by building a culture that routinely evaluates and discusses enterprise risk and has incorporated it into day-to-day operations. Banks can do this by ensuring their employees understand the key risks to evaluate and how each one should be addressed.

This starts with the board and senior management understanding and supporting information security and providing appropriate resources for developing, implementing, and maintaining the information security program. The result is a program in which management and employees are all committed to integrating risk management best practices into the institution’s lines of business, support functions, and third-party management programs. In addition, management and employees should be held accountable for complying with the institution’s information security program.

The FFIEC Information Technology Examination Handbook explains that introducing new business initiatives, including new service offerings or applications, is the true test of the maturity of and degree to which information security and enterprise risk management are part of the institution’s culture. An institution with a strong security culture generally integrates information security into new initiatives from the onset and throughout the lifecycle of its services and applications.

Ensuring that strong security and compliance practices are deeply embedded in the institution’s culture contributes to the overall effectiveness of the information security program. When high compliance standards are established within a financial institution, all employees recognize that they have a personal responsibility to truly understand the risks their institution faces as well as ways to safeguard against them.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

26 Apr 2017

Banks, Security Jamie Davis 0 comment

Why Financial Institutions Should Invest in Layered Security

Phishing, malware, ransomware and a host of additional fraudulent activities continue to target financial institutions. While history has shown that well-designed single-focus solutions can prove useful in stopping specific attacks, the capabilities of advanced malware are now so broad and sophisticated that such protections inevitably fail – opening the way to costly data breaches and other malicious attacks. What is perhaps most frustrating is that Verizon’s Data Breach Investigation Report indicates that 97% of attacks were easily avoidable.

To establish a secure IT network and be better protected in the digital world, banks should employ a strategy that places many uniquely tailored layers throughout their networks, from the end user to the Internet. By employing multiple controls, security layers ensure that gaps or weaknesses in one control, or layer of controls, are compensated for by others. For example, if a malicious email message should make it past the firewall, it would then be countered by the mail server’s antivirus, and if it somehow makes it through that layer, it can be stopped by the workstation’s antivirus system.

A uniquely tailored layered security approach enables financial institutions to:

Monitor antivirus for servers, workstations, and off-site laptops;
Using services that evaluate site lookups to avoid exposure to compromised websites;
Monitor unusual activity on networks as well as defend against hackers and rogue employees;
Block access to all external ports while also monitoring the access of various machines;
Meet government regulations and requirements;
Counter extortion threats by preventing a hacker from holding your customer’s personal data for ransom with special customized software for stopping ransomware; and
Patch machines, encrypt laptops, and install alerts on new devices plugged into the network.

Government Regulations and Guidance Around Security Expectations

There are also regulatory requirements and expectations for banks to invest in proper security. Layered security and compliance policies have come under increased regulatory focus recently, which is evident with the release for the FFIEC Cybersecurity Assessment Tool (CAT) and the updated FFIEC Management Examination Handbook. In addition, the responsibility of securing confidential customer information is mandated by the Gramm-Leach-Bliley Act of 1999. This law established that financial institutions must protect their IT networks from attack and identify any possible breaches that manage to bypass these protections.

This guidance is always changing, and financial institutions must adapt to regulatory demands. IT auditors and examiners will look for evidence of a thorough risk assessment; make sure that written policies and procedures align with the assessment; and then verify that controls and daily practices are appropriate.   
Each financial institution will have a different security approach based on its unique risks, but all financial institutions should implement a security plan that can effectively prevent attacks, assess vulnerabilities and constantly update security measures as new technology assets are added and government regulations evolve.

For more information please download our complimentary white paper, Strengthen Your Strategy: Why a Layered Defense is the Best Choice for Your Bank’s IT Security Program.

Strengthen Your Strategy: Why a Layered Defense is the Best Choice for Your Bank’s IT Security Program

Learn why a single layer of security, such as antivirus, is no longer enough in the current risk environment.

12 Apr 2017

Banks, Security Jamie Davis 0 comment

Ransomware Response: 8 Ways Your Community Bank Can Prevent Malicious Attacks

One of the biggest cyber threats today is ransomware, with instances of these malicious attacks increasing by 44% in the last six months alone. In fact, according to the 2017 State of Malware Report by Malwarebytes, ransomware was the favorite method of attack used against businesses in 2016. Recent FBI statistics indicate that hackers successfully extorted more than $209 million in ransomware payments from businesses and financial institutions in Q1 2016, and the business of ransomware is now on track to become a $1 billion per year crime.

(more…)

05 Apr 2017

Banks, Security Jamie Davis 0 comment

5 Steps to Building a Strong Security Culture

5 Steps Community Banks Can Take

Financial institutions face increasing pressure to provide enhanced consumer protection against phishing, sophisticated malware and fraudulent activities. Smaller organizations are the prime targets for calculated, malicious attacks, due to the sensitive financial data banks are responsible for.

Investing in technology resources is necessary to protect community banks from security breaches and attacks, but it is equally important to instill a strong security culture within the bank to help all departments and personnel adequately combat these threats. IT security is integral to running a successful institution, and banks should begin to educate and train their employees on the proper way to tackle security-related issues and safeguard customer information.

(more…)

29 Mar 2017

Banks, Compliance Tom Hinkel 0 comment

Roadmap to Recovery: Cyber Resilience is More Than Just a Business Continuity Plan

Cyber Resilience

With the increasing frequency of cyber-attacks in the financial industry, community banks need an effective strategy to measure and control these risks, and a program of cyber resilience may just fit the bill. The concept of cyber resilience provides a different way of thinking about an institution’s information security processes. Rather than simply focusing only on preventive controls, cyber resilience also focuses on corrective controls, such as having solutions in place to continue business operations should an attack occur. Cyber resiliency ultimately refers to the preparations that an organization makes in regard to preventing threats and vulnerabilities (the defenses that have been developed and deployed), the responsive controls available for mitigating a security failure once it occurs, and its post-attack recovery capabilities (or corrective controls).

More than a BCP

While the Business Continuity Plan (BCP) has become a de facto framework for guiding an institution through the process of recovery from any unplanned event, including a cyber-attack (the word “cyber” is mentioned 49 times in the FFIEC BCP Handbook), cyber resiliency is far more than just developing and executing your bank’s BCP. Business recovery plans are often ill prepared to address non-traditional disasters. For example, continuity plans often rely on the geographic separation of production and backup facilities in the event of a natural disaster. Cyber attacks, however, are not geographically specific and can (and will) affect facilities and operations located anywhere in the world. Attacks can target both the financial institution directly as well as its backup facility, located elsewhere; or a financial institution along with its third-party service providers (TSP) simultaneously. All of these situations require special consideration and preparations that go well beyond traditional BCP planning.

Common Cyber Risks

The cyber risk and threat landscape is broad and continually changing. Some of the most common cyber risks financial institutions should be prepared for include:

Malware
Insider Threats
Data or Systems Destruction and Corruption
Communication Infrastructure Disruption, and
Simultaneous Attack on Financial Institution and Third-Party Service Provider

Recommended Controls

Being truly cyber resilient is essential for community banks and their vendors. According to Appendix J of the FFIEC’s BCP Handbook, financial institutions should implement the following controls to successfully achieve cyber resiliency:

Data backup architectures and technology that minimize the potential for data
destruction and corruption
Data integrity controls
Independent, redundant alternative communications providers
Layered anti-malware strategy
Enhanced disaster recovery planning to include the possibility of simultaneous attacks
Increased awareness of potential insider threats
Enhanced incident response plans reflecting the current threat landscape, and
Prearranged third-party forensic and incident management services

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

The Keys to Cyber Resilience

Prevention and recovery are the keys to being truly cyber resilient! Cyber threats will continue to challenge financial institutions, but having the proper preventive and corrective controls in place can greatly minimize the impact. Cyber resilience requires banks to bring together all the areas of information security, business continuity, vendor management and incident response in a coordinated effort.

15 Mar 2017

Banks, Technology Christine Ray 0 comment

Oconee State Bank Maintains Compliance and Improves Network Efficiency with Safe Systems’ NetComply One Solution

Oconee State Bank Maintains Compliance

To manage banks’ IT networks today, IT administrators need the proper tools to monitor the network, maintain patches, apply anti-malware, and troubleshoot network issues effectively. Under the pressure of constant technological changes and increasingly strict regulatory guidelines, many community banks struggle to efficiently administer these tasks and meet examiner expectations.

Oconee State Bank felt this pressure and sought a technology partner that was proven within the community banking environment and that clearly understood the challenges it faced from a regulatory standpoint. The bank had initially worked with Safe Systems on the design and installation of its first network in 1997. Over the years, as regulations evolved and IT networks became more complex, Oconee State Bank required additional resources to help with the day-to-day monitoring and overall management of its network. Based on its positive experience with Safe Systems, the bank added Safe Systems’ IT network management service to increase efficiencies and maintain compliance with regulatory requirements.

“As a community bank, I want the relationships with our vendors to be built on loyalty, honesty and integrity,” said Marisa Reynolds, Senior Vice President at Oconee State Bank. “We’ve stayed with Safe Systems for so long because they embody all of these values. I can always count on them to provide quality technology, expert guidance and excellent customer service to our team.”

Solution

Oconee State Bank had already successfully implemented a previous version of Safe Systems’ NetComply® IT network management service, which enabled the bank’s staff to efficiently manage all important network tasks and provide proper documentation to regulators for IT examinations.

In 2016, Safe Systems released the new version of the service, NetComply One. The new solution improved upon the patch management, qualified alerting, and reporting capabilities of the prior version while also offering much faster and smoother remote access capabilities, which allows bank staff to conveniently access the network to solve any issues that arise.

As one of the first banks to go through the conversion process, Oconee State Bank reported a seamless conversion to the new system and the staff was very pleased with the user-friendly interface. Safe Systems provided thorough training on NetComply One, and after a single session with its strategic advisor, the bank was up and running on the new system.

“We thought the conversion to NetComply One would be a long, complicated process, but that wasn’t the case at all,” said Jamie McFalls, IT Specialist at Oconee State Bank. “Safe Systems ran the conversion overnight and after just one week’s time of using both the old and new systems, we crossed over to NetComply One and never looked back.”

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Results

Since adding the NetComply One service, Oconee State Bank has already realized significant improvements in its examination scores and overall management of the network. Additionally, the staff no longer has to manage patches manually because all patches are done quickly and efficiently through automation.

“The patch management capabilities have been a big help to us when we’re doing scans, audits or exams because we want to make sure all of our machines are fully patched and secure,” said McFalls. “With NetComply One, we have better examinations and have achieved a higher level of compliance because our patches are completed much faster than if we had to manage them manually. With these results, I can say that NetComply One easily paid for itself in just the first 30 days.”

The qualified alerting feature has also helped Oconee State Bank reduce the number of tickets and alerts it receives which frees up internal IT staff to work on other things.

“We initially didn’t want to give up too much control over the network, but adding Safe Systems to our team has been a terrific experience,” said Reynolds. “NetComply One has truly been a game changer for our bank by helping us to achieve our IT and compliance goals and better serve our customers.”

08 Mar 2017

Banks, Technology Chris Banta 0 comment

The Next Big Thing in Banking: Safe Systems’ Automated Intelligence with NetComply One

SSAI

Automation plays an important role in helping to ensure community banks and credit unions operate efficiently, securely and compliantly. IT staff put a large amount of time and effort into troubleshooting services and addressing patch management, antivirus, backup issues, and other activities on a daily basis. To help integrate all of these moving parts and ensure they work together without more time-consuming, human intervention, Safe Systems designed its unique Safe Systems Automated Intelligence (SSAI) to work with its NetComply One IT network management service, as well as across its other compliance and security solutions.

NetComply One helps financial institutions further decrease costs, increase performance, and improve their compliance posture, while keeping the network up-to-date. With NetComply One, SSAI works to automate, enhance, and make more efficient responses to device alerts by reviewing log content and when possible, automating a corrective action, thus creating operational efficiencies and avoiding downtime. SSAI also runs proactive maintenance and auto-fixes where needed, to drastically reduce the need for reactive processes. Here are four key ways that SSAI works with NetComply One to help banks more efficiently manage their networks:

Reduce Manual Intervention

For a network to efficiently operate in today’s complex financial environment, all systems must seamlessly work together. In the past, manual processes and maintenance would have to be a reoccurring action that required staff to spend time daily making sure each system or subsystem was working properly. With SSAI, all of these actions are automated, enabling personnel to focus on more revenue-generating activities for the financial institution. SSAI helps automate the on-boarding process for new machines, equipment and solutions added to the network while reducing the amount of labor required.

Eliminate Network Downtime

In managing and monitoring a network, service issues are typically the most common source of alerts. SSAI can address 96% of all service issues without human intervention. The time required to find, correct and resolve an email or printing issue can literally be reduced from hours to mere seconds with SSAI. The software doesn’t simply restart the service to address an issue, rather, it leverages built-in business intelligence to address and correct any issue causing a service stoppage. Only after the system has exhausted a series of automated if/then logic steps does the system automatically submit a ticket for human assistance.

7 Reasons Why Small Community Banks Should Outsource IT Network Management

Control Costs and Save Time

Safe Systems currently monitors more than 20,000 devices and roughly 80% of all issues addressed come through our monitoring systems. Just by implementing Safe Systems NetComply One with SSAI, the number of alerts sent to an IT support team is decreased by an average of 89%. By effectively correcting known problems and only notifying your team about more significant issues, SSAI creates tremendous value for your institution, your employees and your infrastructure.

Be Part of the Safe Systems Community

At Safe Systems, our time troubleshooting services, patch management issues, antivirus issues, backup issues, etc. has dropped dramatically over the years as a direct result of SSAI. We are constantly working to create automated fixes for any issues that arise to provide the best experience to our customers. Whenever a bank has a unique issue that requires a staff member to intervene, our team has been known to create a script to instruct SSAI to fix the issue automatically, which allows all customers to reap the benefits of the automation moving forward. Being a part of the NetComply One service means you have a team that is highly motivated to automate based on actionable data.
Our customers also have the opportunity to contribute ideas and identify new areas that can enhance SSAI. When speaking with your Strategic Advisor or interacting with our team at our user conferences and symposiums, we are always open to your suggestions to help us improve our automation and better serve your institution. Don’t hesitate to discuss possibilities with our engineers in the Network Operations Center (NOC).

01 Mar 2017

Banks, Compliance Tom Hinkel 0 comment

What is Cyber Resilience Anyway?

Cyber Resilience

As the role technology plays in today’s financial services environment has grown, this has also introduced a range of new risks and vulnerabilities that must be recognized and acknowledged, placing cybersecurity high on the agenda for financial services executives and IT staff. The new 2016 FFIEC Information Security Handbook states:

“…because of the frequency and severity of cyber attacks, the institution should place an increasing focus on cybersecurity controls, a key component of information security.”

With financial institutions becoming more reliant on third-party service providers to help support important bank functions such as: loan servicing, collections, item processing, payments, and IT network management, to name just a few, regulators have expressed increased concern that these third-parties could present a weak link that cyber attackers can exploit. And the more third-parties the institution uses, the greater the risk. All institutions, but especially Community banks, ultimately bear this responsibility, and must be aware of – and successfully manage — their service providers’ cyber risks.

Cybersecurity vs. Cyber Resilience

Regulations define cybersecurity as:

“…the process of protecting consumer and bank information by preventing, detecting, and responding to attacks.”

Cyber resilience then, is:

“The ability of a system or domain to withstand cyber attacks or failures and, in such events, to reestablish itself quickly.”

While cybersecurity (or protecting from an attack) is vitally important, it is not the only thing that matters. In order to minimize the risks and vulnerabilities in the evolving digital landscape, cyber resilience (or bouncing back from an attack) must be taken into consideration as well. Cyber resilience is an evolving perspective that essentially brings the areas of information security, business continuity and organizational resilience together. Ultimately it refers to the preparations that an organization makes in regard to threats and vulnerabilities, the defenses that have been developed and deployed, the resources available for mitigating a security failure once it occurs, and their post-attack recovery capabilities.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

One of the primary differences between the two is that although both cybersecurity and cyber resilience require effective third-party management, resilience requires an even greater focus on outsourced technology providers. This is particularly challenging because you must be prepared to recover from an event you couldn’t foresee, could not prevent, and cannot control. The initial stages of a cyber incident require a rapid assessment of the impact of the incident as soon as possible after detection. When the incident occurs at a third-party, you are relying on the vendor to notify you, which means your reaction time (and recovery capability) is entirely dependent on when (or if) you are notified. A recent report by the FDIC Office of the Inspector General found that most institutions have not fully considered and assessed the potential impact that third-parties may have on the bank’s ability to manage its own business continuity planning and incident response.

Compliance Expectations

Regulators expect financial institutions to be not just cyber-secure, but cyber resilient, and that requires close cooperation with all their critical third-parties. Assessing and managing risks, and developing capabilities for response and recovery in the event of disruptions regardless of where they may occur, requires financial institutions to have proven plans in place to meet regulatory expectations. The FFIEC has issued specific guidance on how it expects organizations to manage this process. The FFIEC IT Examination Handbook’s “Outsourcing Technology Services Booklet“, as well as the Information Security and the Business Continuity Booklets address expectations for managing due diligence, incident response, business continuity and the ongoing monitoring of outsourced third-party relationships.

Community banks should remain vigilant in the monitoring of emerging cyber threats or scenarios and consider their potential impact to operational resilience. The good news is that financial institutions can and should simulate and test their response to a cyber event just as they do for natural disasters. They should also make a point to include any significant third-parties in their testing. The financial industry is investing significant amounts of time and resources to defend against cyber-attacks and strengthen resiliency, and there are many resources available today that can help streamline and automate the entire process of cybersecurity and resilience planning, testing and execution.

22 Feb 2017

Jumping through hoops for vendor management

Banks, Compliance Christine Ray 0 comment

Northside Bank Enhances Compliance Posture with Safe Systems’ Vendor Management Solution

Vendor management has always been an important issue for bankers but with increased regulatory demands, examiners are now citing financial institutions for not adequately managing their third-party vendors. In response, many financial institutions are looking for ways to more effectively manage their roster of outsourced vendors while protecting themselves from the associated compliance risk.

Georgia-based Northside Bank is just such an example, as it wanted to streamline its vendor management program to more efficiently monitor and manage its third-party providers. The bank began researching vendor management solutions to find a partner that could adequately meet its compliance needs, and after careful evaluation, selected Safe Systems’ industry-specific, automated vendor management solution. As a result, the bank is now able to cost-effectively execute its vendor management initiatives despite its lean IT staff.

“We needed help simplifying our vendor management processes to better meet regulatory requirements,” said Kim Grimes, VP, Director of Information Systems at Northside Bank. “With only one internal IT resource at the bank, Safe Systems helped us more efficiently manage our third-party vendors and successfully achieve our IT, security and compliance goals.”

Improved Compliance and Streamlined Processes

The products and services Safe Systems provides have enhanced the bank’s ability to meet regulatory needs and provide the necessary technology to both its staff and customers. The bank reports that Safe Systems’ application and support services have also produced meaningful time savings, allowing bank staff to focus more time and energy on additional revenue-generating activities.

“Working with Safe Systems has really simplified our vendor management process,” said Grimes. “Not only are the manual, time-consuming responsibilities now fully automated, but our exam process has been much smoother and regulators have been impressed with our program. In fact, our auditors and examiners have even commented that the Safe Systems solution is such a comprehensive product.”

A Trusted Partner

While the bank originally selected Safe Systems for NetComply, through the years it has added additional Safe Systems solutions including, Continuum and C-Vault disaster recovery services, SafeSys Mail hosted email along with the Vendor Management Solution.

“We consider Safe Systems to be a true partner to our bank and we greatly value their knowledge and support,” said Grimes. “Working with the Safe Systems team enables our bank to thrive in today’s challenging environment. They truly understand our business and what examiners require from us, and have the staff and products to support, meet and exceed those expectations.”

15 Feb 2017

Banks, Technology Safe Systems 0 comment

6 Ways IT Administrators Can Transition from a Tactical to Strategic Role

In today’s fast-paced, constantly evolving banking environment there is an increasing demand for IT administrators to play a larger and more strategic role with community financial institutions. This demand, largely driven by increased regulatory scrutiny, is requiring IT administrators to stay abreast of the latest technology and security solutions in an unprecedented way.

IT administrators are responsible for performing a variety of tasks including network monitoring, patch management, and malware protection, among others. They must maintain the day-to-day tactical activities and keep up with new technologies to ensure the bank’s network remains functional and secure, all while putting out fires and trouble-shooting everyday problems that arise within the institution.

While there is a business need to have IT administrators assume a more strategic role at the bank, they often have limited resources and only so many hours in a day. Below, I have outlined a few key areas that can help IT administrators make the transition:

Think Strategically

The transition to a more strategic role requires new skills and a different understanding of the institution and its goals. Instead of thinking about what do I need to accomplish today, IT administrators must begin to think about what needs to be accomplished within the next year; what are the financial institution’s main business objectives; and how can this be achieved with the help of the IT staff? Think of it as playing chess and always be thinking of your next move. Asking the right questions allows the IT admin to understand the big picture and focus on what will most impact the bank’s long-term goals.

Have a Balanced Skillset

IT administrators should expand their focus beyond the technological side of the bank to include a focus on compliance and how it impacts the technology solutions the institution must consume. By aligning compliance requirements, IT admins can better apply their technical expertise to establish themselves as an indispensable part of the institution’s staff. For example, consider how your technology solutions supports your business continuity plan (BCP). Will your current solutions help to achieve your goals outlined in your BCP and restore critical business functions in the event of a natural disaster?

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Gain Senior Management Support

To become a true, strategic contributor requires buy-in from management. IT administrators need the support of senior management and must be able to get the management team involved with the technology, security, and compliance aspects of the bank. Participating in IT steering committee meetings presents an opportunity for the IT admin to provide new ideas and information and communicate the importance of the board and senior management’s involvement. These quarterly meetings typically cover the bank’s strategic IT roadmap to include: the current IT situation, ongoing technology projects, as well as pending (and emerging) security and compliance issues. This is the ideal time to meet with the management team and showcase a well-rounded skillset that can benefit the bank.

Understand Evolving Technology

IT administrators should do research to truly understanding how technology is evolving and how new technologies and products can benefit the financial institution. One example is the evolution of email and email platforms. In the past, it was common practice to host email in-house. However, new technology has made email a more commoditized product, and it is now very common to have a third-party provider host and manage email platforms. While IT admins may recognize this, they shouldn’t assume others within their institution do as well. Understanding and sharing this knowledge is a strategic move that can save the financial institution money and additional resources in the future. A strategic thinker recognizes the significance of this and in turn, encourages senior management and the board of directors to move in this direction.

Delegate Responsibilities

A financial institution’s IT department bears a host of responsibilities, but often has difficulty in maintaining adequate staff to complete the work. Recognizing this need, knowing when to build a team or outsource, and then selecting a trusted IT partner who can help alleviate the day-to-day pressure is a strategic move that can benefit the entire organization. For example, many IT administrators partner with third parties to help with the time consuming task of patching security vulnerabilities on the network. Having the additional support enables IT personnel to concentrate on the overall direction of the bank’s IT initiatives, meet regulatory expectations, and focus on how the bank can continue to advance in the industry.

Take Advantage of Resources

All too often, IT administrators become so entrenched in their day-to-day work that they neglect their own professional development. The good news is that there is a wealth of resources available today, such as industry white papers, blogs, news articles, user conferences and tradeshows, as well as peer groups and other networking opportunities, all of which can help with staying abreast of the always evolving areas of technology, compliance, and security. It is important to justify the budget and time for participating in these type of activities.

In conclusion, having an impact on the overall IT strategy of the financial institution requires a unique set of skills paired with a strategic way of thinking. Increasingly, IT admins are being challenged to think in new ways and apply their knowledge beyond what they have historically been asked to do. By building on their established foundation of technical knowledge to foster a deeper understanding of the banking business and knowing when to hire or outsource IT administrators will increase their contribution to the institution’s success.

08 Feb 2017

Banks, Compliance, Security, Technology Christine Ray 0 comment

3 Top Challenges Community Banks Will Face in 2017

To get a better understanding of financial institutions’ current IT situation, we surveyed approximately 100 bankers to identify their top IT priorities, IT challenges, security concerns and compliance issues, as well as what technologies and investments they plan to leverage in the coming year. We recently published the findings in our white paper, “2017 Community Bank Information Technology Outlook,” to provide community banks with valuable peer data that can provide guidance for key IT, compliance and security decisions in 2017 and beyond. Here are some highlighted trends from the results:

2018 Community Bank Information Technology Outlook

Primary Research and Analysis of Your IT Priorities
in 2018

Increasing Technology

Mountain Top In today’s banking environment, community banks recognize and embrace the use of technology and remain committed to investing in new technologies and services moving forward. In fact, nearly 77% of respondents claim they are spending more on technology today than they have in the past. However, the challenge often lies in trying to keep pace with the rapid rate of change that is influencing their business. Community banks are continuing to explore ways to enhance and augment their IT departments, as many institutions struggle to maintain adequate personnel needed to manage the complex activities required of the IT department. To counter this, 71% of respondents have turned to outsourcing their network management and 63% have outsourced their IT support.

Cybersecurity is the Greatest Security Challenge for 2017

According to the survey, 94% of respondents foresee cybersecurity as their greatest security challenge in the coming year. No doubt this is in response to a seemingly constant stream of news about security breaches and the possible enforcement of the Cybersecurity Assessment Tool (CAT). Community banks must have procedures in place to secure customer and confidential data and recover critical business processes regardless of the source or nature of the threat. Having a thorough understanding of the CAT and how to properly complete it will help banks to improve their cybersecurity processes and better meet examiner expectations.

Compliance Concerns

Compliance issues are top-of-mind as many community banks are challenged to keep up with constantly changing regulatory requirements. This is reflected in the approximately 40% of respondents that have chosen to outsource their compliance needs. This number is on the rise and is likely to continue to increase as respondents indicate that regulators have been more aggressive as of late and examiners’ expectations and demands continue to increase. Approximately 59% of participants say they now spend more on their IT compliance needs as a result.

Other areas including vendor management, business continuity planning, information security, cloud, and email continue to provide financial institutions with room for improvement. To achieve this, community banks are increasingly turning to their peer groups when seeking recommendations to help guide their decisions regarding new technology and services. The majority, approximately 90% of the survey respondents, consistently leverage their peer network when researching a new solution or vendor.

To gain more insights into the key challenges, goals and opportunities facing community banks today, please download the full report here.

01 Feb 2017

Banks, Technology Kai Xu 0 comment

The Value of Evolution for IT Administrators

Evolution of IT

Community banks continue to embrace technology and remain committed to investing in new technologies and services this year. In fact, according to the 2017 Community Bank Information Technology Outlook Study, a survey conducted by Safe Systems in the fourth quarter of 2016, nearly 77% of respondents claim they are spending more on technology today than they have in the past. The challenge however, often lies in trying to keep pace with the rapid rate of change that is influencing and impacting the banking industry.

It seems that the one constant in our industry is continuous change as new systems, new hardware and new techniques are being developed to improve uptime, increase efficiency, control costs, assist with compliance issues, and generally help banks run more smoothly. This rate of change pushes virtually every institution to regularly perform system upgrades and technology modifications to improve its IT environment. According to the survey, the driving factor for change among community banks is business strategy, with 28% of survey respondents naming this as their primary reason for investigating new resources or services to enhance their institution. However, rather than making large, wholesale changes that can deplete valuable HR energy and resources, IT administrators stand to benefit more by making targeted, incremental improvements to support their bank’s overall IT strategy.

2018 Community Bank Information
Technology Outlook

Primary Research and Analysis of Your IT Priorities
in 2018

Slow and Steady Wins The Race

The IT industry is built on innovation that fuels revolutionary change. Perhaps the most notable example, Apple^®, essentially redefined consumer electronics starting with the Macintosh^®, then the MacBook^®, the iPod^®, the iPhone^®, the iPad ^® and the Apple Watch^®, each building on the other, usually attracting lines around the block of consumers turned brand evangelists.

While technological evolution can yield incredible results, it can also be extremely hard on financial institutions by forcing them to change their entire network or IT plan to accommodate a new innovation. This is particularly relevant for small community banks with limited resources. Additionally, charting the future path of innovation can be an unreliable and unpredictable undertaking. Are you going to innovate this year, next year or in three years? It is very hard to manage and predict. On the other hand, by making smart, incremental changes, it enables the bank to set manageable goals and actually see those goals and improvements come to fruition more rapidly.

Evolutionary Change to Save Time and Improve Efficiency

One proven example of an evolutionary change is automated patch management, software updates designed to fix known vulnerabilities or security weaknesses in applications and operating systems. All software applications require updates from vendors, including third-party software programs such as Microsoft^®, Adobe^®, Adobe Reader^®, Adobe Flash^®, Chrome ™, and QuickTime^®. Too often, though, IT professionals are relying on a manual process, requiring staff to update each machine and workstation individually. This also requires them to stay abreast of all changes essentially in real-time, which is unfeasible. Increasingly, banks are automating this process, which delivers quick, accurate, and secure patch updates to all workstations and servers and mitigates the multiple risks associated with running unpatched programs. The time the IT department saves on managing patch management enables them to instead focus on more profit-generating activities for the financial institution.

Making Evolution Part of your Company Culture

IT Admin with Laptop Banks should make continual service improvement a key part of their overall corporate culture. These changes can be identified by a single resource or through a committee focusing on operational improvement. Allocating time and resources to focus on the right aspects of new technology and process improvement is key as even the smallest incremental changes can have the ability to provide a significant positive impact.

For more information please download our complimentary white paper, 2017 Community Bank Information Technology Outlook.

25 Jan 2017

Banks, Compliance Tom Hinkel 0 comment

Is Your Business Continuity Plan Really Recoverable?

Is Your BCP Recoverable?

For many community banks, developing a business continuity plan can be a time-consuming process that requires careful evaluation of the institution’s critical processes, functions, and the interdependencies that support them. Even after you determine the strategic direction of your recovery plan, establish Recovery Time Objectives, define recovery priority, detail key recovery procedures, and Board approve the document, your BCP process is not complete until you thoroughly test your plan. Testing verifies the effectiveness of your plan, helps train your team on what to do in a real-life scenario, and identifies areas where the plan needs to be strengthened. Examiners are reviewing business continuity plans more closely to verify that banks not only have a well-crafted, compliant plan in place, but are also able to successfully execute it. Without proper testing, how will you know if your team can successfully follow these strategies for recovery?

Test Your Business Continuity Plan

Every test should start with a realistic scenario designed to simulate your institution’s top threats. From there, the FFIEC suggests 4 different test methods of increasing intensity from a Tabletop Exercise/Structured Walk-Through Test through a Full-Interruption/Full-Scale Test. While initial testing of a plan can be relatively small-scale and straightforward, the institution should strive to extend the scope/severity of the exercise with each subsequent test. Running the very same test every year will not satisfy examiners.

2018 Community Bank Information Technology Outlook

Primary Research and Analysis of Your IT Priorities in 2018

Business Continuity is much bigger than simply the IT department. The FFIEC guidance states that:

“The business continuity planning process involves the recovery, resumption, and maintenance of the entire business, not just the technology component. While the restoration of IT systems and electronic data is important, recovery of these systems and data will not always be enough to restore business operations.”

It is important to make sure that all functional areas of the institution are involved in testing. This means that in addition to the Senior Management and Information Security roles defined in your plan, the team should also consist of key department heads with detailed operating knowledge of the processes and functions impacted by your scenario. These individuals must be aware of how to quickly recover and adequately support customer needs, regardless of whether normal operating procedures are available. Therefore, tests should cover the steps departmental managers must take to complete functions manually or in an alternate way. Although technology is important, the disaster response must not hinge on waiting for technology glitches to be resolved. Your departmental specialists know how to do their job under normal circumstances, but including them in testing allows them to gain familiarity with their alternate procedures in a specific emergency scenario.

One of the primary objectives of testing is to validate that the recovery time objectives for each process are achievable. Testing exercises help identify errant assumptions and gaps in the plan to make sure what you have on paper matches your most likely threat scenarios. According to the 2017 Community Bank Information Technology Outlook Study, a survey conducted by Safe Systems in Q4 2016, 78% of respondents reported formally testing their BCP plan every 12 months. While regulators require proof of testing annually, more frequent testing may be indicated if a previous test uncovered significant gaps in your plan or if there are significate internal changes to your processes or infrastructure.

Finally, don’t forget to include significant third-parties in your testing. The guidance states:

“Third parties provide important services to many financial institutions and as such should be included within the financial institution’s enterprise-wide business continuity testing program.”

Stay Current: Review and Update the Plan

While simulated testing scenarios are helpful in adjusting your plan to enhance recoverability of your bank’s processes and functions, it is also important to review and update the full plan on a regular basis. The BCP must be regularly updated as new services and technologies are implemented internally and as regulatory guidance and best practices change. According to the Safe Systems study, 75% of survey respondents indicated they are already in the habit of reviewing and updating their Business Continuity Plan every 12 months, but only 12% are taking the extra step to update their Business Continuity Plan whenever a new vendor, application or process is added.

To streamline this process, community banks should integrate business continuity into all business decisions, assign responsibility for periodic reviews of the plan, and perform regular testing and third-party reviews. The importance of the BCP should be communicated to the entire organization. The board, senior management and other stakeholders should also be kept up-to-date on the status of the BCP, review test results, and approve plan updates.

Meet Examiner Expectations and Ensure Recoverability

In the current regulatory climate, it is critical to ensure you are adhering to the examiner’s expectations. It is no longer enough to simply test restoring the same key systems annually; instead, you must test that the entire BCP plan is actionable and realistic. A comprehensive Business Continuity Plan limits the impact a disaster will have on your financial institution and ensures that you can continue to provide services to your customers, no matter what disaster may strike.

Your BCP should provide specific instructions for employees to follow, and testing makes sure those instructions can actually be followed. At Safe Systems, we have been working with community banks to manage their business continuity planning process for more than 20 years. With our knowledge of banking applications, technology, and compliance we can help you ensure your plan will meet your objectives while also satisfying all regulatory requirements.

23 Jan 2017

Banks, Compliance Chuck Copland 0 comment

Vendor Management – The Importance of Management and the Board of Directors

Vendor Management Board

Financial institutions rely heavily on third-party service providers to offer specialized expertise and services to ensure the institution is successful – something reflected by the results of Safe Systems’ recent 2017 Community Bank Information Technology Outlook Study. In fact, when you add up the number of third-party providers associated with a single institution, the total can be staggering. Results of the study indicate that 32% of respondents currently manage 1-25 vendors; 31% manage 26-50; and 28% manage between 51-100 vendors.

The responsibility for properly overseeing outsourced relationships and the risks associated with that activity ultimately lies with the institution’s board of directors and senior management. It is the Information Security Officer (ISO), or sometimes the CIO or CTO, who is responsible for communicating with the board and helping it manage the process. Unfortunately, sometimes senior management and/or the board may not fully understand the need for comprehensive vendor management, or the pitfalls of neglecting due diligence of service providers.

In order to effectively communicate with the board, the ISO must first thoroughly understand exactly what examiners are looking for. Federal regulators have issued guidelines recently to help institutions better understand and manage the risks associated with outsourcing a bank activity (including functions that support a bank activity) to a service provider. The FFIEC IT Examination Handbook was revised to help guide banks, their boards of directors and management on how to properly establish and maintain effective vendor and third-party management programs.

Understand Examiner Expectations for the Board and Senior Management

Lack of board and management involvement has direct consequences. Inability to prove board oversight can lead to a poor CAMELS score (and subsequent FDIC insurance premium increase), enforcement actions such as an MOU (Memorandum of Understanding), or financial penalties. Examiners expect the board and senior management to develop and implement enterprise-wide policies to govern the outsourcing process consistently. These policies should address outsourced relationships from an end-to-end perspective, including establishing the need to outsource a function, selecting a provider, negotiating the contract, monitoring the vendor regularly, and discontinuing the business relationship. Examiners also expect to see evidence that an institution’s higher-risk vendor relationships receive additional scrutiny above and beyond providers that present less risk to the institution.

2018 Community Bank Information Technology Outlook

Primary Research and Analysis of Your IT Priorities
in 2018

Streamline Vendor Management Oversight

While it is more important than ever for the board of directors and management to oversee and manage the risk associated with vendors, many continue to struggle with the best way to efficiently and successfully accomplish this. According to the survey, 48% of respondents are still using a basic spreadsheet to manage their vendors. While this may have worked in the past, regulators now expect all vendors to be assessed, easily overwhelming the manual process. In addition, spreadsheets provide no proactive alerting mechanism for expiring contracts and upcoming vendor reviews. They also do not provide the ability to collaborate across the organization and make producing management reports and documentation more challenging than it should be.

Many financial institutions are looking for ways to more effectively manage their outsourced vendors, protect themselves from the risk, and maintain government compliance and regulatory requirements. Oftentimes, financial institutions determine that implementing an industry-specific and automated vendor management program is the most cost-efficient method to control and manage these risks. Implementing automated vendor management solutions built around the specific needs of all of the key players within the financial institution saves a tremendous amount of time and money, reduces risks and also eliminates compliance headaches. A complete vendor management system ensures your board of directors and management are notified of all of the critical activities and actions required to effectively monitor a third-party relationship, ensuring all risk assessments, controls reviews and documentation are up-to-date.

Communicating with the board of directors and upper management can be a daunting task, but it is extremely important for financial institutions to ensure the appropriate people are involved in their vendor management program. Doing so not only saves the financial institution time in the long run by helping to focus resources, but also helps protect financial institutions from future poor exams, penalties, fines and additional regulatory scrutiny. Ultimately, it is the Board of Director’s responsibility to protect itself and its sensitive data. Having buy-in and participation from the Board and Senior Management helps ensure that this important Information Security process gets the attention it requires.

For more information please download our complimentary white paper, 2017 Community Bank Information Technology Outlook Study.

18 Jan 2017

Banks, Compliance Chuck Copland 0 comment

What is a Business Impact Analysis?

What is a BIA?

What is a Business Impact Analysis (BIA)?

A bank’s business continuity plan has evolved to become the crucial blueprint for guiding a financial institution through the process of recovering from a business interruption. Examiners are reviewing these plans more closely looking for proof that banks not only have a well-crafted plan in place, but are also able to successfully execute it. Banks must thoroughly understand and evaluate their critical processes, functions, and the interdependencies that support them in order to develop a solid plan the institution can implement effectively in the event that a disruption occurs.

One of the first steps in the BCP process is completing a Business Impact Analysis (BIA). The BIA is designed to help banks determine and evaluate the potential effects of any interruption to critical business operations as a result of a disaster, accident, or emergency. However, there has been some confusion among financial institutions regarding exactly what a BIA is and why it is important to the overall plan. Some financial institutions may confuse conducting a BIA with completing a Risk Assessment (RA). While the two go hand-in-hand and are both important steps in the continuity planning process, it is important to note that they are two completely different exercises.

The Difference Between Risk Assessment and Business Impact Analysis

Simply put, conducting a risk assessment will outline different threat scenarios the bank could face that would negatively impact normal operations. This includes both natural and man-made disasters listed in Appendix C of the FFIEC’s Business Continuity Planning booklet – think flooding, fire, pandemic illness, looting, vandalism, loss of communications, hardware failure, etc. As part of the RA, risks are assessed on their probability and impact to the institution. The Risk Assessment should result in a list of top threats to the institution, its customers, and the financial market it serves. This list can then be used to inform testing priorities.

On the other hand, a BIA focuses on the different processes within the bank rather than the threats to them. How badly will the inability to complete a process harm your institution, regardless of why that process was interrupted? Completing a BIA includes performing a workflow analysis of all business functions and processes that must be recovered. The BIA will help rank the criticality of your different processes, determine how quickly you need to recover the different areas of your bank, and ultimately result in a ranked list of recovery priorities. This analysis should be a dynamic process that identifies the interdependencies between critical operations, departments, personnel, and services.

BIA Defense

How to Complete a Business Impact Analysis for Your Bank

To conduct the BIA, financial institutions should review each individual business process and function that goes into completing that process. Participants evaluate the risks associated with the loss of each process due to a non-specific outage event.

There are four main categories of enterprise risk that should be evaluated for each process to determine an accurate assessment of the total business impact:

Regulatory/legal risk
Reputation risk
Strategic risk
Operational risk

Evaluating these categories allows the BCP team to prioritize and sequence time-sensitive or critical business processes, functions, and the interdependencies that support them. These interdependencies include technology components, personnel, and outsourced relationships. The BIA helps the bank make sense of all these moving parts, and which are more crucial than others. The end result of the BIA is a consensus list of processes, the Maximum Allowable Downtime (MAD) and Recovery Time Objectives (RTO) for each, the amount of data that must be restored (Recovery Point Objective, or RPO), and an order in which those functions should be recovered (recovery priority). This information provides the strategic direction of the recovery plan, and should be referenced when defining recovery procedures.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

Why the Business Impact Analysis is a Crucial Part of Your Bank’s BCP

Completing the BIA enables the financial institution to really define and understand what it is they do and how important those processes are to their operation. While the findings are different for each bank, there are some similarities. For example, most retail banks have a teller system that must be operational, as well as an ATM system and core processing network. However, the MADs and RTOs assigned to each function are often different for each financial institution. It is not uncommon today for regulators to demand that all RTOs be based on a methodical analysis of the tolerance for downtime for each process, and NOT simply a subjective value. Financial institutions need to be able to show how and why they have assigned rankings to each function. It is crucial to have representatives from all areas of the financial institution involved in the BIA process. Not doing so, or not completing the BIA at all, could lead to a misallocation of resources at minimum, or possibly violation of regulatory requirements (and a lower exam score), and potential reputational damage in worst case scenarios.

At Safe Systems, we understand that conducting a BIA has become a very time consuming yet necessary part of operating a compliant, resilient, and recoverable financial institution. Therefore, we have developed a Business Continuity Plan application, BCP Blueprint, to help facilitate and automate the process by automating processes that have previously been done manually, eliminating the need for cumbersome spreadsheets, and time consuming data gathering and reporting activities. The careful evaluation of individual business process and support functions enables the bank to better understand objectives regarding continuity of operations.

For more information download our complimentary white paper, Taking Business Continuity Planning to the Next Level: A Better Way for Banks.

11 Jan 2017

Banks, Compliance Jamie Davis 0 comment

5 Consequences of Doing Nothing: Why a Proactive Approach to Vendor Management Should Be a Top Priority for Your Bank

Why a Proactive Approach to Vendor Management Should Be a Top Priority for Your Bank

In today’s fast-paced banking environment, most financial institutions use a number of third-party vendors to keep bank operations running smoothly. In a recent banking survey, 47 percent of banks cited the use of spreadsheets to help keep track of their third-party providers. While many banks have systematized vendor management and implemented new vendor management software, there are still a large number of banks that do not actively manage their vendors at all. Further still, there are some institutions who view “vendor management” as simply knowing who their vendors are based on a review of the bank’s accounts payable report.

While an accounts payable report allows the bank to keep track of each vendor partner and the services they provide, this is not what regulators are looking for when evaluating an institution’s vendor management program. According to the FFIEC IT Examination Handbook, having a comprehensive list of vendors means nothing if it is not being used to identify risks and manage compensating controls of those risks for each third party service provider. Without a proactive approach to vendor management, banks are opening themselves up to increased levels of risk that can have a negative impact on the institution’s financial standing, compliance posture and overall ability to serve its customers.

Why a Proactive Approach to Vendor Management Should Be a Top Priority for Your Bank

Here are the top 5 consequences your bank could face by not having a solid vendor management program in place:

Missing Yearly Opt-out Dates

Today, too many banks are taking a reactive approach to vendor management which can lead to some major problems for these institutions down the line. For example, a bank may be unhappy with its current vendor and want to look for other alternatives, but in this reactive approach, the bank is really only managing its vendors when there is an immediate issue. When it comes to vendor management, proactively monitoring third-party providers and fully understanding the parameters of the vendor contract can help alleviate this by preventing an institution from being locked into a contract with a vendor that is not performing up to standards.

Unnecessary Costs

Contract management represents a major component of effective vendor management and overall budgeting and profitability. We’ve found that once banks begin an efficient vendor management program, they have a better picture of how their money is being spent, as many discover that they’ve been spending money on services that their bank is no longer using. A common, simple example is a bank that had been spending $45 monthly on a phone line for a fax machine that was no longer in the branch. While by itself, this is a relatively small expense, when bundled with other incremental savings, it can lead to meaningful savings.

Loss of Critical Bank Services

What would happen if your bank’s item processing provider went out of business without warning? For many community banks, this could lead to weeks of researching new vendors, evaluating each choice, and negotiating new contracts. For many banks, being without a critical service is not an option, so it is imperative that banks closely monitor their vendor’s financial statements and have alternative options in place.

Vendor Cybersecurity Events

Without a solid vendor management program, financial institutions may actually be opening themselves up to increased cybersecurity risk. Community banks should understand that their cybersecurity posture is only as good as the cybersecurity of their vendors. Often, a third-party service provider can unknowingly provide a back entrance to hackers who are looking to steal sensitive customer data. Having a procedure in place to identify the risks associated with each vendor will help banks to effectively research third-party providers and help mitigate potential risks to the institution

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

Non-compliance With Government Regulations

Today, bank vendor management processes must align with examiner expectations or the institution runs the risk of being written up and receiving a low CAMELS score. If you are not properly tracking, reviewing, and heavily monitoring your vendors, your bank could be sitting on a time bomb. Some financial institutions haven’t received a written warning from examiners yet only because they haven’t had to update their processes for some time, or because the regulator was focused on another process at the time of the last review. In our experience however, a bank is rarely written up for just one offense. If an examiner sees that the bank isn’t following through on vendor management, they may begin to look more closely into its business continuity plan or cybersecurity procedures as well.

Why a Proactive Approach to Vendor Management Should Be a Top Priority for Your Bank

Since regulators have placed higher importance on how community banks manage their vendors, it can be extremely difficult (or impossible) to gain the required level of insight from a list or a spreadsheet. Simply knowing who your vendors are is not what regulators are looking for. Examiners expect banks to take appropriate steps to mitigate risk and keep the institution safe. Therefore, it is important to have a good understanding of which vendors have access to your institution’s data and how that impacts the banks’ ability to function on a daily basis.

Financial institutions can take a more proactive approach by including non-disclosure agreements, tracking vendor contracts, having a third-party audit their vendors, and analyzing the existing – and emerging — risks. Banks should also confirm that their vendors have the right controls in place to serve the institution properly and have a backup plan in place should that vendor fail to perform. Proactively managing vendors allows banks to better meet regulatory demands, prepare for the unexpected and maintain their good reputation.

04 Jan 2017

Banks, Technology Safe Systems 0 comment

New Regulatory Trend — Succession Plan for the IT Administrator

Succession Plan for the IT Administrator

New Regulatory Trends Encourage Succession Planning for Your Bank’s IT Administrator Too

While banks are accustomed to planning for the departure of the CEO, president, vice presidents, controller and/or other senior leaders, the critical and pervasive nature of IT systems is leading many examiners to require institutions to consider expanding succession planning to include IT administrators as well.

The reality is that today, community banks must address a mounting succession problem, especially as it relates to their IT department. As technology has become more operationally and strategically important, banks must now have a plan in place to ensure that the sudden departure of a critical IT employee is a manageable event and does not present a major organizational crisis.

Understanding Regulatory Expectations

Regulators recognize the important role that IT administrators and cybersecurity personnel play in the overall success and wellbeing of the financial institution. While there have not been any formal government mandates released (yet), regulators are now looking at — and in some cases, requiring — financial institutions to have a formal succession plan in place for their key IT personnel. In fact, the new FFIEC Management Handbook requires examiners to determine that there are “provisions for management succession that provide for an acceptable transition in the event of the loss of a key IT manager or staff member”.

Exit Sign
A community bank’s IT administrator bears a great deal of responsibility as he or she must understand the ever-growing complexity of IT operations, and work closely with the Information Security Officer to ensure the institution remains compliant with continuously changing regulatory requirements. Even though the list of duties and level of complexity has grown substantially in recent years, many community banks have just one dedicated person on staff to manage all of their IT operations.

Employees may leave for any number of reasons, and IT personnel are no exception. There are a number of risks associated with the loss of an IT manager who is the sole individual with the knowledge of how the bank’s network runs. To help mitigate this risk, the FFIEC’s Cybersecurity Assessment Tool suggests that banks build “a program for talent recruitment, retention, and succession planning for the cybersecurity and resilience staffs.” In order to consistently comply with government regulations and examiner expectations in the long term, banks should have a succession plan that outlines how the bank will continue to function in an uninterrupted manner after the loss of an important IT employee.

What the Succession Plan Should Include

Bankers must understand that a community bank’s technological assets are every bit as valuable as the money in their vault. The success of the bank relies on its IT infrastructure, which is heavily dependent (and often over-dependent) on IT personnel. Regulators want to confirm that an institution can provide a constructive response detailing exactly what the bank will do to keep IT operations running efficiently if its key IT personnel leaves.

Again, the FFIEC Management Handbook states that “…Management should have backup staff for key positions and should cross-train additional personnel. The objective is to provide for a smooth transition in the event of turnover in vital IT management or IT operations.”

The IT succession plan does not have to be a long, drawn out procedure, but it should include options such as

cross-training additional staff in the bank on IT functions
partnering with an outsourced provider that acts as an extension of the bank’s IT department
or hiring additional resources to enhance personnel redundancy and make any transition seamless for the bank

While the human element cannot be replaced, using automation to supplement IT personnel bolsters a bank’s succession plan. Automated systems don’t forget, get too busy, take vacations or sick days, and aren’t subject to human error or inconsistencies. And perhaps the biggest advantage of using automated processes to augment your succession plan, is to ensure your procedures are applied in a consistent and timely manner, regardless of personnel changes.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Choose a Partner To Support Your IT Department

Finding, training, and retaining qualified staff to manage an IT network can eat up considerable time and energy from your bank’s management team, taking away valuable time needed to support customers and banking operations. Not doing so quickly can open the bank up to additional security risk. In considering IT succession planning, many financial institutions are proactively turning to IT service providers to act as an extension of their organization and help augment internal IT resources.

The right solution provider can serve as a true partner and work alongside current IT staff to manage the network and streamline technology needs, while meeting regulators’ expectations and enabling the bank to meet all compliance mandates. At Safe Systems, we understand the ever-growing complexity of community banks’ IT operations and apply that knowledge to providing our customers with an in-depth view of their IT network environments and additional support in co-managing their IT operations. We want to provide bankers with assurance that their institution’s IT network is functioning efficiently, optimally, securely, and is in compliance with industry regulations.

The Infrastructure Management Types

Which applications can we move to the cloud?

Does moving to the cloud fit with our corporate strategy?

Is the connectivity at my bank strong enough to support cloud-based solutions?

Are there additional security, risk and compliance issues to consider when moving to the cloud?

Will moving to the cloud save my institution money and cut down on IT costs?

2017 Community Bank Information Technology Outlook

Understanding the FFIEC’s CAT

As you are setting budgets for 2018, here are some key line items for consideration:

Malware/Ransomware Layers: $1,500 – $5,000

Cybersecurity Policy and Incident Response Testing: $4,000 – $7,500

Strengthen Your Strategy: Why a Layered Defense is the Best Choice for Your Bank’s IT Security Program

Honey Pots: $2,500+

Robust Vendor Management Solution: $2,500 – $5,000

New and Replacement Technology: $500 – $10,000

Training: $500 – $1,500

Vendor and User Conferences: $1,000 – $1,800

Employee Training is the Number One Priority

Stop Email Phishing Attacks with Multifactor Authentication

Looking Back at 2017

What Has Changed

It Creates a Challenging Environment to Run a Community Financial Institution

It Increases Operational Costs

Driving Compliance Through Technology

Some of the most common security threats financial institutions are facing today include:

Ransomware

Lack of Third-Party Vendor Security

Insider Threats

Lack of Employee Training and Security Expertise

Combating Security Threats & Protecting Customer Data

Solution

Result

7 Reasons Why Small Community Banks Should Outsource IT Network Management

What is RegTech?

Why is RegTech Important?

Key Benefits of RegTech to Financial Institutions:

Attributes of RegTech Solutions

What do regulators think of RegTech?

Outsourcing is too expensive

A local provider is better because they can come to our location to fix a problem

Without a bad exam, everything must be okay

Outsourcing replaces the institution’s IT personnel

It’s better to do everything with the core provider

Dispelling 5 IT Outsourcing Myths within Financial Institutions

The Importance of Network Management Systems in Community Banks and Credit Unions

Key Components of a Network Management System for Financial Institutions

Some key components of a network management system include:

Benefits of Outsourcing the Oversight of Network Management Systems

Compliance Considerations for a Network Management System

The New Era of RegTech

Service Provider Considerations

Preparing for Fall Storms

Common Issues and Solutions

Understanding the FFIEC’s CAT

Organize Your Efforts to Complete Review Findings

Streamline the Pre-Exam Preparation Process

Understanding the FFIEC’s CAT

Domain 4 – External Dependency Management – Connections

Data flow diagrams are in place and document information flow to external parties.”

Domain 1 – Cyber Risk Management and Oversight – Training and Culture

“Customer awareness materials are readily available” (e.g., DHS’ Cybersecurity Awareness Month materials)

Domain 3 – Cybersecurity Controls – Preventative Controls

“Domain Name System Security Extensions (DNSSEC) is deployed across the enterprise.”

Domain 1 – Cyber Risk Management and Oversight – Oversight

“The institution has a cyber risk appetite statement approved by the board or an appropriate board committee.”

Understanding the FFIEC’s CAT

Streamlined CAT Completion Solution

Lumbee Guaranty Bank Streamlines Cybersecurity Processes

Risk Grade

Gap Analysis

Understanding the FFIEC’s CAT

Understanding the FFIEC’s CAT

The Security Baseline process includes:

7 Reasons Why Small Community Banks Should Outsource IT Network Management

Technical Issues with New Releases

Staggered Update Plan

Enlisting a Trusted Advisor

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Webinar:Designing Your Credit Union’s WAN forNetwork Availability and Business Continuity

What Are Your Credit Union’s Technological Needs Beyond Simple Bandwidth?

Technical Issues with New Releases 

Webinar:
Designing Your Credit Union’s WAN for
Network Availability and Business Continuity