Highlights from our Annual Look Back at Regulatory Updates

As 2023 continues to unfold, there are some important regulatory compliance tips, tricks, and trends that financial institutions should review from last year and consider in the future.

Looking Back

Two key issues to revisit from 2022 are the new Computer-Incident Notification Rule and updates to the 2018 Cybersecurity Resource Guide for Financial Institutions. The incident notification rule—approved in 2021 by the Federal Deposit Insurance Corporation (FDIC), Federal Reserve System, and Office of the Comptroller of the Currency (OCC), went into full effect in April 2022. Under the rule, banking organizations must promptly notify their primary federal regulator of certain computer security incidents that rise to the level of a notification incident within 36 hours. Anything that could materially disrupt or degrade your critical operations could be classified as a notification incident. Most institutions should have already adjusted the policies and procedures of their incident response plan to comply with the new notification requirements. If they haven’t, they should do so immediately because this will undoubtedly be an issue in the next examination cycle.

The rule also obligates third parties to report certain events that occur, so financial institutions should cover this issue with new vendors and those renewing contracts. Institutions should ensure that all contracts specify under what conditions third parties must inform them of any incident. Contracts should also identify at least one contact person to notify within the institution if an event occurs.

Late last year, the Federal Financial Institutions Examination Council (FFIEC) updated its Cybersecurity Resource Guide, which is designed to help financial institutions meet their security control objectives and prepare to respond to cyber incidents. The revised guide features updated references and a list of ransomware-specific resources, which is well warranted given the increasing frequency and complexity of ransomware incidents. The guide now includes eight different cybersecurity assessment tools that institutions may use, along with the “gold-standard” Cybersecurity Assessment Tool (CAT) to combat the evolving threat of ransomware.

Looking Ahead

This year, ransomware will continue to be one of the key areas of focus for financial institutions—as well as auditors and examiners. Institutions should also start thinking of using the term “third-party risk management” instead of “vendor management” to match an impending shift in interagency guidance. The new terminology is more than just semantic, it represents a shift in how the agencies define anyone with whom you interact; including those with or without a contract, and with or without the exchange of compensation. Regulators will be releasing new guidance relating to the issue of third-party relationships and risk management. The stronger emphasis on third-party risk management is significant because it implies a broader and deeper scope of responsibility for institutions in terms of their engagement and oversight processes.

In addition, the guidance will likely propose a six-part, third-party risk management process. The process, for instance, will cover key areas like early planning, selection due diligence, and contract negotiation. It would be wise for institutions to begin contemplating these new expectations and how they will navigate the different aspects of third-party risk management in the future.

Anticipated Trends

There are also some potential trends that financial institutions should be aware of going forward. Based on their actual recommendations or observations, auditors and examiners expect institutions to:

• Identify tolerances for processing and data recovery times for ransomware events—separately from the standard recovery times (RTOs) established in the business impact analysis.
• Have a list of forensic experts available to call if they require assistance with cyber events. (Your cyber insurance provider may require you to utilize their associates, so it’s best to check.)
• Formalize vendor information and ensure their management team is periodically updated about third-party risk management practices.
• Have project management policies that address steps to request and approve new applications, including licensing, contracts, business justification, integration, and risk assessments.
• Make provisions for succession planning for IT, which is a key component in the risk management program. (If necessary, smaller institutions might consider outsourcing the IT role to ensure an appropriate succession plan is in place.)

Read more about this topic by accessing our webinar on “Regulatory Tips, Tricks, and Trends—Looking Back and Ahead.” Or contact us for more information about how our compliance services are specially designed to help community banks and credit unions meet their regulatory requirements.