Category: Compliance

01 Apr 2021
The Security Evolution Featured Blog Image
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Security Evolution: The Integration of Security and Technology in Your Bank’s Infrastructure

The Security Evolution Featured Blog Image

Financial institutions and other organizations face a head-spinning number of information security risks—and the threats are becoming more complex and difficult to detect. In 2020, the FBI’s Internet Crime Complaint Center received a record number of complaints: 791,790, with reported losses exceeding $4.1 billion. The complaints—many of which included sophisticated phishing emails, business email compromise, and ransomware—represented a 69-percent increase in total from 2019, according to the FBI 2020 Internet Crime Report. In almost every case, a financial institution was involved; either as the direct target, a payment intermediary, or the account holder (victims) source of funds.

Importance of Resilience

With IT security, one of the primary goals for financial institutions is to minimize operational risk by limiting downtime; a process also referred to as “resilience”. Formally defined as the “…ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions…”, resilience also includes the ability to withstand and recover from deliberate attacks or naturally occurring disasters.

Resilience extends beyond after-the-fact recovery capabilities to incorporate proactive measures for mitigating the risk of a reasonably anticipated disruptive event in the overall design of operations and processes, including IT infrastructure. Resilience strategies, including maintaining security standards, should extend across the entire business, including outsourced activities. Because of the constantly changing threat environment, banks and credit unions should be regularly refining their security strategies. But it can be challenging for institutions to effectively manage the resources required to create a resilient infrastructure, including the staff, hardware, software, facilities, utilities, and other resources required to support operations. This monumental task encompasses everything from technology and telecommunications infrastructure to the critical dependencies provided by third-party service providers.

With so much complexity, having integrated security controls that coordinate and communicate with each other can make it easier for institutions to detect and prevent an incident before it happens, and to respond and recover afterward. Integration involves blending separate technology and controls into a single system that simplifies the work of short-staffed, time-strapped IT departments. The integration of security technology can ensure that financial institutions have a more manageable—and sustainable—approach to addressing the increasing volume and sophistication of security threats that they encounter.

Compliance and IT Security Integration

Of course, the rationale for integrating security and technology goes beyond the practical need to safeguard an institution’s information, infrastructure, and other assets, as it’s also a matter of compliance.

Information security should be embedded within the institution’s culture, according to the Federal Financial Institution Examination Council (FFIEC), and an institution’s security culture contributes to the effectiveness of its information security program. In fact, the FFIEC IT Handbook’s Information Security booklet indicates that “an institution with a stronger security culture generally integrates information security into new initiatives from the outset and throughout the life cycles of services and applications.”

Financial institutions should have a robust and effective information security program that supports their IT risk management process, according to FFIEC guidelines. Based on the FFIEC IT Handbook’s Information Security booklet, an effective IT program should:

  • Identify threats, measure risk, define information security requirements, and implementing control
  • Integrate with lines of business and support functions in which risk decisions are made
  • Integrate third-party service provider activities with the information security program

Third-party Management

Integrating third-parties into your security program is not just accepted by the regulators, it’s expected. According to the FFIEC, “In many situations, outsourcing offers the institution a cost-effective alternative to in-house capabilities…without the various expenses involved in owning the required technology or maintaining the human capital required to deploy and operate it.” However, the FFIEC goes on to recommend that institutions who elect to outsource technology, line of business activities, and support functions, ensure the integration of these activities with their information security program through an effective third-party service provider (vendor) management program. The FFIEC IT Handbook’s Information Security booklet asserts that: “Effective integration of these programs is evident when the institution creates and enforces expectations that align with the internal information security program in such a way that the combined activities of the institution and its third-party service providers result in an acceptable level of risk.”

Security threats will always be a constant challenge, but successfully integrating security and technology within an institution’s banking infrastructure can help institutions win the fight. Safe Systems provides banks and credit unions with an array of compliance-focused IT services to help them improve their overall security posture. Our proven experience, paired with our compliance-focused technology and security solutions, enables financial institutions to significantly strengthen their resilience by seamlessly aligning compliance and security.

25 Mar 2021
The ISO in 2021 Featured Image
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The ISO in 2021: New Challenges and Expectations Require a New Approach

The ISO in 2021 Featured Image

One of the key lessons financial institutions learned from the COVID-19 pandemic is that regardless of new challenges and seemingly constant change, they were expected to ensure their customers and members continued to receive products and services uninterrupted. The past 13 months (and counting) have been a live exercise in operational resilience.

The current crisis—perhaps more than any even prior—has underscored the true scope of the Information Security Officer’s job. Technically, there are only eight broad areas of responsibility for ISOs outlined in the Federal Financial Institution Examination Council (FFIEC) IT Handbook’s Management booklet. But the actual scope of ISO accountability spans at least 36 elements. One of the key challenges and responsibilities of the ISO is stakeholder reporting, which is intricately linked to accountability. The relationship between responsibility and accountability is that while the ISO is responsible for making sure critical InfoSec tasks are completed, they are also accountable to the various stakeholder groups, which requires providing documentation that a task is being completed a certain way, with a certain group, or with a certain frequency.

To meet their accountability obligations, because information security is pervasive, ISOs must be engaged at all levels across the enterprise and in all lines of business. This requires understanding every place that data is stored, processed, or transmitted—whether it involves a customer or member, employee, or vendor. The ISO also needs to be aware of the latest emerging risks and be able to implement an effective mitigation strategy. Ultimately, ISOs need to be effective at translating information to the board, management committee, and IT auditors and examiners, in a manner in which these various stakeholders are best able to consume and comprehend it.

The expectations for ISOs also extend beyond the traditional area of ensuring the confidentiality, integrity, and availability of data. ISOs are also responsible for minimizing the disruption or degradation of critical services—which has emerged as the more urgent necessity during recent pandemic and cyber events.

Some of the early challenges ISOs faced during the pandemic ranged from the technical, such as securing virtual private network access, to the administrative, such as ensuring that employees have signed acceptable-use policies and remote-access agreements. Fortunately, we’ve found that most institutions adjusted well to the initial hiccups, resulting in minimal degradation in their services. However, cybersecurity promises to keep that pressure on for the foreseeable future, even post-pandemic.

Predictably, financial institutions are now seeing more exam scrutiny in three areas.

Business Continuity Management (BCM)

When the FFIEC implemented a BCM update in 2019, it created new terminology and new expectations that are finally beginning to emerge in exam findings.

Strategic Planning

The expectation for additional strategic planning is calling for more formal project management procedures. On the IT examination side, FIs are receiving requests for “pre-initiative” risk assessments, meaning that ISOs are expected to assess the risks of a project or initiative before they even agree to move forward and select a vendor. The FFIEC’s Development and Acquisition Handbook states that “Poor planning often contributes to projects failing to meet expectations.” This early stage is referred to as the “initiation” or “feasibility” phase of the project. Once the project clears this phase and moves forward, a vendor or vendors are selected, and vendor due diligence and on-going management can proceed. As the project proceeds to completion, management should be kept informed.

Board and Committee Reporting

Which is now focusing on not just what gets reported, but the frequency of the reporting as well. Suffice to say that the traditional annual updates won’t get it done going forward.

A New Approach to Virtual ISO Services

With ISOs being forced to wear multiple hats, some institutions are choosing to leverage a virtual ISO solution. Whether outsourced, insourced, or a hybrid virtual ISO model, each offers varying levels of service, flexibility, and support. Further still, several FIs are leveraging technology in tandem with security expertise to support their ISOs.

Safe Systems’ ISOversight is a proven risk management solution that provides complete and comprehensive accountability for the responsibilities of the ISO position. This third-party solution assigns a dedicated ISO oversight lead who understands the details of the institution’s environment and provides institutions with expert guidance and access to additional resources. ISOversight is an ideal asset for new (or frankly, overwhelmed) ISOs that may be struggling to keep up with the complex responsibilities of their position. And now with federal and state examiners tightening their level of scrutiny, ISOversight is proving even more crucial for institutions that need to enhance their information security expertise.

To learn more about how Safe Systems is supporting ISOs in the industry, listen to our webinar on “The ISO in 2021: A New Approach to New Challenges and Expectations.”

11 Mar 2021
Segregation of ISO Duties Critical to Network Security and Regulatory Compliance for FIs
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Segregation of ISO Duties Critical to Network Security and Regulatory Compliance for FIs

Segregation of ISO Duties Critical to Network Security and Regulatory Compliance for FIs

It’s essential that banks and credit unions maintain segregation of duties between their information security officer (ISO) and network administrator to ensure network security, regulatory compliance, and the overall health of their operations.

From a regulatory standpoint, the separation (or segregation) of the ISO’s duties is the corrective action to a concentration of duties finding. Management should designate at least one information security officer responsible and accountable for implementing and monitoring the information security program, according to the Federal Financial Institutions Examination Council (FFIEC) IT Handbook’s Information Security booklet. The booklet states: “ISOs should report directly to the board or senior management and have sufficient authority, stature within the organization, knowledge, background, training, and independence to perform their assigned tasks. To ensure appropriate segregation of duties, the information security officers should be independent of the IT operations staff and should not report to IT operations management.”

The FFIEC also provides guidance on this matter in the IT Handbook’s Management booklet. “The institution should separate information security program management and monitoring from the daily security duties of IT operations. The IT department should have personnel with daily responsibility for implementing the institution’s security policy,” the booklet explains. “Responsibility for making changes and granting exceptions to policy should be segregated from the enforcement of the controls.”

Oversight Is the Key Issue

The importance of isolating the ISO’s duties comes down to oversight as separating the functions of the ISO and network administrator helps to create a clear audit trail and ensures that risk is being accurately assessed and reported to senior management. Without proper oversight reporting, financial institutions and their Boards lack a clear picture of their information security posture and can face other negative repercussions, such as downgrades in their Management IT component.

If, for instance, the ISO shares administrative duties and an administrator account, oversight dynamics can be undermined. As an example, the admin may have day-to-day responsibility for patch deployment, but the ISO is ideally suited to monitor and validate the overall patch management program—not the network administrator. The ISO has a higher-level, enterprise perspective of the impact of day-to-day activities; whereas the admin is at the ground level and may not always be capable of accurately assessing the full impact of performing, or not performing, a particular task. In addition, the definition of “oversight” is basically having another set of eyes validate the actions of someone else.

Understanding the Role and Duties of the ISO

The ISO’s oversight role primarily serves to ensure the integrity of a financial institution’s information security program. In essence, by segregating the admin/ISO duties, ISOs are the “other set of eyes” that help to maintain a level of accountability to management, the board, and other stakeholders.

The responsibilities of the ISO are clearly outlined in the FFIEC’s Information Security and IT Management booklets. Some of the ISO’s key duties include responding to security events by ordering emergency actions to protect the institution and its customers from imminent loss of information; managing the negative effects on the confidentiality, integrity, availability, or value of information; and minimizing the disruption or degradation of critical services.

However, in fulfilling these obligations, ISOs are expected to continually meet a high standard of information privacy and security. It’s imperative for institutions to not only assign the proper responsibilities to the ISO but to also select the right individual to assume the role.

Banks and credit unions often have difficulty designating an ISO with the appropriate technical and regulatory compliance expertise. Institutions in rural or small communities—where the talent pool is meager—might even have their chief financial officer or chief operations officer wear the hat for this “part-time” job. Regardless of these challenges, community institutions are expected to maintain the same level of segregation of duties as larger institutions. Size and complexity considerations may allow for some leeway in the timing of the separation, but not the ultimate outcome.

Leveraging a Virtual ISO

For every responsibility, there is an associated piece or set of documentation that must be provided to demonstrate adherence to and alignment with your formal written procedures. Not having an ISO with the requisite knowledge and/or time to effectively manage the assigned responsibilities of the position can result in control failures—and possibly policy or procedure non-compliance. In some cases, financial institutions may have a separation of duties “on paper”, but not so in practice. Again, the absence or presence of oversight is the key.

In fact, feedback from examiners indicates that because of the lack of oversight, there is a certain level of concentration of duties that cannot be adequately addressed internally. But institutions can remedy this problem by engaging a third-party, virtual ISO to add assurance that all responsibilities are being successfully addressed. A virtual ISO can provide another set of eyes and an independent layer of oversight on top of what the institution already has in place internally.

Virtual ISO services from Safe Systems, a national provider of fully compliant IT and security services, can be the ideal solution for community banks and credit unions. Safe Systems has proven experience in providing institutions with dependable technical expertise to ensure there is adequate separation of ISO-related duties within their organization—enhancing network security and significantly increasing regulatory compliance.

04 Mar 2021
5 ISO Duties that Can Be Automated for FIs
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

5 ISO Duties that Can Be Automated for FIs

5 ISO Duties that Can Be Automated for FIs

Information security officers (ISOs) at financial institutions typically have myriad responsibilities on their plates, and each of those responsibilities comes with one or more forms of documentation to verify the actions taken. While these duties relate to the main categories of network security and regulatory compliance, there are a host of functions that fall under the ISO’s oversight role.

Fortunately, many ISO responsibilities can be automated in some areas to facilitate the management of the institution’s information security program. Here are five of them:

1. Business Continuity Management (BCM)

ISOs are responsible for overseeing and coordinating BCM, providing detailed guidance on how to recover from a business interruption, and ensuring that the appropriate people, processes, and technology components that make up the network of interdependencies are also restored. Automation can make it easier for the ISO to identify the interdependencies, complete the annual updates, and conduct the training exercises and testing required. Automation can also enable alerts for tasks due by process owners, and generate reminders for annual plan board approval, and report the test results to the board. While the tests for BCP cannot be automated, the documentation and reporting of the tests can—something that can significantly streamline the ISO’s oversight responsibilities and make it much easier to locate these documents at audit and examination time.

2. Updates to the Information Security Program and Information Security Risk Assessment

Automation can provide alerts to help ISOs keep abreast of updates from regulators. Then the ISO can easily pull reports on the revised areas to present them for board approval. Essentially, it’s plan maintenance that can be automated—although some interpretation is needed to support the process. Automation can prevent an institution’s information security program from becoming out-of-date (which can happen easily when an ISO is relying on manual processes for management) as failing to make an important update can have significant, negative consequences. For instance, if management misses a major BCP update, or an annual test, or board reporting, auditors may construe this as a general weakness in management, and scrutinize other areas more closely, such as lending practices or financial reporting. Automation can help institutions avoid inadvertent missteps and resulting hassles within their information security program.

In addition, many recent examination findings relate to inconsistencies between the institution’s policies (what they say they do) and their procedures (how they say they will do them). Automation, when combined with integration between applications, can greatly reduce this probability by easily propagating policy and procedural changes throughout all elements of your information security program. For example, sometimes financial institutions will update their BCM plan but might be lax with other policies—something that can result in a disconnect between different policies. In this case, one policy may refer to a process that is no longer being used; or a policy may contain conflicting references for a process that has been updated. These and other kinds of inconsistencies are virtually impossible to catch without automation and integration.

3. Tracking Audit Exam Findings

Unresolved, or “repeat” findings are usually treated very harshly by regulators. Making sure that all audit and exam issues are resolved in a timely manner is crucial. Automation can rate the severity, assign them to a responsible party, assign a due date for resolution, and sending “ticklers” and reminders as the dates come due. At the end of the process, the ISO can quickly generate reports to provide to the institution’s board, examiners, and other stakeholders. Alerts and on-demand reporting can enhance accountability for addressing each of the findings to improve internal controls and other areas.

4. Managing Third-party Relationships

Financial institutions are required to manage the risks of their third-party vendors and the responsibility to assure this is done falls squarely on the shoulders of the ISO. Institutions can use automation in every aspect of their vendor relationship management, including alerting and tracking of periodic updates to the risk assessments, annual updates to the control reviews, contracts, and contract renewals. With automation, the ISO can instantly identify required tasks and produce the necessary documentation related to its vendor management activities.

5. Cybersecurity

Cybersecurity is an important sub-component of information security, and automation can significantly enhance the ISO’s multiple oversight efforts in this area. An automated system can remind ISOs to verify that crucial assessments are completed, including the annual Cybersecurity Assessment Tool (CAT) and the Ransomware Self-Assessment Tool (R-SAT). Alerts can be scheduled to prompt ISOs to conduct annual incident response tests, a gap analysis, and cybersecurity training for employees and the board. And on-demand reporting can keep all stakeholders informed on the progress of your cybersecurity efforts.

One final thought about automation; when the application is combined with a provider familiar with, and dedicated to, the regulatory environment of the financial institution, you do not have to worry about a non-compliant policy or procedure. All necessary regulatory and best practice updates are built-in to the automation.

As a national provider of fully compliant IT and security services, Safe Systems offers a variety of innovative solutions that can help financial institutions automate some of the important responsibilities of their ISO.

25 Feb 2021
Key Areas of Focus for Your Regulatory IT Exam
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Five Key Areas of Focus for Your Regulatory IT Exam

Key Areas of Focus for Your Regulatory IT Exam

We’re back with part two of our IT Exam Prep blog series.

Picking up where we left off, there are five key areas where we expect you’ll likely be scrutinized closely at your next exam cycle:

  • Cybersecurity
  • Business continuity management
  • Outsourcing and third-party vendors
  • Governance and management engagement
  • Strategic planning

Of these, the most challenging, and most important, for smaller institutions might be governance and management engagement; the CAMELS “M”. This is true because often smaller institutions may have a more informal reporting structure.

For example, relevant issues may be discussed in committees and may even be reported upstream—but they may not be sufficiently documented. The issue is not just a matter of how you engage and report to senior management and the board, but rather, how you document that the necessary practices are in place. This is important when discussing day-to-day operational matters, but even more important when addressing issues of long-term strategic significance.

Although documenting management engagement can be particularly challenging, institutions must focus on all areas when prepping for an exam. You may not have time to rigorously prepare for every aspect, but you cannot afford to be lax in any one area, as examiners expect all areas of information security to be addressed. However, even if you are not where you need (or want) to be in any particular area, knowing where you are will often buy you additional time.

Our experience is that examiners will often give you additional time to address an issue if they know A) you are aware of it, and B) you have a plan in place (including a timeline) to address it. In short, if you haven’t had the opportunity to conduct a BCM exercise in the past 12 months, at least acknowledge it and have one on the calendar for the near future.

Ransomware on The Rise

As we discussed here and here, both the pandemic and cybersecurity will continue to dominate the infosec landscape for the foreseeable future, and because of that, are sure to receive special consideration during your next exam cycle. In particular, ransomware is a hot-button issue for examiners as attacks have been accelerating and cybercriminals capitalize on the security vulnerabilities and disruption caused by more employees working from home.

These malicious destructive malware attacks are becoming more targeted, more sophisticated and more costly, according to the FBI. Even more disconcerting is the fact that modern ransomware variants can not only lock data in place so that it’s no longer available to the institution but also exfiltrate data, making a secondary data disclosure attack much more likely. Another recent variant locks your data and initiates a distributed denial of service (DDoS) attack against your website if you don’t respond.

Resiliency

One common denominator between all five areas of focus is the concept of “resiliency”, which is the ability to withstand and recover from unplanned and unanticipated events. Examiners increasingly want to see a proactive approach to resilience, and when institutions implement the proper measures ahead of time, this can reduce their risk of operational downtime during a cyberattack, pandemic, natural disaster or another event.

Simply put, once ingrained into your practices and procedures, the reactive measures taken today become the proactive measures of tomorrow. Also, don’t forget to build resiliency into all future initiatives. If the initiative is important enough to implement and maintain, it’s important enough to protect from downtime.

Today, banks and credit unions are taking advantage of a host of resources to mitigate ransomware and other IT security issues, including the Cybersecurity Assessment Tool (CAT), the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), and the Ransomware Self-Assessment Tool (R-SAT). In addition, consulting with a third-party IT expert can help institutions better prepare for assessments and respond to difficult questions from examiners.

The bottom line is that regardless of the format regulators require for an examination, you can expect them to address a wide variety of areas. So, focus on the areas outlined here and in part one of this series, but be prepared to discuss all the relevant actions your institution is undertaking.

23 Feb 2021
Part 1 - Financial Institutions, Know What to Expect at Your Next Regulatory IT Exam
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Financial Institutions, Know What to Expect at Your Next Regulatory IT Exam

Part 1 - Financial Institutions, Know What to Expect at Your Next Regulatory IT Exam

While sometimes the IT examination is separate, most of the time it’s incorporated into the Safety & Soundness exam. Regulatory examinations like Safety & Soundness are designed to assess the financial health and risk management practices of a financial institution, and the results are expressed as a number “grade” from 1 (highest) to 5 (lowest). An information technology (IT) exam is narrower in scope and utilizes four components to assess information management maturity: Audit, Management, Development and Acquisition, and Support and Delivery (AMDS).

With the twin challenges of the Pandemic and cybersecurity continuing into 2021, on top of an already full plate of regulatory expectations, it’s critical for institutions to be prepared to address all IT issues to meet regulator expectations and ensure their safety and soundness.

So exactly what should financial institutions expect at their next IT regulatory exam? We’ll break it down in a two-part IT Exam Prep blog series.

The Pre-examination Questionnaire

On one hand, anticipating the exam elements is relatively straightforward, as the examiner will provide a pre-exam questionnaire. This is somewhat akin to an open-book test where the questions are provided ahead of time.

However, there is no single standardized questionnaire that all regulators adopt—and there likely won’t be in the foreseeable future. (The InTREx was an attempt by the FDIC a couple of years ago to standardize the process, but it is not yet caught on universally.) So, when the examiner sends his or her pre-exam questionnaire, that essentially provides the framework you should follow to prepare for your examination.

Nevertheless, bankers should expect a certain amount of the unexpected. While you should expect examiners to closely adhere to the pre-examination questionnaire, there will most likely be “curveball(s)” included. Curveballs are deviations from the questionnaire that could trip you up if you’ve followed it too strictly.

But if you’ve done your job correctly and addressed all infosec matters adequately since your last exam, you are better positioned to pivot when you need to during the exam. In other words, treat the pre-exam questionnaire more as a starting point than a checklist. And if you find yourself presented with a difficult question, do not respond with anything you are not 100 percent sure of, and that you know you can document. It is perfectly acceptable – and advisable — to wait and answer the question later when you have the appropriate information available.

One final point about examiner interaction: we strongly advise that your ISO be the primary point-person for the exam.

In most institutions, the ISO has the broadest and deepest knowledge of your information security procedures and practices. The ISO can bring in others as needed (network admin, internal audit, external providers, etc.), but they should still stay very close to the conversation. We’ve seen many situations where someone other than the ISO is interviewed by the examiner, and because of the person’s comparative lack of knowledge, it has resulted in exam findings that otherwise could have been avoided.

To ensure your financial institution’s next regulatory IT exam is a success, stay tuned for part two of our IT Exam Prep blog series, where we will dive into the key areas of focus you can expect to be evaluated on.

14 Jan 2021
Looking Ahead to 2021: A Regulatory Compliance Update
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Looking Ahead to 2021: A Regulatory Compliance Update

Looking Ahead to 2021: A Regulatory Compliance Update

As we mentioned in our previous blog, the Pandemic dominated the regulatory landscape early in 2020, and cybersecurity dominated the last few months of the year. This double-whammy forced financial institutions to quickly make operational adjustments to their procedures and practices. In the previous post, we explored the Pandemic. In this post, we’ll summarize the regulatory focus on cybersecurity in 2020, and look ahead to 2021.

Focus on Ransomware

The escalation of ransomware attacks (also referred to as destructive malware) has prompted a greater focus on addressing this aspect of cybersecurity. On October 1, 2020, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) issued an advisory to alert companies about possible sanctions for facilitating ransomware payments. Financial institutions should be aware that they (and their cybersecurity insurance provider) could be in violation of OFAC regulations should they decide to pay a ransom to anyone on the Specially Designated Nationals (SDN) list. This would place the institution on the hook for payments made by themselves, or by any third-party on their behalf. Institutions should address this issue during incident response testing by including their cyber insurance company and making sure they know that paying a ransom could trigger penalties or sanctions.

The heightened emphasis on ransomware also led to the release of a new Ransomware Self-Assessment Tool (R-SAT) in October 2020. Developed by the Bankers Electronic Crimes Taskforce (BECTF), the U.S. Secret Service, and state bank regulatory agencies, the R-SAT follows established best practices to help financial institutions reduce their risk of ransomware. We have reports from several banks around the country that their State examiners are requesting completion of the R-SAT prior to their examination. Unlike the CAT, the 16-question tool only allows “Yes” or “No” responses, it does not give users the option to answer “Yes with compensating controls”. This lack of flexibility does not work in the favor of smaller, less complex financial institutions, which may have informal practices in place that still accomplish the same objectives as the more formal practices of the larger institutions.

Nonetheless, the yes/no response format should not be an issue if institutions have already taken steps to address ransomware and, more broadly, cybersecurity. They can simply point regulators to relevant supporting details, (completed CAT assessments and incident response plans and tests for example) and that should be sufficient to demonstrate compliance. It’s also important to note that what we’ve heard from state regulators is that they are not strictly requiring institutions to employ the R-SAT, only that they intend to use the assessment as a starting point for further discussion. Increased discussion surrounding shared cyber threats facing financial institutions is never a bad thing!

Finally, the OCC released their semi-annual Risk Perspective in November and singled out cybersecurity as a key operational risk. While they point out that overall banks have adequate cybersecurity systems, they have seen some weaknesses related to IT, change management, and information security. We can expect increased scrutiny in these areas, and cybersecurity generally, for the foreseeable future.

What to Expect in 2021

One common denominator between the Pandemic and cybersecurity is the concept of resilience. Resilience, or the ability to withstand and recover from unplanned and unanticipated events, is all about proactive as opposed to reactive measures. It equates to implementing procedures ahead of time—rather than just responding to past events—to reduce the risk of operational downtime. Granted, the impromptu procedures established during the COVID-19 pandemic, or following a cyber-attack, are reactive in nature. But, once firmly in place and tested in the real world, they become the proactive resilience measures ready for when the next event occurs.

One additional factor common to both Pandemic and cybersecurity is proper management and oversight of third-parties. We expect that examiners will scrutinize how institutions manage the third-party lifecycle; from the initial decision to engage the third-party, to assessing and controlling on-going risk, to disengagement at the end of the relationship. Among the elements attracting attention are whether you are tracking the complementary user entity controls for critical vendors. These are found in the SOC 2 reports and list the controls expected of you by the vendor. Be aware of these vendor expectations, and document how you’ve addressed them.

In summary, take extra precautions in 2021 relating to cybersecurity (particularly ransomware), another potential Pandemic event, and third-party management. Document everything you’ve done or plan to do (e.g., resilience measures), and most of all stay flexible. If we’ve learned anything from 2020, it’s to expect the unexpected!

08 Jan 2021
2020 in the Rearview: A Regulatory Compliance Update
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

2020 in the Rearview: A Regulatory Compliance Update

2020 in the Rearview: A Regulatory Compliance Update

The COVID-19 pandemic dominated the regulatory landscape early in 2020, with cybersecurity dominating the last couple of months. Here is a look back at important regulatory changes and trends in 2020 and a look ahead at what to anticipate for 2021.

Characterizing Causes of Weakness

When it became obvious that the pandemic would have a pervasive and wide-ranging effect, the Federal Financial Institution Examination Council’s (FFIEC) issued several statements to address the situation. The FFIEC outlined some of the adjustments and accommodations that regulators expect bankers to make concerning lending, operational risks, and other areas. For instance, if an exam results in downgrading component or composite ratings for an institution, a distinction will be made between any weakness caused by the pandemic vs. management and governance issues.

Essentially, examiners will differentiate between a weakness resulting from an external event versus an internal systemic issue—even if the event is beyond management’s control.

The statement issued in June 2020, states, “Examiners will consider whether institution management has managed risk appropriately, including taking appropriate actions in response to financial and operational stresses caused by COVID-19 impacts.”

It is uncertain exactly how this issue will be interpreted in a post-pandemic world. After all, pandemic should be a part of all financial institutions’ business continuity planning, and as such, not completely outside the realm of a reasonably anticipated threat. So ideally management should have anticipated such an event, and have been prepared to respond. The only unanticipated aspect of the current Covid 19 event is the extreme extended duration compared to a standard Pandemic. It will be interesting to see how the agencies square the concepts of a “reasonably anticipated threat” vs. “external factors beyond management’s control”. Aren’t most threats both reasonably anticipated, and also beyond management’s control? We’ll let you know if and when we get any clarification on that.

Regardless of the scenario, documentation is crucial and often overlooked. Most folks are laser-focused on just getting past this and back to “normal” business, but memories fade over time, and documenting what adjustments you’ve made (or plan to make) during the pandemic will make the post-pandemic adjustments easier to explain to management and justify to examiners. Documentation can also help establish your increased ability to anticipate and respond to the next threat, also referred to as “resilience”. Institutions should make every attempt to document all management decisions, such as the minutes from management meetings, communications with third-parties, and any strategic or procedural changes you may have made or need to make. For example, if you’ve implemented technology to enable an increased mobile workforce (a strategic change), have you updated the remote access procedures and best practices in your employee Acceptable Use Policy accordingly (a procedural change)? Have all remote employees signed the updated AUP?

In our next blog post, we will dive into the focus on ransomware mitigation, how best to address cybersecurity, and what to expect heading into 2021.

01 Dec 2020
Why Documentation is an Essential Priority During the COVID-19 Pandemic
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

Why Documentation is an Essential Priority During the COVID-19 Pandemic

Why Documentation is an Essential Priority During the COVID-19 Pandemic

While financial institutions have spent the last nine months focused on pandemic response and ensuring critical services remain available to their customers and members, there are other key areas of consideration to ensure their institutions remain compliant and can thrive in the future, including documentation. Unfortunately, few financial institutions are adequately documenting their efforts and new strategies as they are being implemented. Below are three key reasons why they really should.

1. Regulatory Expectations

Examiners will expect to see how financial institutions have handled the pandemic and that all of the lessons learned are reflected in their business continuity management plans (BCMP).

Some key questions regulators may ask regarding pandemic response include:

  • What have you learned from this event?
  • What have you done to enhance your pandemic plan based on those lessons learned?
  • Prior to this event, had you analyzed your business processes and their interdependencies, and prioritized them by recovery time?
  • Have you identified employees with job duties capable of being performed remotely? If so, did they have secure, reliable, remote access?
  • If those job duties are highly specialized, or highly critical, did you have alternate personnel identified and pre-trained to step in when needed?

2. Key Lessons Learned

All banks and credit unions must take a different approach to pandemic planning that fits well with their institution’s unique needs. They need to consider all of the challenges they’ve faced throughout the pandemic and apply key lessons learned to enhance their operations, including the importance of cross-training staff, enhancing security measures, succession planning, or improving technology for an employee to work at home. Until the pandemic passes, financial institutions should continue to reference their business continuity plans and document the entire process to create a blueprint for reference if a similar situation arises again in the future.

3. Strategic Planning

According to the FFIEC, an entity’s strategic planning should be developed to address all foreseeable risks, and these risks should cover the potential impact on personnel, processes, technology, facilities, and data. Throughout the pandemic, financial institutions should track what they are doing, how they are doing it, and whether any new procedure should be included in their existing crisis management or response plan.

The key is for institutions’ steering or strategic planning committee to stop periodically and document—or backfill information after the fact (at least a month or a quarter later.) Failing to document this process will result in institutions returning to business as usual after the crisis subsides and potentially making serious mistakes if a pandemic situation occurs in the future.

To learn more about pandemic response and key priorities for financial institutions, download our latest white paper, “Navigating the Coronavirus pandemic: Best Practices for Pandemic Planning and Key Lessons Learned for Community Banks and Credit Union.”

19 Nov 2020
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

3 Key Concepts to Incorporate into Your Business Continuity Management Plans

3 Key Concepts to Incorporate into Your Business Continuity Management Plans

The 2019 FFIEC Business Continuity Management Handbook represented a significant change in how bank and credit union examiners will assess your business continuity planning efforts going forward. Here are 3 concepts to make sure you’ve incorporated into your Business Continuity Management Plan (BCMP):

1. Likelihood and Impact

According to the Federal Financial Institution Examination Council’s (FFIEC) Business Continuity Management Handbook, “management should evaluate the likelihood and impact of disruptive events. Risks may range from those with a high likelihood of occurrence and low impact such as brief power interruptions to those with a low probability of occurrence and high impact such as pandemics. The most difficult risks to address are those that may have a high impact on the entity but a low probability of occurrence.”

Performing a risk assessment helps financial institutions identify all potential risks and classify them based on probability and impact. They should also quantify the impacts and define loss criteria as either quantitative (financial) or qualitative (e.g., impact to customers, reputational impact). However, to efficiently assess these risks, banks and credit unions need to be able to visualize them and plan accordingly. One way to do this is to use a four-quadrant matrix to scatter graph and plot the likelihood and impact of every threat.

Likelihood and Impact Graph

There are many other ways to do this, but whichever method you choose, examiners expect financial institutions to be able to document both probability and impact, and not only for the high probability and high impact threats, but also for the low probability high impact threats.

Although the Handbook lists Pandemic as an example of a low probability, high impact event, you may want to adjust the probability (and possibly the impact) rating upward based on the COVID 19 event. At this point, it is a certainty that everyone has been impacted somehow.

2. Resilience

Resilience is the ability to prepare for—and adapt to—changing conditions, and both withstand and recover rapidly from disruptions, whether that includes deliberate attacks, accidents or naturally occurring threats or incidents. The first step to resiliency is to identify your proactive measures for mitigating the risk of a disruptive event such as:

  • Off-site repository of software (Data vaulting)
  • Appropriate backups of data
    • Cloud-based disaster recovery services may be considered as part of resilience programs
  • Off-site/redundant infrastructure (Hardware, data circuits, etc.)
  • Third parties (Alternate vendors/suppliers)
  • Key personnel (Succession planning)
  • Cybersecurity assessment tool
    • Annual process of considering changes in inherent risk and how your evolving in maturity

These are things you probably are already doing. If so, you can use your calculations to show that you already have proactive resilience measures in place.

Make sure to incorporate any adjustments made and lessons-learned from the recent Pandemic into your inventory of resilience measure against the next pandemic.

3. Inherent vs. Residual Impact

Although the residual risk rating is often used as the measure of the effectiveness of your risk management program, best practices mandate that management should use inherent risk ratings to guide their recommendations for (and use of) mitigating controls. However, when calculating residual threat impact, you can factor in any existing impact mitigation measures you already have in place. For example, if you use forewarning, duration, and speed of onset to calculate impact, any measures taken to reduce those 3 factors can also reduce your impact rating:

  • Example 1: Smoke detector & Fire detection equipment decreases the impact of fire by increasing the forewarning factor
  • Example 2: Auxiliary power decreases the impact power outage by decreasing the duration factor
  • Example 3: Good project management practices decrease impact of strategic risk by slowing the speed of onset factor

This is how you can take advantage of the existing measures you already have in place to decrease the residual impact of an event. You don’t have to do anything new, just take into account all of things you’ve already done to build resilience into your business continuity plan. Then simply add on where residual risks are still above your risk appetite!

For more information, watch our webinar recording, “The New Business Continuity Guidance Requires a Whole New Approach.”

12 Nov 2020
The Importance of Performing a Cybersecurity Gap Analysis for Banks and Credit Unions
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Importance of Performing a Cybersecurity Gap Analysis for Banks and Credit Unions

The Importance of Performing a Cybersecurity Gap Analysis for Banks and Credit Unions

In response to the Coronavirus pandemic, many financial institutions have implemented new technologies and made modifications to their IT infrastructure to better serve customers, members, and employees during this time. These changes may have increased the institution’s inherent risk profile, however, making it necessary to review the Federal Financial Institution Examination Council’s (FFIEC) Cybersecurity Assessment Tool (CAT) or National Credit Union Association’s Automated Cybersecurity Examination Tool (ACET). When adjustments are made to the organization, community banks, and credit unions must evaluate their risks and perform a gap analysis to ensure the institution is protected from cyber threats.

What is a Cybersecurity Gap Analysis?

A cybersecurity gap analysis starts evaluating the results of the CAT or ACET, (which is simply a snapshot in time of where you are with your risks (inherent risk profile) and controls (cybersecurity maturity) and then comparing “where your institution is” to “where you need to be.” In almost every case, there is some degree of misalignment between the two. Some common questions financial institutions ask are “Could we be doing more to oversee our cloud providers?” or “Should we be doing more to manage our internal administrators or third parties?” The idea of the gap analysis is to take your risk areas and determine what set of controls are most effective against those specific risk areas.

Completing the Cybersecurity Maturity section, for example, helps financial institutions better identify missing controls and processes. So, in order to increase the level of cybersecurity maturity, institutions should continually implement changes even if their inherent risk profile doesn’t change. Conducting a gap analysis is the first step in this process.

Continuous Improvement

Why should institutions strive to continuously improve their security posture even if their risk profile doesn’t increase? Simply put, because the threat environment is constantly evolving. New threats (and new twists on old threats) require constant vigilance and continuous improvements to existing controls. Standing still means you’re probably falling behind. On the other hand, making steady, incremental progress on your control maturity demonstrates a proactive, forward-thinking approach to cybersecurity.

Key Areas of Focus

First, financial institutions must determine if their controls and risks align – no small task as there are roughly 30 risk elements and nearly 500 control maturity elements in the assessment. Attempting to improve all of these areas in the CAT can be challenging and expensive for any institution, but especially smaller community banks and credit unions. While all control maturity domains are important, if your financial institution has limited resources, there are two key domains that you should focus your attention on when developing the gap analysis.

  • Domain 4: External Dependency Management

    • This domain involves establishing and maintaining a comprehensive program to oversee and manage external connections and third-party relationships that provide access to the institution’s technology and information. Most financial institutions have a host of outsourced relationships that they rely on to keep operations running. Evaluating the interdependencies and associated security gaps from third-party vendors should be a key part of your analysis process.

  • Domain 5: Cyber Incident Management and Resilience

    • This domain focuses on establishing, identifying, and analyzing cyber events, as well as the ability to prioritize, contain, and mitigate during cyber events. The institution should also have the ability to properly inform the appropriate stakeholders in response to a cyber event. Cyber resilience includes both planning and testing to maintain and recover ongoing operations during — and following — a cyber incident. In the current security environment, it’s not if a cyber event will occur but when. Financial institutions should have an effective cyber incident response plan to control, contain, and recover from a potential cyber incident.

For more information, watch our Banking Bits and Bytes episode, “What is a Cybersecurity Gap Analysis?”

02 Nov 2020
The Impact of Digital Banking During the Coronavirus Pandemic
Banks, Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

The Impact of Digital Banking During the Coronavirus Pandemic

The Impact of Digital Banking During the Coronavirus Pandemic

The coronavirus (COVID-19) pandemic has drastically reshaped the way banks and credit unions operate today. While financial institutions value face-to-face interactions with their customers and members, social distancing requirements and other safety precautions have caused retail banking to go almost entirely digital. This change impacts not only how financial institutions conduct their business and interact with customers and members, but also how they keep their institutions secure.

In this blog post, we outline 3 key ways the pandemic has impacted the industry and consumers, and how financial institutions are managing these changes in real-time while ensuring they continue to operate effectively for their employees, customers, members, and other stakeholders.

1. Know Your Customer

For banks and credit unions, know-your-customer (or member) procedures are a key function to establish a customer or member’s identity, understand their financial activities, and evaluate the level of risk to the institution. Traditionally, before opening an account, completing a transaction, and/or sharing private information, many financial institutions have relied on at least some face-to-face interactions. For community financial institutions, know-your-customer has gone well beyond best practice to become a competitive advantage. Many (if not most) community institutions pride themselves in knowing their customers by name!

However, due to the COVID-19 pandemic, financial institutions need to find ways to verify their customers’ identities and retain that personal touch using digital channels. Consumers want a frictionless banking experience where they feel trusted and can quickly receive the products and services they need, but they also want to avoid feeling like just another number. Institutions must balance managing remote transactions that could increase their security posture, against technology and policies that positively identify customers without alienating them. As a result, some financial institutions are leaning towards increased security by starting to adopt a “zero-trust” stance where every individual and transaction is considered suspicious unless proven otherwise.

2. Technology Updates

To protect customers and members during the pandemic, banks and credit unions have moved from in-branch, face-to-face interactions to using remote channels such as online, telephone, ATM banking as well as the drive-through to serve their customers. Our experience has been that many institutions that may have technology upgrades on their roadmap two or three years down the road have had to accelerate those projects. Others have added new initiatives to increase their remote capabilities and enhance their electronic services. However, all this likely requires tighter security protocols for customer verification. This can be challenging for smaller financial institutions that rely on more traditional in-branch visits to provide services to their customers or members, particularly if branches are closed or observing limited hours and services. It is up to these institutions to find the right balance of physical and digital solutions to ensure customers and members receive the same level of service they were accustomed to prior to the pandemic.

3. Digital Adoption

The COVID-19 pandemic has driven consumers to rely more heavily on digital channels for their banking needs. This has accelerated digital transformation for financial institutions in the U.S. as their customers demand solutions that allow them to quickly and easily complete transactions remotely. To meet this demand, financial institutions have reevaluated their traditional strategies, implemented and even accelerated digital initiatives, and are more inclined to not just enable but encourage digital capability for their customers. As they encourage consumers to adopt new solutions and remote tools, it will be critical to assess the risk of these solutions and develop controls to keep the network safe and protect sensitive, financial information.

Banks and credit unions must be able to provide the products and services their customers and members need all while keeping information secure, even in the midst of a pandemic. Having a solid plan to guide how you manage operations can make all the difference. One final thought, when the dust settles and things go back to “normal”, the steps you’ve taken to enable digital engagement with employees and customers will be considered resilience measures to mitigate the impact of a future event of this nature. Resilience will be a focus for regulators in future examinations.

To learn more about pandemic planning and best practices, download our latest white paper, “Navigating the Coronavirus Pandemic: Best Practices for Pandemic Planning and Key Lessons Learned.”

08 Oct 2020
Best Practices for Developing a Compliant Cyber Incident Response Program
Banks, Compliance, Credit Unions Jamie Davis 0 comment

Best Practices for Developing a Compliant Cyber Incident Response Program

Best Practices for Developing a Compliant Cyber Incident Response Program

If you think a cyber incident won’t impact your financial institution, you are seriously underestimating the lengths cybercriminals will go to steal your customers’ or members’ non-public information. According to a new report from NuData Security, a Mastercard company, financial institutions receive the highest percentage of sophisticated attacks (96%) amongst all industries.

As cybercriminals continue to exploit organizations and increase the quality of their attacks, financial institutions need to have a compliant incident response plan in place to control, contain, and recover from a potential cyber incident quickly and efficiently.

Safe Systems held a webinar discussing what a compliant cyber incident response plan should look like and shared key best practices community banks and credit unions should use to effectively document a cyber incident. In this blog, we’ll cover a few of the key points from the webinar.

Elements of a Compliant Incident Response Program

The requirements for incident response have changed significantly since 2005. The guidance was broad enough to encompass many of the events that are occurring today including cybersecurity and pandemic-related events. According to the Federal Deposit Insurance Corporation (FDIC), there are five key elements of a compliant incident response program:

  • Assessing the nature and scope of an incident and identifying what customer information systems and types of customer information have been accessed or misused
  • Notifying its primary federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information
  • If required, filling a timely suspicious activity report (SAR), and in situations involving federal criminal violations requiring immediate attention, such as when a reportable violation is ongoing, promptly notifying appropriate law enforcement authorities
  • Taking appropriate steps to contain and control the incident to prevent further unauthorized access or use of customer information
  • Notifying customers when warranted in a manner designed to ensure that a customer can reasonably expect to receive it

Although these requirements have essentially stayed the same, there is one key change that has occurred in the FFIEC’s 2019 update to the Business Continuity Handbook. The guidance now requires financial institutions to reference or include the incident response plan (IRP) in the business continuity management plan (BCMP). While still acceptable to have a separate incident response plan, somewhere within your BCMP you must now reference the IRP.

How to Document and Maintain Evidence of an Incident

Documentation is a key component of incident response to provide auditors, examiners, and other stakeholders with key information about the abnormal event or incident. Initial steps include the recording of basic facts about the suspicious event before it becomes an official incident.

Key questions include:

  • What specific abnormalities were noticed?
  • Where were they discovered?
  • When were they discovered?
  • Who first noticed the abnormality or event and who did they notify/involve?
  • If the event escalates to an incident, how did it happen, and what were the contributing factors that allowed it to happen?

If the event is categorized as an “incident,” you need to know how to document and maintain the evidence; what decisions were made; and the resulting actions taken. When enacting your containment strategies, part of that should involve collection and preservation of the evidence, including all the key records created by all the various technologies your institution uses. The guidance references that all financial institutions should have some type of logging intelligence. But which logs are most important for incident response?

When creating a logging strategy, there are five key challenges to consider:

  • Sources – Logs are generated from various sources such as users, databases or file shares, endpoints, networks, applications, and cloud services. With so many logs coming from different sources, it’s important to be aware of all the systems and applications generating logs and know how to access them to monitor efficiently
  • Log Volume – The volume can be different depending on the source. Some sources are quiet and easier to manage while other sources like network switches and firewalls are a constant torrent of volume and may be difficult to log. It’s important to determine what is realistic for your institution to store and manage
  • Log Protocols – All of the various sources speak different languages or protocols. Some of them are sending emails using a language called simple mail transfer protocol (SMTP), while other sources like network switches are sending information using a constant stream of Syslog data. It is nearly impossible to create a centralized system that can speak all of these languages perfectly so you must determine how your institution will extract intelligence from the logs
  • Log destinations – Once you’ve collected information, where are you going to send it? You’ll need to determine storage destinations for the different types of logs
  • Log interaction – After you’ve built the logging platform, do you want it to be searchable? You’ll need to decide how you want to interact with the data and how long you will keep it. Adding data retention can become significantly more expensive depending on the time frame for storage

Different types of data likely require different lengths of time for retention. Your retention policy should outline the expected retention time frame for each data log. Institutions should carefully consider all these key challenges when building a logging strategy that fits their unique needs.

If you’d like to learn more about cyber incident response, download our recorded webinar, “Not If, But When: Best Practices for Cyber Incident Response.”

01 Oct 2020
After a Year Unlike Any Other, What Community Banks and Credit Unions Should Budget for in 2021
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

After a Year Unlike Any Other, What Community Banks and Credit Unions Should Budget for in 2021

After a Year Unlike Any Other, What Community Banks and Credit Unions Should Budget for in 2021

In 2020 we’ve learned a lot about ourselves, and whether the general population realizes it or not, they have learned a lot about something often relegated just to banking: Risk Tolerance. And with that in mind, here are seven key items that your institution should consider while budgeting for 2021:

1. Laptops

Supply is down, demand is up, so from a pricing standpoint, you are unlikely to find great deals on laptops, but their portability has been a key component to companies and employees being successful during the pandemic. Remote work is a great option for employees who do not need face-to-face interactions with customers or members, but not every department can work successfully outside of the main office or branch.

When planning for next year, each position in the institution needs to be evaluated, if it hasn’t already, to determine the ability and effectiveness of remote working. When possible, consider having remote employees use a company laptop going forward. In a recent Safe Systems survey of community financial institutions, 1/3 of respondents have already decided that they will be purchasing more laptops this year.

2. Hardware Management Software

How many of the controls you use to secure your institution’s devices require the device to physically be in the office? As the work environment changes and more people make the shift to working from home offices, your current controls need to be evaluated to ensure they work just as effectively outside of the branch. For years, the push for “agentless” controls has been popular, but many of these controls assumed the office was a well-defined building where all devices used the financial institution’s network. As the home office becomes the new standard for many banks and credit unions, the need for agent-based controls is greater than ever. Controls/security measures are no longer effective if they require the device to be on premise.

3. Business Continuity Plan (BCP) Update

Having an updated pandemic plan as part of your BCP is still likely a need for many institutions. Because it has been more than a century since a full-scale pandemic hit the U.S., many of the assumptions and concepts that pandemic plans were based on have proven to be incorrect. For instance, many plans outlined operational changes based on only 50% staff for just a week or two. Much of the concern before 2020 was making sure staff members were properly cross trained in the event key individuals were unavailable for days or perhaps a few weeks. While this is still very important, it represents only a tiny portion of truly being ready for a pandemic.

Pandemic plans often did not address managing operations for a long duration or important measures like social distancing, security measures, consumer access, etc. Financial institutions must take a hard look at key lessons learned so far during the COVID-19 pandemic and update their plans accordingly.

4. Moving to the Cloud

Recognizing that having employees working outside of the office is a real possibility moving forward, investing in new servers and putting them in offices is becoming an antiquated idea. The cloud provides a level of redundancy, scalability, and accessibility that cannot be matched by buying a single server. It also means no one has to be in the office to manage the infrastructure. As servers need to be replaced, banks and credit unions should seriously consider the process of moving to the cloud.

5. Client Experience

One question every institution should be asking itself is: “how can we better enhance the customer experience?” While IT is usually seen as a cost center, the events of the past year may have opened a door for IT to step up and offer solutions that directly affect the customer experience. The pandemic has forced many people, some maybe for the first time, to adopt digital banking solutions. If IT can offer specific tools and/or insight into how to improve the customer experience, this may be the opening that IT has hoped for to secure a “seat at the table” among their institution’s leadership.

6. Cybersecurity

Garmin, the GPS and active wear company, reportedly paid $10 million in 2020 to counter a ransomware attack. Their customers were without the services for over a week while Garmin’s data was held hostage. All of the information about their case is not available yet, but the sad reality is that they likely could have prevented the entire situation with just a few technology solutions and security settings being implemented correctly. The threat to your data is as real today as it ever has been. Be sure to have a conversation with a security company you trust to ensure that even if you are the target of a ransomware attack, it won’t be able to hurt your business long-term. Invest in cybersecurity now, so that your institution won’t end up paying much more later.

Consider this: Cyber-attacks are 300 times more likely to hit financial services firms than other companies, according to a recent Boston Consulting Group report, and cyber-attacks continue to climb each year, with the global cybersecurity market expected to eclipse $300 billion by 2024, according to Global Insights.

Unfortunately spend and layers of protection most likely need to increase annually to address this issue.

  • Employee training – to ensure adequate and effective
  • Perimeter protection – to ensure the appropriate layers are enabled and all traffic is being handled correctly including encrypted traffic
  • Advance threat protection and logging – to be able to identify how, if at all, malware or an intrusion created an incident
  • Backup and data redundancy – to ensure ransomware can’t wipe out your data

Per Computer Services, Inc (CSI), 59% of financial institutions will increase spending for cybersecurity this year.

7. ISO

With the increase in responsibilities of the Information Security Officer and the focus on separation/segregation of duties, there has been an uptick in the number of institutions looking for virtual ISO (VISO)-type solutions. These solutions can help by taking some level of burden off of internal resources, provide staff with templates or toolsets when needed, and oversight to ensure nothing is falling through the cracks.

For 2021, there are a lot of things to consider. One focus should be to look at the changes your institution had to make because of the pandemic and what changes you should consider making in the future to improve cybersecurity, information security, and as always, your customers’ and members’ experience.

21 Sep 2020
Three Often Overlooked Elements of an Effective and Compliant Incident Response Plan (IRP)
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Three Often Overlooked Elements of an Effective and Compliant Incident Response Plan (IRP)

Three Often Overlooked Elements of an Effective and Compliant Incident Response Plan (IRP)

In today’s security environment, it’s not if a cybersecurity incident will impact your institution, but when and how big? That’s why having an effective and compliant incident response plan (IRP) is so important to ensure your institution is prepared for the unexpected and equipped to recover.

When a financial institution experiences a cyber incident, the information security officer (ISO), along with the incident response team, must assess the situation and determine if this incident has resulted (or might reasonably result) in exposure of non-public personal information (NPI). If the answer is “yes,” then the team must activate the IRP to contain and control the situation and ensure quick and efficient response and recovery. When activating an IRP, there are three key elements that we sometimes see financial institutions overlook:

1. Incident Response Team Participation

When building your incident response team, it is important to include representatives from each functional unit of the institution. Too often the incident response team consists of IT personnel only. While an incident might seem to be isolated to a certain department (like IT), there could be residual effects impacting other parts of the organization.

For example, let’s say you have an incident that seems to be limited to a group of customers who received a phishing email appearing to be from the institution asking them to click a link to change their ebanking password.

In this situation, you may be inclined to simply involve IT and deposit operation teams. However, because there could be a ripple effect that goes beyond that one incident, you’ll want to include other departments such as lending, human resources, and accounting. For instance, the customer could have a lending relationship or home equity line with the institution that might be impacted as well. Or, the customer could also be a vendor. Furthermore, with the increased possibility of pretexting during a social engineering attack, the Human Resources department may want to use the incident as an opportunity to conduct refresher training to ensure employees know how to verify customer information. As such, it’s important to have all your bases covered and include all functional units on the incident response team.

2. Designated Spokesperson and Social Media Monitoring

Once you’ve activated your plan, it’s important to understand that you cannot simply hope to contain the incident within your organization. A cyber incident may involve key external stakeholders including the Board and senior management, regulatory agencies, law enforcement, third-party service providers, insurance, legal, customers, and may even attract the attention of the media.

When an incident occurs, it is important to have designated spokespeople pre-selected to communicate with each external stakeholder that needs to be informed. For example, you’d want to have your IT admin in contact with the point person at your outsourced IT company because they most likely have a direct relationship with this vendor. However, you probably wouldn’t want that same person reaching out to regulators or customers. A member of senior management would be the best choice for that. In addition, you should designate one or more individuals to be your media contact. Don’t forget to have someone monitoring social media channels to ensure news about the incident isn’t spreading online potentially exposing you to reputational harm.

When developing an incident response plan, designating spokespeople to communicate with external stakeholders and monitoring online social media channels often gets overlooked because the main focus is usually on how the incident happened and how to fix it quickly. The moment the incident response plan is activated it is critical for the incident response team to assign these roles and keep these individuals updated with any interactions they may have with stakeholders.

3. Detailed Incident Documentation and Log Retention

It is imperative that the incident response team creates detailed documentation outlining everything that occurred from the time the event was first identified, even before it became classified as an incident. Again, this is often overlooked as the team engages in containment and control activities. However, regulators, insurance companies, third-party forensics companies, the Board, law enforcement, etc., will need full details when and if they are drawn into the incident. The documentation should detail who responded, what actions were taken, when each action was taken, (the timeline), and why and how (if known) the incident occurred.

Equally important is the retention of any data logs that might assist with the response and recovery phase. Often insurance carriers will need this information if they are involved, and forensic firms will definitely need it if they are drawn into the investigation phase.

We’ll dive deeper into security event logging and best practices for responding to a cyber incident in a future blog post.

03 Sep 2020
The Peoples Bank Implements Virtual ISO Solution to Support Succession Planning for the ISO Role
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

The Peoples Bank Implements Virtual ISO Solution to Support Succession Planning for the ISO Role

The Peoples Bank Implements Virtual ISO Solution to Support Succession Planning for the ISO Role

The ISO is tasked with multiple simultaneous activities; supervising the financial institution’s business continuity planning, project management, vendor management, cybersecurity, exams and audits, and information security, which can be an overwhelming responsibility for one person to manage. This presents operational and compliance challenges for the institution if there is no second-in-command should the ISO become suddenly unavailable. For this reason, the Federal Financial Institution Examination Council (FFIEC) in their Management booklet outlines the importance of succession planning for key roles within the institution, including the ISO.

The Challenge

Effective succession planning involves proactively identifying alternate personnel and initiating proper cross-training for critical roles well in advance. A case in point is Billy Peele, who has worked with Iva, South Carolina-based The Peoples Bank for 45 years, and who has plans to retire by the end of 2020. Overseeing the bank’s IT and InfoSec departments, Peele has also functioned as the institution’s ISO. With a succession plan in place, the bank selected Jill Seymore and Addrian Wilson to jointly assume the title and responsibilities of the ISO in preparation of Peele’s departure.

Although highly skilled in banking operations, Seymore and Wilson initially lacked the level of ISO related experience necessary to fulfill the role. Specifically, the pair wanted a better grasp on the IT reports and to learn best practices in reviewing these reports from the ISO perspective. This learning curve could have been overwhelming for the new ISOs, but The Peoples Bank decided to implement a proven virtual ISO solution to give Seymore and Wilson the tools to become more confident in the new role.

The Solution

Too often, new ISOs do not receive a detailed hand-off document from the predecessor and may not know where to start to complete key responsibilities. Fortunately this was not the case for The Peoples Bank as Safe Systems’ ISOversight Virtual ISO Solution formalized all responsibilities into a structured framework for Seymore and Wilson, allowing for methodical review of all tasks on a monthly, quarterly, and annual basis to ensure continuity for the bank.

ISOversight serves as a risk management tool designed to support the role of the ISO by augmenting existing personnel and ensuring that all tasks and related activities are completed on time and properly reported to the various stakeholders. ISOversight helped ease Seymore and Wilson into the ISO position by grouping all of the various responsibilities into a unified platform to effortlessly manage compliance and security activities. Not only did this clearly outline key requirements of the ISO, but it also educated Peele’s successors on how to effectively perform the role.

The Results

ISOversight gave Seymore and Wilson the confidence that allowed them to trust the bank’s IT department while verifying all interrelated activities are running smoothly and securely. Reviewing reports and receiving alerts with the assistance of the VISO helps the new ISOs extract relevant, actionable information to determine if there are anomalies or exceptions that they should be aware of and act on.

The key to succession planning is to find ways to standardize and maintain the consistency and continuity of the responsibilities of the ISO. In this case, the bank can be confident that information is secure, tasks are being completed on time, and documentation is shared with auditors, examiners, and the board. At The Peoples Bank, ISOversight provided a seamless transition for Seymore and Wilson, while laying a solid foundation for future ISO activities.

For more information, download the full white paper, “5 Case Studies: Exploring Common Challenges Faced By The Information Security Officer.”

27 Aug 2020
Three Virtual ISO Delivery Models for Community Banks and Credit Unions
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Three Virtual ISO Delivery Models for Community Banks and Credit Unions

Three Virtual ISO Delivery Models for Community Banks and Credit Unions

Management should designate at least one information security officer responsible and accountable for implementing and monitoring the information security program.
– FFIEC Information Security Handbook

Information security officers (ISO) have a wide range of responsibilities and navigating them can be quite challenging, especially with increased scrutiny from examiners on alignment of policies, procedures, and practices. Adding to that challenge is the associated element of accountability; the premise that unless your practices are properly documented and reported to the various stakeholder groups, there may be doubt in the mind of the examiner as to whether or not they actually happened.

As a result of this responsibility + accountability challenge, many financial institutions are turning to virtual information security officer (VISO) solutions to support the role of the ISO by augmenting existing personnel and ensuring all tasks and related activities are completed on time; are following approved procedures; and are properly reported to the various stakeholders.

In a recent webinar, Safe Systems outlined the three virtual ISO delivery models available to community banks and credit unions today and discussed key considerations when implementing each.

1. Outsource All Activities

In this model, the financial institution hires a third-party provider to take on all of the responsibility and accountability tasks of the ISO role. Outsourcing these activities minimizes your staff’s involvement, potentially freeing up time to focus on more revenue generating activities, but this approach is typically more expensive because the third-party provider is doing all of the heavy lifting.

Another important consideration is that outsourcing everything can also isolate key personnel from important procedures and practices. If the institution isn’t involved in the day-to-day information security activities, when IT auditors and examiners question your personnel, they may not have the necessary day-to-day procedural knowledge to answer their questions. For example, there will likely be activities the outsourced provider is doing that the ISO is unaware of or they are using procedures not familiar to your personnel. This could lead to audit and examination observations or findings, as the ISO is expected to have comprehensive knowledge and understanding of all information security activities

Outsourcing information security tasks is best for financial institutions with neither the time, expertise, nor inclination to perform the duties of the role. However, it comes at a higher cost, both in terms of capital outlay and also in the possibility of ISO disassociation from actual procedures and practices. The FFIEC Management Handbook uses terms such as “engaging with…,” and “working with…,” and “participating in…,” and “informing…,” to describe the typical responsibilities of the ISO. This level of involvement may be more difficult under the “outsource all” model.

2. Toolset only (Apps, Checklists, Templates, etc.)

Another option is to select a model where there’s a toolset provided to accomplish ISO tasks. The toolset could consist of applications, checklists, or templates that may be prefilled or partially filled. With this model, you’re given the tools to manage ISO responsibilities without the support. There’s less human interaction, which typically means the service is less expensive.

However, the toolset model requires more effort from staff and requires the financial institution to rely on internal resources for information security expertise and guidance. Without this guidance, this model may also introduce some inconsistencies between the institution’s policies and procedures. For example, if you specify something in one area of your policies and you reference something that may conflict with that in another area, auditors are likely going to notice and question you on it, and that could cause them to dig deeper into other areas. Policy/procedure consistency is one of the most important indicators of strong infosec governance.

This model may include access to compliance guidance and expertise, but it would be reactive instead of proactive. It is best for institutions that have the necessary internal expertise, but they just need the additional structure a toolset provides to ensure all activities are completed in a timely manner.

3. Hybrid (Toolset + Consultation)

Finally, a hybrid model combines the first two models to provide a toolset plus additional expertise, proactive guidance, and consultation. It typically has better integration between various ISO practices because it’s all under one umbrella. As a result, the institution gains consistency and better coordination within and among its policies for business continuity, vendor management, incident response, project management, and information security. However, because of the tight integration, financial institutions that do not adopt all of the tools that support this model may not see the maximum benefit. Also, because of the increased level of ISO engagement, it may be more resource intensive initially, especially if the institution is behind on key ISO tasks. However, once tasks are brought up to date, ongoing maintenance is simpler due to the integrated toolset. This model is also quite flexible and can easily adapt to the evolving needs of the institution.

This is the model we decided to adopt for our virtual ISO solution, ISOversight. We’ve found this model is best for institutions that desire the advantages of regular active involvement with outside expertise, plus a toolset and reporting to ensure the ISO remains fully engaged. The price point is somewhere between the other two models; less than a complete outsource, but a bit more than toolset only.

ISOversight is a risk management solution that provides accountability for all of the responsibilities of the ISO. We have monthly touch point meetings, and we tailor the service to meet each institution’s unique requirements.

To learn more about the information security officer role and the benefits of virtual ISO solutions, watch our recorded webinar, “ISO Requirements and Expectations: Accountability vs. Responsibility.”

13 Aug 2020
One Florida Bank Achieves Rapid Growth and Streamlines Information Security with ISOversight
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

One Florida Bank Achieves Rapid Growth and Streamlines Information Security with Safe Systems’ Virtual ISO Solution

One Florida Bank Achieves Rapid Growth and Streamlines Information Security with ISOversight

Mergers and acquisitions can present significant operational challenges for information security officers (ISO) who are tasked with ensuring a smooth transition of the information security program. Often, some key responsibilities of the ISO may be overlooked as other tasks related to the merging of the two institutions take precedence, overextending the ISO as they work to manage the information security program effectively and stay on top of regulations.

The Challenge

Eric Nadeau, chief financial officer at One Florida Bank, faced this very issue when his bank acquired another bank in Florida to expand the institution’s reach across the state. Nadeau wore many hats at the bank serving as the information security officer, chief financial officer, head of accounts payable, and director of both HR and IT. Although Nadeau understood the role and responsibilities of the ISO, he simply lacked the necessary time required to develop a formal program to efficiently complete all ISO-related tasks.

After acquiring the other bank’s charter and then merging the two institutions, Nadeau knew that his bank’s existing compliance management practices would not be enough to accommodate the rapid growth and continue to satisfy the regulators. While he needed assistance in managing the information security program, the institution was not yet ready to make the investment to expand personnel by adding a dedicated ISO.

The Solution

Following the merger, the bank needed a strong operational structure in place to get the now larger institution up and running and meet regulatory expectations quickly. During the acquisition process, Nadeau was introduced to Safe Systems’ ISOversight VISO (Virtual Information Security Officer) solution. The institution One Florida Bank acquired was already a Safe Systems customer using its network management services. After learning more about the VISO and compliance program, Nadeau performed his due diligence and made the decision to implement the ISOversight solution to streamline the bank’s information security processes.

A VISO serves as an extension of the in-house ISO by augmenting existing personnel and ensuring all tasks and related activities are completed on time and are all properly documented and reported to the various stakeholders. ISOversight’s integrated approach to vendor management, business continuity planning, cybersecurity, strategic planning, and information security influenced Nadeau to implement a VISO strategy.

“We had a very aggressive growth plan and I was wearing many hats. I couldn’t cobble together a bunch of Excel-based risk assessments and manual tasks into a formal process within an acceptable time frame,” said Nadeau. “I needed a support structure that I could leverage very quickly to sustain our bank’s strong and rapid growth plan and ISOversight provided that.”

The Results

While Nadeau expected the bank to grow, he did not anticipate that the bank would become a $690M institution in just 18 months. With ISOversight, Nadeau was able to quickly implement new operational structures for the institution amidst this rapid growth.

ISOversight combines all the various risk assessments into one centralized portal with ease, eliminating the use of multiple spreadsheets and numerous documents. The VISO enabled the bank to create a new compliance infrastructure with easy-to-read summaries of all ISO activities, as well as establish a new fully compliant business continuity management plan, a robust vendor management program, and comprehensive project and audit/exam tracking. ISOversight provides an integrated approach to all these initiatives as they all work hand in hand.

“The first year after the acquisition required a massive amount of work, but ISOversight allowed our bank to prioritize and complete tasks until we reached a smooth and successful integration,” said Nadeau. “Even examiners have commented on the progress we’ve made and recognized the value that the integrated platform provided to our management.”

For more information, download the full white paper, “5 Case Studies: Exploring Common Challenges Faced By The Information Security Officer.”

06 Aug 2020
Managing Information Security Requirements and Expectations: Accountability vs. Responsibility
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Managing Information Security Requirements and Expectations: Accountability vs. Responsibility

Managing Information Security Requirements and Expectations: Accountability vs. Responsibility

Of the many roles within a financial institution, the information security officer (ISO) is the most critical for the protection of confidential and nonpublic personal information and maintaining compliance with federal regulations. In fact, the Federal Financial Institution Examination Council (FFIEC) goes so far as to mandate that all financial institutions have one or more individuals dedicated to the position of ISO.

Safe Systems held a webinar last week outlining the most common challenges for ISOs and some helpful ways that they can better identify, perform, and document their regulatory responsibilities. In this blog post, we’ll highlight two of the most important elements of the ISO role and outline 8 key regulatory responsibilities all ISOs should focus on to meet examiner expectations.

Key Elements

For ISOs, everything ultimately hinges on responsibility (specific tasks the ISO must perform) and accountability (specific documentation ISOs must provide to key internal and external stakeholders). In fact, these terms are referenced multiple times within the FFIEC guidance:

“The ISO is responsible for overseeing and reporting on the management and mitigation of information security risks across the institution and should be held accountable for the results of this oversight and reporting. – FFIEC Management Handbook

“Management should designate at least one information security officer responsible and accountable for implementing and monitoring the information security program.” – FFIEC Information Security Handbook

Individuals in the ISO role must effectively demonstrate both elements to adequately meet regulatory expectations.

Maintaining Compliance

The ISO must not only be able to perform key responsibilities of the role, but he or she must also provide proper documentation to specific stakeholders to satisfy the accountability requirements. The FFIEC’s Management Handbook outlines 8 key responsibilities of the ISO role including:

  1. Implementing the information security strategy and objectives, as approved by the board of directors, including strategies to monitor and address current and emerging risks
  2. Engaging with management in the lines of business to understand new initiatives, providing information on the inherent information security risk of these activities, and outlining ways to mitigate the risks
  3. Working with management in the lines of business to understand the flows of information, the risks to that information, and the best ways to protect the information
  4. Monitoring emerging risks and implementing mitigations
  5. Informing the board, management and cybersecurity risks and the role of staff in protecting information
  6. Championing security awareness and training programs
  7. Participating in industry collaborative efforts to monitor, share, and discuss emerging security threats
  8. Reporting significant security events to the board, steering committee, government agencies, and law enforcement, as appropriate

When performing these key responsibilities, the ISO must reference the institution’s policies (what you say you do); procedures (how you say you’ll do them); and actual practices (what you actually do and are able to document). In our experience, we’ve seen that there is often a gap between procedures and practices, which often results in the majority of audit and exam findings for financial institutions.

To address this issue, many community banks and credit unions are turning to virtual ISO solutions. A virtual ISO platform serves as a risk management solution that addresses the regulatory expectations and important tasks that the ISO must oversee. The solution helps financial institutions augment their internal ISO role, streamline responsibilities, and ensure the institution’s procedures and practices are properly aligned. Most importantly, a virtual ISO can make sure that all stakeholders; Board, committee, auditor, and regulator, have the appropriate reports to document that alignment.

To learn more about the information security officer role, the 3 virtual ISO delivery models, and the benefits of virtual ISO solutions, watch our recorded webinar, “ISO Requirements and Expectations: Accountability vs. Responsibility.”

16 Jul 2020
The ISO in a Crisis: The Increased Importance of Vendor Management During a Pandemic
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

The ISO in a Crisis: The Increased Importance of Vendor Management During a Pandemic

The ISO in a Crisis: The Increased Importance of Vendor Management During a Pandemic

In a previous post, we discussed the role of the ISO in a pandemic and how he or she must make sure all routine tasks are still being completed; help the institution adapt to the new circumstances; and continue providing all products and services at an acceptable risk level.

While an institution may be prepared to continue business as usual, its third-party provider partners may not be on the same page. Like the bankers they support, third-party vendors are also experiencing the impact of the pandemic and are dealing with a variety of operational issues as well. Financial institutions must be able to perform effective vendor management during a crisis and develop alternative plans in the event a critical vendor may not be able to perform the services agreed upon.

Here are a few things the ISO must consider to effectively evaluate the institution’s vendors during a crisis like a pandemic:

Identify Vendor Risks

During a pandemic, the ISO must anticipate several different risk scenarios that can adversely impact the institution’s daily operations. With vendors, there are two interrelated key risk factors to consider:

  • “Supply chain risk” is related to the interconnectivity among the entity and others. In a pandemic, critical vendors may receive an overload of requests for products and services from a variety of industries and may not be able to keep up with demand. For example, many financial institution employees have been working remotely due to Coronavirus and to keep the network secure, financial institutions have provided company laptops to staff. However, if the FI’s laptop provider runs out of inventory, the institution is then put in a difficult situation – if they allow the use of personal devices, they must still make sure all employees can work safely from home and ensure the network remains secure.
  • “Cascading impact risk” is an incident affecting one entity or third-party service provider that then impacts other service providers, institutions, or sectors. For example, if the vendor that manages the bank’s perimeter security has a large case of absenteeism and an inadequate succession plan, real-time alerting may be negatively impacted, and the institution could be exposed.

Evaluating these risks with third-party vendors in advance will help ensure that they have the proper personnel redundancies in place, so these situations don’t impact the institution.

Managing Third-Party Risks

According to the Federal Financial Institution Examination Council (FFIEC), open communication and coordination with third parties, including critical service providers, is an important aspect of pandemic planning. A current SOC 2 report that covers the “availability” trust criteria is the best way to determine if the vendor has the capability to respond and recover its systems. In the absence of a SOC report, the first thing the ISO should request is a copy of the business continuity plan. Since the SOC report may not cover the service providers’ vendors (also referred to as sub-service providers), the ISO will also want to gain some awareness of the possibility of supply-chain risk. For example, how might a provider failure two to three layers deep affect the institution?

In addition to vendor business continuity plans, the ISO should ask additional questions about how the vendor is managing the pandemic. Here are a few examples:

  • When was the last time you updated and tested your BCM plan? Have you incorporated the possibility of a failure of a critical sub-service provider?
  • Is the likelihood and impact of a pandemic evaluated as a part of your risk assessment?
  • How do you plan to continue providing services in the event of the loss of key employees?
  • Have you been in communication with your critical third-party providers?
  • Are you financially prepared to withstand a long-term pandemic event?

Critical third parties are often either overlooked or under-managed during normal circumstances, but because of the current high level of interdependency among financial institutions and their third-parties, operational events such as pandemics call for much closer scrutiny. Depending on responses received, ISOs may choose to accelerate their oversight efforts, revisit their vendor risk assessments, and make adjustments accordingly.

For more information on responding to pandemic events, view our pandemic resources.

14 Jul 2020
The ISO in a Crisis: Key Responsibilities of the Information Security Officer During a Pandemic
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

The ISO in a Crisis: Key Responsibilities of the Information Security Officer During a Pandemic

The ISO in a Crisis: Key Responsibilities of the Information Security Officer During a Pandemic

According to the Federal Financial Institution Examination Council’s (FFIEC) Information Technology Examination Handbook, “ISOs are responsible for responding to security events by coordinating actions to protect the institution and its customers from imminent loss of information, managing the negative effects on the confidentiality, integrity, availability, or value of information, and minimizing the disruption or degradation of critical services.”

When faced with an operational crisis such as the current Covid-19 Pandemic, potential disruption of critical services is the primary concern. Since the information security officer (ISO) acts as the “quarterback” over the many different departments and functions within the institution, they must make sure all routine tasks are still being completed, in addition to ensuring that the institution has adapted to the unique circumstances of the crisis.

The FFIEC Management Handbook lists 8 broad categories of responsibilities for ISO’s. We’ve identified a few of those areas that should be of particular focus during a crisis:

Working With The IT Steering Committee

During any crisis, the ISO must work closely with the IT Steering Committee to ensure that the institution minimizes the risks to the security and confidentiality of non-public information and financial transactions. As difficult as this is during normal operations, it may be even more of a challenge during a crisis. Key considerations include:

  • The IT Steering Committee should still perform their normal duties and maintain a normal schedule. Phone /video conferences can suffice if in-person meetings are not an option.
  • Attention to on-going and planned IT project road map/initiatives. Timelines and all supporting activities must still be tracked, project plans updated, and all stakeholders informed.
  • Review the Remote Access Policy and the Remote User / Acceptable Use Acknowledgement with IT and HR as your current situation may include unique risks that have not been previously addressed. For example, some employees may have to use their personal devices to access the FI’s network to do their job. Take particular note of the Remote Access and Use of Remote Devices sections of the FFIEC Information Security Handbook and any other related best practices and/or guidance initiatives. Trusted third parties can also be an important resource for this effort.
  • Document all actions taken and lessons learned during the crisis so far. Then, incorporate them into your next round of policy updates.
  • Continue to report the status of all IT and information security activities to the Board.

Managing Incident Response, BCP/IRP, and Cyber Responsibilities during an Adverse Event

The ISO is typically the Incident Response Team Coordinator and may determine whether or not to activate the formal Incident Response Plan (IRP). The declaration of a pandemic or other adverse operational event does not in itself require the IRP to be invoked, however, any disruption of normal business services may create vulnerabilities that a cyber attacker could take advantage of.

The ISO will also likely be involved with general business continuity planning and recovery efforts. The criteria for activating the Business Continuity Plan will vary by institution, but the ISO is typically one of the few key individuals tasked with evaluating whether the event is likely to negatively impact the institution’s ability to provide business products and services to customers beyond recovery time objectives (RTOs).

In adverse situations, cyber awareness should be heightened. For example:

  • The institution could have key personnel out, and alternate personnel may not be adequately trained or have the same level of cyber awareness as the primary staff members.
  • The institution may be implementing workarounds for new software or devices when trying to accommodate customers affected by the event. In the interest of expediency for customers, the institution may take shortcuts that it normally wouldn’t or otherwise fail to follow normal procedures.
  • The institution could run into issues with the critical vendors that perform or support its perimeter security, compromising real-time alerting for the organization. This is known as “cascading impact”, where a product or service provided by a third-party is degraded, which in turn affects you.
  • The institution could experience secondary disruptions where hackers may attempt a cyber-attack against perceived weakened defenses.

The ISO must anticipate all of these risks and should communicate with critical third parties to ensure they have a plan in place to keep the NPI and financial transactions secure and provide critical operational services at acceptable levels of risk.

Addressing Auditor and Examiner Expectations

Although a pandemic, as a crisis event, was de-emphasized in the 2019 BCM Handbook, financial institutions should expect regulators to issue additional joint statements in the post-pandemic phase due to the shear impact and duration of this event. ISOs should expect examiners to ask about the specific actions the institution has taken in response to COVID-19, including:

  • Succession plans – ISOs should be prepared to share the institution’s succession plans, how these plans were implemented during the pandemic, and any key updates to the plan post-pandemic.
  • Cross-training efforts – the ISO (if also the BCP Coordinator) should explain the institution’s plans for cross-training and how these plans were implemented during the pandemic.
  • Remote access controls – the ISO should address all of FFIEC requirements for remote access and document any updates or changes that occur.
  • Third-party/supply chain issues – the ISO should communicate with all critical vendors to ensure there are no interruptions to critical services, and he or she should have contingency plans in place if a third-party provider can no longer provide adequate service.

Information security officers ultimately must be able to show auditors and examiners exactly how the institution withstood the pandemic, maintained compliance, kept all non-public information secure, and kept all stakeholders informed, all of which is no small task during normal operations!

For more information on responding to crisis events, view our pandemic resources.

02 Jul 2020
Keys to Develop a Compliant Business Continuity Management Program
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Keys to Develop a Compliant Business Continuity Management Program

Keys to Develop a Compliant Business Continuity Management Program

Financial institutions (and examiners) are still adjusting to the Federal Financial Institution Examination Council’s (FFIEC) 2019 update to its BCP IT Examination Handbook. The handbook, now renamed Business Continuity Management (BCM), included several updates to the previous 2015 guidance. According to the FFIEC, BCM is the process for management to oversee and implement resilience, continuity, and response capabilities to safeguard employees, customers, and products and services.

To ensure financial institutions do this effectively, the FFIEC expanded the original BCM process.

The previous handbook encouraged institutions to adopt a four-step approach:

  1. Business Impact Analysis
  2. Risk Assessment
  3. Risk Management (essentially, recovery procedures), and
  4. Risk Monitoring and Testing

The new guidance recommends a slightly different approach:

  1. Risk Management (Business Impact Analysis, Risk/Threat Assessment)
  2. Continuity Strategies (Interdependency Resilience, Continuity and Recovery)
  3. Training & Testing (aka Exercises)
  4. Maintenance & Improvement
  5. Board Reporting

Additionally, the business continuity management process outlines 10 key steps financial institutions must complete to achieve a more enterprise-wide approach and meet examiner expectations. This is a bit more complicated than the process has been in the past and may require more time for plan preparation and annual maintenance.

The FFIEC handbook also provides a more detailed break-down of the BCM lifecycle:

  1. Oversee and implement resilience, continuity and response capabilities
  2. Align business continuity management elements with strategic goals and objectives
  3. Develop a business impact analysis to identify critical functions, analyze interdependencies, and assess impacts
  4. Conduct a risk assessment to identify risks and evaluate likelihood and impact of disruptions
  5. Develop effective strategies to meet resilience and recovery objectives
  6. Establish a business continuity plan that includes incident response, disaster recovery, & crisis/emergency management
  7. Implement a business continuity training program for personnel and other stakeholders
  8. Conduct exercises and tests to verify that procedures support established objectives
  9. Review and update the business continuity program to reflect the current environment and
  10. Monitor and report business resilience activities.

As many of these items were part of the previous guidance, here is a checklist consisting of required elements that may be missing from your program:

  1. Have you conducted a formal business process-based Business Impact Analysis (BIA) that identifies all critical interdependencies?
  2. Does the BIA produce sufficient information to establish the following?
    • Recovery point objectives (RPO)
    • Recovery time objectives (RTO) for each business process (prioritized)
    • Maximum tolerable (or allowable) downtime (MTD/MAD)
  3. Does your risk/threat assessment measure both the impact and the probability (likelihood) of potential disruptive threats, including worst case (low probability, high impact) scenarios?
  4. Do you use testing as employee training exercises to verify that personnel are knowledgeable of recovery priorities and procedures?
  5. Do you track and resolve all issues identified during testing exercises, and use lesson-learned to enhance your program? (Must be documented)
  6. Does your Board report include a written presentation providing the BIA, risk assessment, and exercise and test results, including any identified issues?

If you would like to make sure your BCM is up to date with the latest regulatory expectations, a complimentary plan review is the best place to start.

25 Jun 2020
What is My Bank's Cybersecurity Posture Compared to My Peers?
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

What is My Bank or Credit Union’s Cybersecurity Posture Compared to My Peers?

What is My Bank's Cybersecurity Posture Compared to My Peers?

It is important to understand your institution’s cybersecurity posture to find out where you stand in regard to cyber threats and what you need to do to create a more secure environment. It’s a delicate balance because being behind on your cybersecurity posture means your institution is less secure than it should be but being ahead likely means that you are investing in resources that you may not need. Unfortunately, it’s almost impossible to do a true peer-to-peer comparison because there are just too many variables between even similarly sized financial institutions to obtain a useful analysis. Here’s why:

Every Institution Has a Unique Model

When we implement information security or business continuity programs for banks and credit unions, we start with a process called “Enterprise Modeling” where we identify the departments, the processes, and the functions that make up each individual financial institution. What this process typically reveals is that if you model out two financial institutions that look identical in terms of geographic area, demographic customer or member base, size and complexity, the results will almost always be significantly different since each institution has a unique operating model based on their specific services, organization, processes, and technologies.

Cyber Risk Appetite Is a Key Variable

Cyber risk appetite is another factor that often differentiates your institution from your peers. Safe Systems’ Compliance Guru defines risk appetite as “The amount of risk that an enterprise is willing to pursue and accept in order to achieve the goals and objectives of their strategic plan.” For example, let’s say we have two financial institutions that seem equivalent in outward appearance. Based on their strategic plan, one institution has decided to take a more aggressive cybersecurity posture to electronic banking products and the other has decided to take a more conservative approach. Because the level of risk varies by the approach, you simply cannot accurately compare the two institutions.

The Best Way to Evaluate Cybersecurity Posture

At Safe Systems, we recommend allowing your bank or credit union’s information to stand on its own. To truly improve your cybersecurity posture, you must examine where you are based on where you need to be — not where a peer may be in the process. Carefully evaluate your risks (including areas of elevated risk), and the controls you have in place that offset those risks. Then, examine the best control groups to apply against those areas of elevated risk and develop an action plan to take your institution from where you are now, to where you need to be. Then, when you conduct this process again next year, you can demonstrate steady progress to both examiners and your Board.

Holding Steady May Cause You to Fall Behind

In addition, just because your inherent risk profile isn’t increasing from one assessment to the next, this doesn’t necessarily mean your control maturity levels shouldn’t increase. The risk environment is constantly evolving, so holding steady on your controls may actually mean your cybersecurity resilience is decreasing. Making incremental increases in your control maturity levels will help keep you ahead of the latest threats.

For more information about improving your cybersecurity posture, watch the full “Banking Bits and Bytes Super Duper CEO Series,” below.

18 Jun 2020
Addressing Banking Security, Technology and Compliance Concerns
Banks, Compliance, Credit Unions Darren Bridges 0 comment

Addressing Banking Security, Technology and Compliance Concerns

Addressing Banking Security, Technology and Compliance Concerns

To gain new insight into the needs of banks and credit unions today, Safe Systems conducted a sentiment survey and asked community financial institutions directly about their top concerns. Their responses were primarily concentrated in three main areas: security, compliance, and technology, especially regarding exams and audits, cyber threats, and disaster recovery. Since the pandemic events of this year, many of these concerns have only strengthened in importance. In this blog post, we’ll address these challenges and offer some key best practices to solve them.

Top Security Concern: Cybersecurity

Banking security threats are pervasive worldwide, leaving banks and credit unions with good cause for concern. Consider these alarming cybercrime statistics: Cyber-attacks are 300 times more likely to hit financial services firms than other companies, according to a recent Boston Consulting Group report.

A key tool to combat cyber threats is the Cybersecurity Assessment Tool (CAT) from the Federal Financial Institutions Examination Council (FFIEC) and the Automated Cybersecurity Examination Tool (ACET) from the NCUA. Institutions can utilize this voluntary industry-specific cyber assessment tool to identify their risk level and determine the control maturity of their cybersecurity programs.

Top Compliance Concern: Exams and Audits

While examinations and audits are necessary components of compliance, many institutions are intimidated by the process itself, and while exams and audits may overlap in similar areas, they are distinctly different in terms of nature and scope.

The Federal Deposit Insurance Corporation (FDIC) conducts bank examinations to ensure public confidence in the banking system and to protect the Deposit Insurance Fund. Audits, which typically last several months, are designed to ensure institutions are complying with federal laws, jurisdictional regulations, and industry standards. Auditors conduct tests, present their findings, and recommend corrective actions for the bank to undertake.

Banks and credit unions can use several tactics to prepare for, and meet, the requirements and expectations of regulators:

  • Review all guidance and issues related to their institution and become familiar with any changes that might impact them
  • Review previous exam reports for comments or matters that require attention and be prepared to report and discuss these findings, along with any previous nonfinding comments
  • Use a managed services provider in combination with compliance applications to automate the process of documenting, reporting, and preparing for exams.

While following best practices will not guarantee that an institution won’t have examination findings, it can help significantly lower the likelihood and severity of them.

Top Technology Concern: Disaster Recovery

Financial institutions must have provisions for restoring their IT infrastructure, data, and systems after a disaster happens. Considering the recent outbreak of COVID-19, it is also important for community banks and credit unions to consistently review, update, and test their current disaster recovery plans to be able to address any issues that occur during a pandemic event.

With effective planning, banks and credit unions can launch a calculated response to a disaster, pandemic event, or other emergencies to minimize its effect on their information systems and the overall business operations. Some general best practices for disaster recovery include:

  • Analyzing potential threats
  • Assessing the technology required
  • Managing access controls and security
  • Conducting regular data recovery test
  • Returning operations to normal with minimal disruption

While the survey respondents shared a number of serious banking security, technology, and compliance concerns, the good news is that they all can be properly addressed with the right processes, strategies, and resources in place. For more information on the top concerns community banks and credit unions are experiencing today, read our latest white paper, “Top 10 Banking Security, Technology, and Compliance Concerns for Community Banks and Credit Unions.”

12 Jun 2020
The “Inherited” Risk – Assessing and Reporting on Vendor Risk
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

The “Inherited” Risk – Assessing and Reporting on Vendor Risk

The “Inherited” Risk – Assessing and Reporting on Vendor Risk

Vendors are the largest source of non-preventable risk for a financial institution, so it is critical that banks and credit unions carefully evaluate, monitor, and manage all vendor relationships to remain compliant and reduce risk. Additionally, institutions must be able to accurately assess risk, implement adequate controls, and provide all stakeholders (including regulators, management, and the Board) with appropriate reporting to convey the overall status of the vendor management program at any point in time.

Assessing Vendor Risk

The first step in vendor risk management is to perform a risk assessment to evaluate your level of inherent risk. This must always be done first so that you can then identify and implement the proper controls. If the controls selected do not completely offset the risks identified, then alternate or compensating controls would need to be identified in order to achieve a level of residual risk that is within your risk appetite.

Depending on the information you get from the risk assessment, you can clearly map out the level of inherent risk based on the vendor’s access to data and systems and the level of criticality for each vendor. These results will provide the information you need to control the risks, and ultimately report the overall results of your vendor management program to your key stakeholders.

When conducting a risk assessment you want to include all vendors but focus particularly on your critical vendors. A critical vendor is defined as one that either provides a product or service that is a key interdependency of one or more of your products or services, or one that stores, processes, or transmits non-public customer or confidential information.

Once you’ve established the initial or inherent risk level, you can identify one or more controls to off-set the risks. Typically, you want the vendor’s third-party audit report or SOC report; audited financials; insurance binders; a copy of their incident response and disaster recovery plans; and any testing the vendor has done on these plans. If you can’t obtain a SOC report, you’ll need compensating controls to determine their network security. Ask if they have an information security program and if they’ve conducted any vulnerability and penetration testing. You should also request a report of examination (ROE) from your primary federal regulator on your core provider.

Reporting to Stakeholders

When reporting to the various stakeholders within your institution, many of the reports are relatively similar, but the level of detail will be slightly different for each stakeholder group.

Board

The primary stakeholder that financial institutions must report to is the Board. When presenting to the Board, reporting does not generally need to be highly detailed and should provide a brief, high-level summary of the overall program.

Additionally, it is not necessary for the Board to see this report every time they meet. The requirement is to present an annual update, but we recommend reporting more often if the pace of internal change dictates (whether twice a year or quarterly) to show you are adequately managing vendor risk on an on-going basis. Here is an example of what a Board report should look like:

Sample Report for Vendor Management

Management

The management committee (i.e. IT Steering) requires a bit more detailed information than the Board does, and unlike Board reporting frequency, IT should report to the management committee every time they meet. If your management committee meets on a monthly basis, you should produce a report each month as well and communicate this information to the committee. Management needs to know what you’re doing; what you’re not doing; what you’re behind on; and have a good understanding of your progress.

Sample Report for Vendor Management   Sample Report for Vendor Management

Regulators

Regulators typically review the same reports as your board and committee. However, auditors and examiners will tend to take a deeper dive into your vendor management program and want to review everything you have on your critical vendors. They are looking to see if you’ve done a risk assessment and if you have identified the reports from the vendor that will line up with, control, and offset the risks you identified in the risk assessment. The report you present to examiners and auditors may have more of a narrow but deeper focus, taking a more detailed view of your most critical vendors.

21 May 2020
The Value of Network Reporting for Community Banks and Credit Unions
Banks, Compliance, Credit Unions Jamie Davis 0 comment

The Value of Network Reporting for Community Banks and Credit Unions

The Value of Network Reporting for Community Banks and Credit Unions

With increased cyber-attacks, shared data with third-party vendors, and strict regulatory requirements, community banks and credit unions have high standards to meet for information security. Adequate oversight and network reporting on the information security program is needed to ensure the proper controls are in place and that all stakeholders have visibility into the network.

In a recent webinar, Safe Systems shared some key observations on the need for financial institutions to have better communication and reporting between IT staff, the compliance department, and senior management. Here are a few key points to consider:

  1. Gaps Between IT Staff and ISO/Compliance Teams

    2. In many financial institutions, there is a lack of synergy and communication between the IT department and the information security/compliance team. Many ISOs simply do not have the technical background to fully understand how information is being protected. They tend to be more focused on vendor management, business continuity management, and performing risk assessments and less familiar with how systems are getting patched; if machines have antivirus; or if backups are updated consistently. It can be difficult to communicate effectively if ISOs don’t understand the IT world or don’t have visibility into network reports and the necessary information to do their job.

  2. Oversight to Better Manage Controls

    3. Because bank and credit union IT staff are human, sometimes errors will occur. While financial institutions have many technology solutions that automate IT functions and controls, oversight is required to ensure that the controls are adequate, working, and therefore mitigating risks. Without appropriate oversight, any gaps in the network can lead to a successful cyber-attack. Similarly, a finding during an exam that shows certain controls were implemented ineffectively can also leave the institution vulnerable.

  3. Limited Access to Reports

    4. Too often, when ISOs conduct a review of the information security program, the reports they receive are vague or too technical to decipher the key insights most important to the ISO role. Other key stakeholders, like the Board and senior management, also may need more access to high-level reports to better identify threats, assess risk, and make decisions on the appropriate controls to implement.

    Without access to adequate reports, the ISO and other stakeholders can become overly reliant on the IT team to explain what is happening on the network without having the ability to verify that information independently.

To learn more about information security reporting and get a demo of our NetInsight ™ cyber risk reporting tool, watch our webinar, “NetInsight: Trust But Verify.”

22 Apr 2020
Reading Between the Lines: Recent Regulatory News
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Reading Between the Lines: Recent Regulatory News

Reading Between the Lines: Recent Regulatory News

March 30, 2020 – Federal Reserve Statement on Supervisory Activities from ComplianceGuru.com

The Compliance Guru has introduced a new series, “Reading Between the Lines: Recent Regulatory News,” designed to help community banks and credit unions better understand new regulations and updates.

His first post of reviews the recent Federal Reserve Statement on Supervisory Activities.

Read the full post to get a breakdown of:

  • Where did it come from, and where can I find it?
  • Who needs to know about it?
  • Why was it Issued?
  • What does it say?
  • What did it NOT say (but the Guru wants you to know)?
16 Apr 2020
Building a Pandemic Response Plan
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Building a Pandemic Response Plan: What Are the Requirements for Community Banks and Credit Unions?

Building a Pandemic Response Plan

As COVID-19 continues to spread around the world, financial institutions have been forced to respond to this pandemic in new and innovative ways to stop the spread of the virus; protect their employees and the public; and keep their doors open and operations running smoothly to serve their customers and members. Community banks and credit unions are referencing the Pandemic sections of their business continuity management plans to determine the best way forward for their institutions during this challenging time. With the Federal Financial Institution Examination Council’s (FFIEC) recent business continuity management (BCM) guidance, many financial institutions are first of all wondering what has changed in the guidance, and second what specific additional changes this particular event might require.

Pandemic Planning

Since 2007, financial institutions were required to have a separate pandemic plan, and regulators only looked for documentation that institutions were testing their plans periodically. Unfortunately, the pandemic section of the business continuity plan (BCP) has tended to be treated as more of an afterthought since these situations have historically occurred much less often than natural disasters or other business interruptions. If they were assessed at all, they fell into the category of a high impact, low probability event.

Notwithstanding COVID-19, pandemics are still low probability events, but the impact of these events may be far more significant than past risk assessments have indicated. In what may now be perceived as an untimely move, the FFIEC made the decision in the 2019 BCM update to deemphasize Pandemic by categorizing it the same as any other disruptive event. The FFIEC no longer requires financial institutions to have a separate pandemic plan, but instead expects community banks and credit unions to assess and manage pandemic risk alongside all other possible disasters.

In other words, your BCM plan is your pandemic plan, and you must analyze the impact a pandemic can have on your organization; determine recovery time objectives (RTOs); and build out a recovery plan. You must also include a methodology to determine the key triggers your organization will use to activate your recovery plan when faced with a pandemic. But when should you activate your recovery plan and who is in charge of this process?

Pandemic Response

CDC Intervals of a Pandemic

Before a recovery plan is activated, it is important to have an initial response team (typically comprised of C-Level executives) evaluate the situation and assess the potential impact of the current event on the institution. The team must determine if the situation is likely to negatively impact the institution’s ability to provide products and services to their customers or members beyond the established recovery time objectives outlined in the BCM plan.

The same rules apply in a pandemic. Community financial institutions should use the six pandemic phases outlined by the World Health Organization (WHO) or the Center for Disease Control (CDC) to evaluate the severity of the situation.

In most cases, the pandemic portion of the plan is not triggered for activation until phases 4-5 (or if between 20-40% of your workforce is not available to work).

What Regulators Expect

During a pandemic, regulators expect financial institutions to continue offering products and services to customers/members and conduct operations as normally as possible. This underscores the importance of including succession planning and cross training in the BCM plan. In the past, assumptions used to simulate a pandemic were that phases 4-5 wouldn’t last more than a week or two, so most financial institutions may only have planned for one person to be identified and pre-trained to step into a critical role until the event was over. However, the COVID-19 pandemic is a global crisis currently impacting at least 183 countries and territories and is predicted to impact many more people, and take much more time to contain.

To ensure critical functions continue, financial institutions should have at least two or three alternate staff members trained for every primary resource within the institution and assess whether some roles can be performed remotely. This can be difficult for smaller institutions with limited staff and resources. For specialized functions dominated by key personnel, such as funds management, wire services, human resources, etc., these institutions may not have multiple alternatives to step in if key employees are unavailable. In these circumstances, you may need to have other cross-trained staff members identified who can step into these roles quickly.

Next Steps: Lessons Learned

There will be many more lessons learned after the COVID-19 pandemic has passed, and regulators will expect those lessons to be reflected in your plan. When all is said and done, regulators are likely to ask “what have you learned from this event, and what have you done to enhance your pandemic plan based on those lessons learned?” Prior to this event, had you analyzed your business processes and their interdependencies, and prioritized them by recovery time? Since interdependencies include employees, and pandemic events almost exclusively impact personnel, have you identified employees with job duties capable of being performed remotely? If so, did they have secure, reliable, remote access? If those job duties are highly specialized, or highly critical, did you have alternate personnel identified and pre-trained to step in when needed?

The answers to these questions, and many more, will be used to enhance the pandemic section of your BCM plans, but until we reach that post-event, lessons-learned point, it’s important for financial institutions to continue to reference their business continuity plans; document the entire process; keep stakeholders informed; and put measures in place to continue serving their customers and members and protecting their employees and the public.

For more information on pandemic response, view our pandemic resource center. Or, if you would like to make sure your BCM is up to date, please request a complimentary plan review to ensure that your business continuity management plan is keeping up with changing regulations.

View Our Pandemic Resources

09 Apr 2020
American Pride Bank Tackles Information Security Responsibilities with Safe Systems’ ISOversight Virtual ISO Solution
Banks, Compliance, Credit Unions Christine Ray 0 comment

American Pride Bank Tackles Information Security Responsibilities with Safe Systems’ ISOversight Virtual ISO Solution

American Pride Bank Tackles Information Security Responsibilities with Safe Systems’ ISOversight Virtual ISO Solution

With ongoing cybersecurity threats; increased use of third-party providers; and constantly evolving regulatory and reporting requirements, the role of the information security officer (ISO) is even more important in today’s complex banking environment than ever before. However, community bank and credit union ISOs often struggle to keep up with the growing number of responsibilities this role requires – often forced to manage critical tasks with limited resources and a lack of segregation of duties.

The Challenge

Nicole Rinehart, Chief Operations Officer at American Pride Bank, ran into this very issue as the sole IT admin at American Pride Bank. Managing all of the ISO responsibilities, including critical activities such as Board reporting and the production of comprehensive reports for examiners, was difficult to manage due to the many manual processes required.

During a regulatory examination, an examiner recommended the bank focus on having more independence within its ISO duties. The Federal Financial Institution Examination Council (FFIEC) states that all financial institutions must have separation of duties for the ISO role. To accomplish this, the bank began evaluating solutions to help streamline processes and ensure complete oversight of all information security activities.

The Solution

Get a CopyImplementing a Virtual ISO to Improve Compliance Posture  Complimentary White Paper

After consideration, American Pride Bank decided to partner with Safe Systems and implement its ISOversight virtual ISO solution. The service includes a suite of applications and programs to help institutions streamline management of key compliance duties including the CAT, BCP, Vendor Management and Information Security.

In this case, the bank was already leveraging individual components of ISOversight. By converting to the virtual ISO service, they gained additional tools, reports, and expert compliance support. An important part of the solution includes monthly meetings with the Safe Systems compliance team to assess the bank’s information security activities and provide guidance.

The Results

With ISOversight, American Pride Bank has improved its overall preparation and communication of the information security program. All key stakeholders in the bank have access to ISO-related items in real-time, and the information security program is more organized and streamlined, enabling the bank to save time on monitoring and reporting.

“The ISOversight solution has been a game-changer for our bank because now we have a robust process in place working with Safe Systems and a full committee of our team members to ensure all tasks are completed accurately and nothing slips through the cracks,” said Rinehart. “It’s so important to have a process like this, especially when you have limited resources. Safe Systems has truly become an extension of our internal team, helping us to stay on track with ISO responsibilities and ensuring we comply with all regulatory requirements.”

To learn more, read the full case study, “American Pride Bank Streamlines Processes and Improves Compliance Reporting with Safe Systems’ ISOversight Virtual ISO Solution.”

31 Mar 2020
Pandemic Resource
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Are You Required to Address Your COVID-19 Readiness with Your Customers?

Pandemic Resource

Hey Guru,
 
Are we required to post any kind of statement to the public or our customers as to our readiness for the COVID-19? If so, can you direct me to the kinds of things we need to say? We are working on an ad to educate our customers on how to use our online products if they are concerned about coming out in public to the branch. Thanks!

I wouldn’t call it a requirement to post a statement, but it’s definitely a best practice. I could easily see the examiners being just fine with your generic Pandemic planning, but next time they come in asking “what specific steps did you take in reaction to the recent COVID-19 event?”

Lots of generic best practices out there (CDC, etc.), and of course your response would depend on your capabilities (encouraging e-banking vs. face-to-face transactions, and e-signatures for physical signatures on loan documents, for example). For some FI-specific resources and more, read the complete blog post at ComplianceGuru.com.

27 Mar 2020
What Community Banks and Credit Unions Should Do to Combat COVID-19
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

Facing a Pandemic: What Community Banks and Credit Unions Should Do to Combat COVID-19

What Community Banks and Credit Unions Should Do to Combat COVID-19

As the Coronavirus pandemic continues to rise throughout the world, it is important for community banks and credit unions to effectively carry out their pandemic plans to stop the spread of the virus and implement alternative ways to serve customers or members during this critical time. Safe Systems held a webinar last week covering five things all community banks and credit unions need to do during a pandemic. In this blog, we’ll cover a few of the key points from the webinar.

  1. Pandemic Testing

    2. According to the Federal Financial Institution Examination Council (FFIEC) guidelines, financial institutions need to have a “testing program designed to validate the effectiveness of the facilities, systems, and procedures identified” in their business continuity plan. In a pandemic, it is the people who are affected more than the facilities, so your systems and processes become more impacted than anything else.

    A preventative program has to address:

    • Monitoring outbreaks
    • Educating and providing appropriate hygiene training and tools to employees
    • Communicating with customers and members
    • Coordinating with critical providers and suppliers

    With the pandemic already underway, it can feel counterproductive to conduct a pandemic test for your financial institution. However, we’ve found it’s never too late to test and improve your pandemic plan, even in the midst of a crisis. Make sure you are validating your succession plan and cross training measures by purposely excluding certain key individuals from actively participating in the testing exercises you conduct for your institution. During a pandemic, important individuals may not be in the branch or available every day, so it’s important that you test your plan to make sure the institution can still operate efficiently.

  2. Social Distancing

    3. Social distancing is a term that’s come out of this global pandemic to stop the spread of the virus. The Center for Disease Control (CDC) states that individuals should keep a six-foot minimum distance from others to limit the spread of the virus, but how does this impact the way your financial institution does business? Think of how your teller line, customer service areas, lending offices, etc. are set up. For these more personal, face-to-face interactions, it is important for you to change the location set up to ensure the 6-foot distance is achieved to protect both the customer and employee. Here are some tips from the American Bankers Association® to consider:

    • Require non-customer facing personnel work from home and try limiting interactions of personnel as much as possible in offices.
    • Have staff sign in when they arrive and leave.
    • Designate times for “at risk” customers (because of age or condition) to visit the lobby when no others are allowed.
    • Make loans or open new accounts by appointment only. When you close a lobby, designate one drive-thru for business customers and one for consumers, as their transactions are very different and differentiating the two can help speed transactions.
    • Keep your messaging positive. Don’t not use the word “Closed” on your door or website; instead use “Appointments Available.” Remind customers that banks are never truly closed, thanks to online and digital platforms that provide customers with 24/7 access to their accounts.

    We are posting tips, resources, and FAQs from ABA, FDIC, NCUA, and our own Safe Systems’ experts on the homepage of our website.

  3. Security in Social Distancing

    4. For employees that are able to work from home, providing resources for working outside of the institution is another great option to keep staff and the public protected. If your staff members are working from home, here are a few things to consider to ensure the institution maintains both security and productivity.

    • Do your employees have enough bandwidth at home?
    • Do you have a dedicated VPN device?
    • Do you have a firewall to allow this connection?
    • Can the firewall/device handle the number of devices actively connecting remotely at one time?
    • Do you have enough licenses (if needed) for each user to connect remotely?

    When your staff is working from home, you still must worry about security. You will need to decide how they connect to your network, what device they use, and how that device is secured. For instance, if you are allowing an employee to use their personal computer, then reference your remote access policy. It should include rules for the appropriate cyber hygiene of the remote device (patching, antimalware, etc.), and should be signed by the end-user. OpenDNS offers free security options for DNS lookups on home computers, which is also a good consideration should you need to update or create a home PC access policy and requirements. You may also require multi-factor authentication as an additional precaution to keep the network secure.

Financial institutions provide critical services to their communities and must be able to support customers and have alternate ways of doing business during a pandemic.

If you would like to gain more insights on COVID-19 and listen to a brief Q&A from our compliance team and information security officer, download our recorded webinar, “5 Things Community Banks and Credit Unions Need to do During a pandemic.”

 

Watch Recorded Webinar


 

As many community banks and credit unions are still formulating their responses to the pandemic, we’d like to collect and share what steps financial institutions are actively taking to protect employees and customers while maintaining business operations. Please take a few minutes to complete this survey and tell us how your institution is responding to the novel coronavirus (COVID-19) pandemic.

 

How are you responding to the Pandemic? Take the Quiz


 

19 Mar 2020
5 Important Observations in FFIEC’s New Business Continuity Management Guidance
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

5 Important Observations in FFIEC’s New Business Continuity Management Guidance

5 Important Observations in FFIEC’s New Business Continuity Management Guidance

Since the FFIEC updated its BCM IT Examination Handbook last year and expanded its focus from “business continuity planning (BCP)” to “business continuity management (BCM),” financial institutions are gaining a better understanding of what has changed and how it impacts their current business continuity planning efforts.

In a previous post, we outlined some of the major changes in the new business continuity management guidance and what financial institutions need to do to be prepared. However, there are some general observations that can have a significant impact on the way community banks and credit unions interpret this guidance. In this blog post, we’ll cover five key points to keep in mind when evaluating your BCM plan:

“Resilience”

Watch VideoDoes the New Business Continuity Guidance Require a Whole New Plan? Watch Recorded Webinar

A reoccurring theme in the FFIEC’s new business continuity management handbook is the concept of resilience. In fact, the term “resilient” or “resilience” occurs 128 times in the document. Resilience is the ability to prepare for and adapt to changing conditions and withstand and recover rapidly from those disruptions. This includes the ability to withstand and recover from deliberate attacks, accidents, or naturally occurring threats or incidents.

Traditional BCP has been focused on the recovery ability, but the FFIEC is clearly wanting institutions to focus on this notion of being able to “withstand” a disruption. Regulators want to know what proactive measures financial institutions have in place to mitigate risks and minimize the impact of an outage by planning in advance for the absence of a critical service provider or other interdependency. When going through the BCM process, resilience must be included from the very beginning of the process to successfully meet these new regulatory expectations.

“Entities” vs. “Institutions”

In the new BCM guidance, the FFIEC took every instance of the word “institution” and replaced it with the word “entity”. The significance of this change is to now include bank holding companies and third-party service providers along with traditional financial institutions in the new expectations. The FFIEC now expects critical third-party providers to be active participants in the BCM program, and it’s likely that regulators will require you to have a detailed understanding of the resilience capabilities of your core/TSP providers, cloud providers and others moving forward.

“MAD” vs. “MTD”

Another update that stands out is the change from “Maximum Allowable Downtime (MAD)” to “Maximum Tolerable Downtime (MTD).” MTD represents “the total amount of time the system owner or authorizing official is willing to accept for business process disruption and includes all impact considerations.” To put it simply, MAD/MTD is the point at which recovery becomes impractical or impossible, or losses become unacceptable.

So, while the definitions have essentially stayed the same, and the handbook makes it clear that either term is acceptable, it is important to show examiners that the institution is familiar with the new guidance and any new terminology it includes. The examiner may want to test your knowledge and make sure the institution understands the nuances of the updated handbook.

“Exercises and Tests”

The new handbook makes an important distinction between these two concepts, defining an exercise as “…a task or activity involving people and processes that is designed to validate one or more aspects of the BCP or related procedures.” For many institutions, the scenario-driven table-top tests where participants simulate a disaster event and walk through performing their duties in a simulated environment is best described as a training exercise.

On the other hand, a test is often performed “…to verify the quality, performance, or reliability of system resilience in an operational environment.” Typically, this involves the recovery of a critical asset or infrastructure component, such as backup and recovery options, supplementary power, or circuit fail-over. The handbook makes it clear that both exercises and tests are necessary to demonstrate resilience and recovery capabilities.

“Guidance” vs. “Requirements”

Finally, it is also interesting to note that the handbook states that “This booklet does not impose requirements on entities. Instead, this booklet describes practices that examiners may use to assess an entity’s BCM function.” Our belief is that semantics aside, any “guidance” that examiners use to assess an entity’s BCM program is indeed a “requirement”, meaning that if a financial institution deviates from the guidance, the examiner could find fault. However, according to FIL-49-2018, examiners cannot take enforcement action based on supervisory guidance.

To be clear, it is important for financial institutions to follow the guidance as outlined by the FFIEC if at all possible, but if you choose to deviate from guidance, you must have a very good reason to do so. If your institution has not strictly followed the guidelines but still believe you are following the best practices for you, you may be able to push back on an examiner or auditor whose interpretation of the guidance may not be realistic in the context of the entirety of your organization’s particular situation. However, the burden is on you to make your case convincingly.

The 2019 BCM guidance gives financial institutions a host of new items to evaluate and consider for inclusion in your business continuity program for this year. If you’d like to find out what other changes were made that will impact your financial institution, download our recorded webinar, “Does the New Business Continuity Guidance Require a Whole New Plan?”

Or, if you’re not sure if your institution is BCM ready, then request a complementary plan review to ensure that your business continuity plan is keeping up with changing regulations.

27 Feb 2020
Top 3 Cybersecurity Threats CEOs Need to Be Aware of in 2020
Banks, Compliance, Credit Unions Brendan McGowan 0 comment

Top 3 Cybersecurity Threats CEOs Need to Be Aware of in 2020

Top 3 Cybersecurity Threats CEOs Need to Be Aware of in 2020

We recently conducted a sentiment survey to ask our community bank and credit union customers about their top worries for 2020. Cybersecurity was at the top of the list for most institutions and not without reason. According to a recent Boston Consulting Group report, cyber-attacks are 300 times more likely to hit financial firms than any other company.

In an effort to help community bank and credit union CEOs prepare for cybersecurity threats in 2020, I recently shared a video from my “Banking Bits and Bytes Super Duper CEO Series,” covering the current threat landscape and what financial institution CEOs need to look out for over the next 12 months. Here are three key areas to focus on:

Business Email Compromise

Business email compromise isn’t a new cybersecurity threat to financial institutions, but we’ve recently seen increased incidents of these malicious emails in community banks and credit unions. We often see this happen when the CFO at a bank receives an email that appears to come from the CEO asking them to send a wire transfer on their behalf. These types of emails are able to easily slip through email filters because they don’t contain any malicious code. It is just a plain text message so it can easily be viewed as a non-threatening email to an employee. This is why user security awareness training is the most important counter measure to prevent employees from interacting with these messages.

Extortion Emails

New call-to-actionTop IT Areas Where CEOs Should Focus to Enhance Cybersecurity Posture  Get a Copy

We’ve also seen a rise in extortion emails claiming to have compromising information about a financial institution executive that will be released to the public unless a ransom is paid. In these emails, hackers may also claim to know username and password pairings and say they have hacked into a victim’s computer. Fortunately, these threats are rarely – if ever — true or accurate, but this has still raised concerns from many executives.

The best way to guard against this sort of attack is to use different passwords for different accounts and to change those passwords often. Multi-factor authentication is another very effective tool in protecting against extortion. Also, ensuring your institution has quality user security awareness training prevents someone from mistakenly responding to these emails.

Internet of Things (IoT)

Most people think of the IoT as devices like the Amazon Echo or the Google Nest Thermostat, but that’s not what we’re talking about here. While most Windows PCs in financial institutions have effective security measures in place to protect against threats, there are other items on the network like multi-function printers; network connected LaserJet printers; the digital signage in front of the institution; or the even the DVR system or security camera from third-party providers, that can present an opportunity for criminals.

These devices are often on the network and as a result, can “see” the other devices connected to the network. They are often communicating with devices outside of the institution and unfortunately, you don’t have the ability to control the software that runs these devices; manage the patch level; or dictate who the device can talk to or how it does so. Financial institutions can compensate for this lack of control through careful network topology design; careful perimeter security rules; and installing detective technologies on the network to know when these IoT devices are up to no good.

As cybersecurity threats become more complex, so too must the measures that CEOs employ within their institutions to counter these threats. To learn more about security threats and how to protect your institution, watch the full “Banking Bits and Bytes Super Duper CEO Series” below.

 


 

10 Feb 2020
The Value of User Conferences For Banks and Credit Unions
Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

The Value of User Conferences for Banks and Credit Unions

The Value of User Conferences For Banks and Credit Unions

As the financial services industry has become more technology-driven and more complex operationally, user conferences have become key events along with industry association conferences. By providing a venue for banking professionals to collaborate directly with their technology providers and other peer institutions, user conferences represent a proven way for banks and credit unions to extend the ROI of their technology investments. Examiners and auditors recognize the importance of participation in these events and many now expect attendance to gain industry knowledge and strengthen existing vendor relationships.

Regulatory Expectations – Vendor Management

Examiners are increasingly focused on how a financial institution manages their vendors. According to the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook, “User groups are another mechanism financial institutions can use to monitor and influence their service provider. User groups can participate and influence service provider testing (i.e., security, disaster recovery, and systems) as well as promote client issues. Independent user groups can monitor and influence a service provider better than its individual clients. Collectively, the group will constitute a significant portion of the service provider’s business. User groups offer advantages to both the service provider and the serviced institution by allowing customers to discuss and prioritize their concerns…service providers should obtain customer feedback though user groups or customer surveys.”

In addition to effective vendor management requirements, the FFIEC also requires employees of financial institutions to participate in ongoing education and technical expertise to remain in compliance.

Educational Benefits of a Users’ Conference

Regulatory and compliance issues aside, user conferences offer a host of benefits to participating banks and credit unions, such as:

Classroom Training

Well-designed webinars or online training sessions are great resources, but focused, in-person learning, and networking allows attendees to remain current on the latest technology solutions and enhancements, industry developments, and specific products and functionality that your vendor is working on. The opportunity to learn first-hand from industry and subject matter experts, as well as share your own experiences and expertise, really should not be underestimated.
User conference learning opportunities often consist of:

  • Basic and advanced workshops or sessions
  • Issue-focused roundtable discussions
  • Networking opportunities with peers
  • Software demonstrations
  • Professional development courses
  • Hands-on training and consultations with vendors

Best Practices

Many find the greatest value in user conference participation through peer discussions and open Q&A sessions on best practices. These sessions give customers access to some of the best information and insight on how other institutions are utilizing the vendor’s solutions to solve problems and drive efficiencies and profitability.

Networking

We know from experience that peer groups serve as the perfect environment to share and exchange ideas, concerns, successes and failures tied to the industry. Many community banks and credit unions share the same worries about technology, compliance, security, and business issues. These events provide a venue for you to hear others’ experiences and tap into their knowledge, providing you the opportunity to make industry friends and gain a trusted group of individuals you can rely on in the future.

The Safe Systems National Customer User Conference, NetConnect™, is less than a month away. This event will bring Safe Systems’ employees and strategic partners together with a variety of banking professionals representing technology, compliance, operations and management roles.

We understand the value of user conferences and we use that opportunity to meet with a selection of customers (Customer Advisory Board) to discuss existing and new products and services that will meet their future business goals.

If you’ve never been to a user conference, don’t take our word for it. Here’s what a few of our customers have said:

“Every time I attend, I come away with knowledge and information that can help me do a better job in my organization.”
“It was good to hear feedback from other bankers about Safe Systems as well as make connections and contacts.”
“This is the best opportunity to get a pulse on exactly what’s happening in the IT Banker’s world.”
30 Jan 2020
Reduce Cybersecurity Risk by Involving the Board of Directors in the ACET Process and Beyond
Compliance, Credit Unions Tom Hinkel 0 comment

Reduce Cybersecurity Risk by Involving the Board of Directors in the ACET Process and Beyond

Reduce Cybersecurity Risk by Involving the Board of Directors in the ACET Process and Beyond

The National Credit Union Administration (NCUA) has recently identified cybersecurity as a supervisory priority for 2020, and as credit unions continue to manage an evolving cybersecurity threat landscape, it is vital that they have their Boards of Directors involved in the process. This starts with adhering to regulatory agencies expectations, such as completion of the Automated Cybersecurity Examination Tool (ACET), designed to help credit unions assess their cybersecurity maturity levels.

While the board typically delegates the day-to-day operational responsibilities to its officers and employees, it cannot delegate its responsibility for the consequences of unsound or imprudent information security policies and practices, including cybersecurity. Institutions that do not adhere to standards and best practices run the risk of examiner findings, Board criticism, and in extreme cases, individual director financial liability.

The Credible Challenge

The expectation that the Board provides a credible challenge to management applies to all financial institutions and is defined in the FFIEC IT Management Booklet this way: A credible challenge involves being actively engaged, asking thoughtful questions, and exercising independent judgment. To accomplish this, the Board must be kept informed, and that requires accurate, timely, and relevant information presented in a manner the Board will truly understand and be able to act on. A simple summary report is typically not detailed enough to engage the Board or give them the kind of information they need to provide that credible challenge. Summary reports can tell the “what” but not the “why”, and Boards need the “why”, when it involves something as significant as cybersecurity.

Engaging the Board of Directors

Moving Beyond the ACET imageMoving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture View Infographic

The Board is responsible for approving and providing general oversight for the credit union’s information security/cybersecurity program, and that includes being involved in—and engaged with—the completion of the ACET and the next steps. Once the initial risk assessment has been completed and reported to the Board, the next step that requires Board involvement is the Gap Analysis and resulting Action Plan. Since the Board is expected to review and approve the institution’s relative risk and control levels, presenting the outcome of the Inherent Risk Profile and Cybersecurity Maturity portions of the ACET enables the Board to gain valuable insight into their systems, cyber vulnerabilities, and current general control levels.

Most importantly though, an accurate risk and control maturity assessment enables management to present a convincing case to the Board providing key reasons why the institution should strengthen controls whenever and wherever necessary. The ACET already assigns numeric values in the Inherent Risk Profile and the Control Maturity sections, which enables a risk and a control maturity “grade” to be given. This adds clarity and gives the Board quantitative insight into how their organization is doing and how auditors and examiners are likely to see their relative risk and control levels.

The ACET only allows a single assessment’s results to be displayed, but ideally multi-assessment data should be displayed graphically or in an easy-to-consume manner, one that enables the Board of Directors to easily evaluate assessment-to-assessment performance comparisons, identify trends, and determine the necessary steps to enhance their cybersecurity posture.

It is extremely important for credit unions to ensure the appropriate people are involved in their efforts to combat cybersecurity risk, from the Board room to the server room. Doing so helps protect them from possible suboptimal audit and exam results and additional regulatory scrutiny. Ultimately, it is the Board of Director’s responsibility to protect itself and its sensitive member data. Having participation from the Board ensures that all stakeholders from the top down are completely vested in addressing this important security and regulatory process.

For more information, please download our complimentary white paper, Moving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture.

23 Jan 2020
Three Steps Credit Unions Should Take to Enhance Cybersecurity Posture After Completing the Automated Cybersecurity Examination Tool (ACET)
Compliance, Credit Unions Tom Hinkel 0 comment

Three Steps Credit Unions Should Take to Enhance Cybersecurity Posture After Completing the Automated Cybersecurity Examination Tool (ACET)

Three Steps Credit Unions Should Take to Enhance Cybersecurity Posture After Completing the Automated Cybersecurity Examination Tool (ACET)

While completing the National Credit Union Administration‘s (NCUA) Automated Cybersecurity Examination Tool (ACET) is an important first step in helping credit unions and their regulators assess cybersecurity readiness, there are additional critical steps that are required to ensure that a credit union is fully prepared and truly in compliance with regulator expectations.

The ACET measures credit union operations, products and services, and cyber controls through two major components: Inherent Risk Profile and Control Maturity. The Inherent Risk Profile determines a credit union’s exposure to risk by identifying the type, volume, and complexity of the institution’s operations. The Control Maturity measures the entity’s level of cybersecurity control readiness. Completing both the Inherent Risk Profile and the Cybersecurity Maturity portions of the assessment enables credit unions to gain valuable insight into their systems, potential cyber vulnerabilities, and general control levels.

Regulators expect credit unions to take the information gathered in the assessment, understand it, determine where they are versus where they need to be, and then put a plan in place to reach those goals. These are collectively referred to as “the next steps”, and in our experience are often missing from cyber-readiness planning.

Gap Analysis – Determining “Desired” State of Maturity

After establishing your current risk status by completing the assessment, the gap analysis is the next step credit unions must take to identify missing controls and processes. The intent of this step is to increase their level of cybersecurity maturity by comparing their current state to their “desired” state.

A credit union’s desired state of cyber maturity can be thought of as where the institution desires to be after addressing the gaps identified in the gap analysis. This can actually present the biggest challenge for a credit union because the concept of a “desired” state requires the credit union to establish its risk appetite. Risk appetite is mentioned nine times in the ACET, and the FFIEC defines it as “…the amount of risk a financial institution is prepared to accept when trying to achieve its objectives.” The risk appetite is set and approved by the Board, and although they may decide a single enterprise-wide cyber risk appetite is sufficient, more often they may prefer to assign a separate risk appetite to each business process.

Finally, because the cybersecurity landscape is continually evolving, and the number of cyber threats is constantly increasing, institutions should strive to steadily increase their control maturity levels, even if their inherent risk profile and risk appetite do not increase. For this reason, the gap analysis and action plan are the most important recurring steps in the cybersecurity program.

The Action Plan, Implementing Plans to Attain and Sustain Maturity

The action plan uses the information gathered in the gap analysis to identify specific declarative statements that should be achieved prior to the next assessment. There is no pre-set number of statements that need to be implemented, but once all baseline statements have been achieved, it is best to target the top six to eight statements and put plans in place to achieve them before the next assessment. Statements should be prioritized according to how the associated contributing components align with specific risk areas. Again, the key is to show all stakeholders that you are making incremental progress from one assessment to the next.

Moving Beyond the ACET imageMoving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture View Infographic

Reevaluate and Address Any Issues from Prior Assessments

The ACET is intended to be completed at least annually, or as significant operational and technical changes occur. Credit unions should continue to review the risk and control maturity results to understand which policies, procedures, processes, and controls are in place and where any corresponding gaps may occur. The periodic reevaluation should include documentation on what improvements have been made (i.e. what declarative statements have been achieved) and how the results were achieved, including resolutions from prior assessments.

The ACET is not the only cyber assessment tool available, but it is now the standard most auditors and NCUA examiners are using. Completing it accurately, and then understanding and acting on the results enables credit unions to confidently understand their cybersecurity risk levels, enhance their cybersecurity posture, and meet auditor, examiner, and Board expectations with confidence. While completing the assessment represents an important first step, taking the information gathered from the assessment, understanding it, and putting a plan in place to address gaps and vulnerabilities helps ensure a credit union can effectively identify and address cyber threats, and demonstrate a strong cybersecurity posture.

For more information, please download our complimentary white paper, Moving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture.

16 Jan 2020
How NCUA’s Assessment Tool Can Enhance Cybersecurity Preparedness for Credit Unions
Compliance, Credit Unions The Safe Systems Compliance Team 0 comment

How NCUA’s Assessment Tool Can Enhance Cybersecurity Preparedness for Credit Unions

How the NCUAs Tool Will Enhance Cybersecurity Preparedness for Credit Unions

Cybersecurity is a top-of-mind concern for all financial institutions as the number and sophistication of threats continues to increase. Attackers today are often well-financed and equipped with the latest technology like machine learning tools, automation, and pre-built toolkits that make it easy for them to attack institutions of all sizes. As the cybersecurity world continues to evolve, it’s important that credit unions do so as well.

In response to this threat, regulatory agencies have introduced a host of new regulations around cybersecurity, and developed tools and guidance aimed to better evaluate a financial organization’s cybersecurity preparedness. Most recently, the National Credit Union Administration (NCUA) developed the Automated Cybersecurity Examination Tool (ACET) to help credit unions better assess their cybersecurity readiness.

The ACET

Moving Beyond the ACET imageMoving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture View Infographic

The ACET, developed in 2017, directly aligns with the Federal Financial Institutions Examination Council’s (FFIEC) Cybersecurity Assessment Tool (CAT), released in 2015. Both the CAT and the ACET are designed to support an institutions’ measurement of cybersecurity risk and evaluation of control maturity. According to the NCUA, the new exam tool intends to provide a “repeatable, measurable, and transparent process that improves and standardizes our supervision related to cybersecurity in all federally insured credit unions.”

The ACET measures credit union operations, products and services, and cyber controls through two major components: Inherent Risk Profile and Control Maturity. The Inherent Risk Profile determines a credit union’s exposure to risk by identifying the type, volume, and complexity of the institution’s operations. The Control Maturity portion measures a credit union’s level of cybersecurity controls. The levels range from “baseline” to “innovative,” with the 123 baseline statements representing the minimum regulatory expectations. This portion consists of almost 500 declarative statements within the following five domains:

  • Cyber-risk management and oversight
  • Threat intelligence and collaboration
  • Cybersecurity controls
  • External dependency management
  • Cyber-incident management and resilience

While officially the ACET is not strictly required, the NCUA states that “Credit unions may choose whatever approach they feel appropriate to conduct their individual assessments, but the assessment tool would still be a useful guide.” During an examination the NCUA will typically ask if the credit union has completed the ACET or equivalent assessment, and if not, the examiner will then use the ACET tool during the exam to complete the cyber assessment with the institution. Simply put, the ACET is the current defacto standard for cyber assessments.

Proper Interpretation is Key

While completing the ACET is recommended, it can also be quite time-consuming, particularly for smaller institutions, due to the amount of prep work and supporting documentation required. To complicate matters further, most of the questions and declarative statements can be interpreted in various ways. Incorrect interpretation will impact the accuracy of stated risk profiles and risk levels, which in turn will result in inaccurate gap analysis and actions plans, possibly resulting in under allocated, or misallocated, resources.

Next Steps

Regardless of whether you use the ACET or another methodology, simply completing the cyber assessment merely clears the first hurdle in the process, it does not ensure that a credit union is fully prepared, however. There are several critical next-steps credit unions need to take to ensure they are truly prepared to address cybersecurity threats. Next week, we will discuss the steps credit unions should take following completion of the ACET to ensure they are taking a proactive, vigilant, and compliant approach to cybersecurity preparedness.

For more information, please download our complimentary white paper, Moving Beyond the ACET – Next Steps All Credit Unions Should Take to Improve Cybersecurity Posture.

09 Jan 2020
Top Bank Technology, Security, and Compliance Concerns in 2020
Banks, Compliance, Credit Unions, Security, Technology Darren Bridges 0 comment

Less Worrying. More Banking.™ Top Banking Technology, Security, and Compliance Concerns in 2020

Top Banking Technology, Security, and Compliance Concerns in 2020

The constant evolution of technology, the ever-changing compliance landscape, and increased security threats have fundamentally changed the way financial institutions operate today and the key concerns they are facing on a daily basis. In our 26 years of experience serving the community banking industry, we have not seen a more difficult landscape for our clients to navigate.

The risks associated with security, compliance and technology have never been more challenging than they are today. As the responsibilities of community financial institutions continue to grow and evolve, it is not uncommon to worry about limited resources, keeping up with new technologies, or simply maintaining a competitive advantage in the industry. We believe that all financial institutions, regardless of size and location, should be able to leverage the best technology solutions available so they can focus on serving the financial needs of their communities. It is our mission to provide peace of mind and value for our customers in these areas so banking professionals can get back to doing what they do best and spend less time worrying.

Through the years we have developed and offered compliance centric IT services designed exclusively for community banks and credit unions, ensuring that they are kept up to date on the current technologies, security risks, regulatory changes, and FFIEC guidelines. We strive to listen to our customers to ensure our solutions continue to support the changing needs of the industry and meet their expectations in addressing key concerns. We recently surveyed a group of our community bank and credit union customers to gain a better understanding of the top worries and concerns they have for 2020 as they relate to technology, compliance and security. Through that survey we uncovered the following:

Technology Challenges

Financial institutions of all sizes continue to depend on their IT network infrastructure and technology solutions for nearly all functions of the institution, which makes it crucial that all solutions work efficiently. While community banks and credit unions have been utilizing technology for quite some time now, they continue to face certain technology challenges heading into 2020. According to survey respondents, the expense of technology solutions, keeping up with rapid changes, and truly understanding the technology solutions are top concerns. In addition, many continue to struggle with network management and connectivity, patch management, and training employees on IT solutions.

Compliance

While banks and credit unions have adjusted to the frequent and strenuous regulatory reviews, they continue to struggle with meeting examiner expectations across critical areas such as vendor management, business continuity planning, and risk management and assessment. In addition, many struggle with adequately defining the requirements of the Information Security Officer (ISO), as this role has become more involved and the expertise needed has grown. The ISO has one of the most crucial roles in a financial institution. In fact, it is one of the few positions that are required by guidance. The FFIEC covers various issues related to information security in great detail, including the expectations and requirements for the ISO. According to the FFIEC IT Examination Handbook’s Information Security booklet, financial institutions should have at least one person who is dedicated to serving as an in-house ISO.

Security

Over the past several years, the industry has been impacted by a marked increase in data breaches, ransomware, card fraud and other malicious attacks. Additionally, an increase in devices connected to networks has made it critical for financial institutions to strengthen their security strategies and policies and ensure all systems are up to date and able to effectively combat today’s threats. Cybersecurity-related attacks on the financial sector continue to increase at an alarming rate, making cybersecurity a top area of concern for financial institutions. Additional areas of concern include ransomware, phishing, malware, disaster recovery, and network security.

Managing these challenges alone can be a daunting task to undertake. As a trusted resource for financial IT and regulatory support, Safe Systems is here to serve as a true extension of your team, providing you with access to technology professionals who are specifically trained in the banking industry. Safe Systems offers cost effective solutions such as IT support and managed services, internal network/cloud design and installation, hosted email, business continuity and disaster recovery, compliance consulting, security services, and IT and compliance training. Our services help financial institutions significantly decrease costs, increase performance, and improve compliance posture.

Let us help you get back to what you do best. Less worrying. More banking.™

 
05 Dec 2019
How to Maintain Bank Compliance and Security During the Holiday Season
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

How to Maintain Bank Compliance and Security During the Holiday Season

How to Maintain Bank Compliance and Security During the Holiday Season

The holiday season is in full swing, which means many employees are heading out of the office to enjoy some vacation time. However, just because it’s the holiday season, it doesn’t mean that cybercriminals are taking time off. Cybersecurity attacks continue to increase and are becoming more sophisticated. Institutions are expected to maintain bank compliance with regulatory guidelines and ensure all technology assets are working properly so operations continue to run smoothly during the holidays.

This can be a challenging time for many community banks and credit unions that have a small staff and rely on key individuals to make sure all activities related to technology, compliance, security, and regulatory requirements are taken care of. Today’s community financial institution relies on the IT department to maintain its hardware and software and to ensure all systems are available when needed. The department is also responsible for monitoring an array of ongoing IT concerns like anti-malware, cybersecurity issues, service-related touch points, compliance updates, and email security, to name just a few. So, what happens when the people responsible for these crucial aspects of the institution go on vacation?

Partner Up

Many financial institutions are turning to an industry-specific managed services provider to act as an extension of their organization and help augment internal technology and compliance resources and responsibilities. The right managed services provider, who is familiar with the banking industry, can serve as a true partner and work alongside current staff to provide timely support, and manage the technology, security, and regulatory compliance aspects for the institution.

A managed services provider can help automate and manage many of the administrative functions that normally fall to the technology or compliance department, making it less daunting for employees to get away. In addition, while this not only saves time and improves efficiencies, it also helps the bank or credit union extend its support hours beyond the traditional 9 to 5 retail hours, which is key for IT departments with limited staff.

Managing IT resources, bank compliance-related issues and combatting cybercrime are some of the greatest challenges and concerns for financial institutions today. When IT and security staff are out or unavailable, outsourcing these processes helps fill the personnel gap and provides added stability for the institution and peace of mind to all.


What To Do When Your Bank's IT Administrator Leaves

What To Do When Your Bank’s IT Administrator Leaves (Checklist)

10 Oct 2019
5 Things Community Banks and Credit Unions Should Budget for in 2020
Banks, Compliance, Credit Unions, Security, Technology Jamie Davis 0 comment

5 Things Community Banks and Credit Unions Should Budget for in 2020

5 Things Community Banks and Credit Unions Should Budget for in 2020

The final months of the year signal the beginning of many traditions. For community banks and credit unions, the Fall marks the start of budget season. Financial institutions use this time to assess the year’s performance, make necessary adjustments—or full upgrades—for 2020 and beyond.

As you know, technology and security are constantly evolving, and compliance continues to be a moving target, so it’s time to consider important areas your institution needs to budget for in the next year. To ensure that your institution heads into 2020 on an upward trajectory, here are five key items to include on your list.

  1. Hardware

    2. Every year hardware should be evaluated to see if it is under warranty; in good working condition; and that the operating system hasn’t reached end of life.

    Two dates to be aware of:

    • SQL Server 2008 R2 reached end of life on 7/9/2019
    • Windows Server 2008 and 2008 R2 reach end of life on January 14, 2020

    These items will need to be upgraded or replaced as soon as possible with supported software. If the decision is to replace a server based on these products being end of life, there are options to consider as covered in number 2 in this article.

  2. Cloud vs. In-house Infrastructure

    3. Free eBookEverything You Need to Know About the Cloud Get a Copy

    Moving internal infrastructure out of the office is the new trend. This move feels similar to the move to virtualization, in that everyone agrees this is the next logical step in the evolution of computing. You should be asking the same question about cloud infrastructure as you did about virtualization—when is the right time for your institution to make the move and what are the pros and cons of this move? When the time comes to replace pieces of your infrastructure, start to gather information about the benefits of moving to the cloud and the costs associated with it. Remember, each server has both direct and indirect costs.

    Direct:

    • Server Hardware
    • Warranty
    • Software

    Indirect:

    • Electricity
    • Cooling
    • Storage/physical space
    • Maintenance
    • Backup
    • Disaster Recovery

    Each year as hardware becomes outdated and needs to be replaced, evaluate whether moving that server to the Cloud makes sense. Be sure that the functions of the server can be accomplished in a cloud environment. Once a presence in the cloud is established, future growth and changes become much easier and quicker.

  3. Firewalls

    4. Download Free PDFMoving Beyond Traditional Firewall Protection to Develop an Integrated Security Ecosystem Get a Copy

    Firewalls continue to evolve as network and cybersecurity threats evolve and change. Ten years ago, adding intrusion prevention systems (IPS) to firewalls became commonplace in the industry. Now there are a host of new features that can be added to your firewall to improve your institution’s security posture. Many of these fall under products using the term next-gen firewalls. A few key features to consider include:

    • Secure Sockets Layer, or SSL, is the industry standard for transmitting secure data over the internet. The good news is most websites on the internet now use SSL to secure the traffic between the PC and the website. The bad news is, your firewall may be protecting your institution from fewer sites than ever before. Google researchers found that 85% of the websites visited by people using the Chrome browser are sites encrypted with SSL. This means that for many firewalls, 85% of web traffic cannot be inspected by the firewall. Many firewalls can perform SSL inspection but may require a model with more capacity; a new license to activate the feature; and configuration changes to enable this feature to work.
    • Sandbox analysis is a security mechanism used to analyze suspect data and execute it in a sandbox environment to evaluate its behavior. This is a great feature to introduce to your infrastructure because it provides more testing and insight into the data coming into your institution.
    • Threat intelligence feeds (like FS ISAC), built-in network automation, and correlation alerting are also important features that can help you keep track of emerging security threats; automate key processes; and improve your institution’s cybersecurity posture.

    Consider enhancing your firewall features or upgrading to a next-gen firewall to ensure the traffic traversing your firewall is truly being evaluated and inspected.

  4. Virtual Information Security Officer (VISO)

    5. A newer service that has grown in popularity over the last year is the Virtual ISO or VISO role. While services like this have been available for a while, this is the first year we have heard so much talk from community financial institutions. As the job of Information Security Officer (ISO) has become more involved the expertise needed has grown as well. These VISO services offer a way to supplement the internal staff with external expertise to accomplish the tasks of the ISO. Budgeting for a service like this becomes critical if one of the following is true:

    • No one else in the institution has the needed knowledge base and finding this knowledge set in your area is difficult or expensive;
    • Your current ISO does not have a background in the field or is wearing too many hats to do it well;
    • Your current ISO is likely to retire or leave due to predictable life change events; or
    • The role of ISO and Network Administrator or other IT personnel do not provide adequate separation of duties at the institution.

  5. Disaster Recovery (DR)

    6. Many institutions do not have a fully actionable or testable disaster recovery process. A verified DR process is a critical element of meeting business continuity planning (BCP) requirements. Therefore, this can be a significant reputational risk for the financial institution, if not done correctly. If your institution hasn’t completed a thorough and successful DR test in the last 12 months, it is time to evaluate your current DR process. Using a managed site recovery service can ensure you have the proper technology and support to thoroughly test your DR plan and recover quickly in the event of a disaster.

    Budget season is a time to address needs and wants, but also a time to seek improvement or evaluate key changes for the new year and beyond. For example, moving your infrastructure to the cloud may not make sense for the coming year, but the insight gained by evaluating it this budget season improves your knowledge-base for when it is time to make that decision. As we conclude 2019, we hope these insights position your institution for a productive budget season and a successful 2020.

12 Sep 2019
Is Your Financial Institution Ready to Weather a Storm
Banks, Compliance, Credit Unions Jamie Davis 0 comment

Is Your Financial Institution Ready to Weather a Storm? How to Be Prepared for the Upcoming Fall Storm Season

Is Your Financial Institution Ready to Weather a Storm

While natural disasters can strike at any time, September and October have historically produced some of the worst storms we have seen. Just last week Hurricane Dorian wreaked havoc on the Bahamas and the Eastern Seaboard of the U.S, disrupting thousands of businesses and organizations, and impacting millions of lives. While hurricane season is top of mind today, tornados, earthquakes, severe thunderstorms, wildfires, etc. all can have a negative impact on area businesses and communities.

As a result, September has been declared National Preparedness Month, designed to encourage and remind everyone to be prepared for disasters or emergencies in their homes, businesses, and communities.

In the spirit of National Preparedness Month, we thought it was important to review the critical steps all banks and credit unions should have in place to ensure they are prepared for a disaster – no matter what time of year it is.

Preparing for Disasters

Get My CopyHow Southern Bank and Trust Recovered from Hurricane Irma Get a Copy

The potential damage that storms can inflict underscores the importance of Business Continuity Planning (BCP) and Disaster Recovery (DR) plans. In addition, regulators require financial institutions to prepare for disasters and have plans in place that ensure key products and services remain available to customers and members after a crisis. In addition to having an updated and tested BCP and DR plan, there are several additional steps your institution can take to adequately prepare for storms, natural disasters, and any other business outages. These steps include:

  • Monitor success of backups and/or replication services to DR site;
  • Utilize Uninterruptable Power Supplies (UPS) for short-term outages;
  • Preemptively shut down servers and all IT equipment in anticipation of an extended outage;
  • Confirm that the server room is locked and secure;
  • Verify that all equipment and sensitive documentation is secure;
  • Ensure all ATMs are stocked as customers may require access to cash;
  • Validate the institution’s Business Continuity Plan through appropriate annual testing;
  • Confirm technology infrastructure will work in a disaster through annual DR test;
  • Make sure that employees and vendors are aware of the proper communication protocols and actions items outlined in your BCP plan to ensure a successful recovery of an event; and
  • Keep the safety and security of employees top of mind. Confirm that key employees have someone to step in should they be unavailable during or after the disaster.

While storms and natural disasters cannot be prevented, proactively knowing what critical functions must be restored first provides confidence to bank executives and staff when responding to a disaster. Developing, implementing, and regularly testing your BCP and DR plans is crucial in today’s banking environment and can make the difference between satisfied customers in the event of a disaster and loss of customer trust when they may need their bank most.

08 Aug 2019
Maintaining Bank Compliance - Understanding the Regulatory Expectations of the Information Security Officer
Banks, Compliance, Credit Unions Jamie Davis 0 comment

Maintaining Bank Compliance: Understanding the Regulatory Expectations of the Information Security Officer

Maintaining Bank Compliance - Understanding the Regulatory Expectations of the Information Security Officer

The information security officer (ISO) plays an integral role in helping organizations meet regulatory expectations, compliance requirements, and other obligations. In a broad sense, the ISO is charged with keeping the IT programs of an organization safe from internal and external threats. This entails creating enforceable policies and processes to protect the institution’s computer infrastructure, networks and data as well as satisfying regulatory compliance requirements.

More specifically, the ISO is responsible for a wide range of duties, from ensuring appropriate software is installed to thwart viruses, spyware, and other harmful threats to facilitating IT security training and communicating security strategies to senior management. These tasks are critical because an information security breach can cause substantial problems, including the loss of sensitive corporate or customer data; interruption to the business and financial loss; and damage to the company’s reputation and brand.

ISO Regulatory Requirements and Expectations

Download PDFRole of the ISO: Regulatory Expectations and Requirements of a Financial Institution’s ISO Get a Copy

Financial institutions are highly regulated organizations; therefore, the ISO fills a unique role in maintaining compliance to these regulations. Much of the ISO’s role started with the Gramm-Leach-Bliley ACT (GLBA) of 1999. GLBA, for example, broadly dictates that institutions implement the necessary security measures to safeguard their sensitive information and that of their customers. This involves ensuring information is effectively protected whenever it is being accessed, processed, and stored. The statements in the GLBA outlining information security have been expanded over the years by the Federal Financial Institutions Examination Council (FFIEC) into a set of booklets that in turn define the ISO role.

The FFIEC covers various issues related to information security in great detail, including the expectations and requirements for the ISO. According to the FFIEC IT Examination Handbook’s Information Security booklet, financial institutions should have at least one person who is dedicated to serving as an in-house ISO. The handbook specifically explains: “Management should designate at least one information security officer responsible and accountable for implementing and monitoring the information security program. Information security management responsibilities may be distributed across various lines of business depending on where the risk decisions are made and the institution’s size, complexity, culture, nature of operations, or other factors.”

Ensuring Bank Compliance

In this role, the ISO must have the appropriate authority, stature within the organization, knowledge, background, training, and independence to complete the assigned duties successfully. To ensure the proper separation of duties, that individual should be independent of the IT operations staff and should not report to IT operations management. The ISO is responsible for overseeing and coordinating security efforts such as information technology, human resources, communications, legal, finance management, and other groups. The ISO must lead risk assessment efforts that guide security initiatives and standards throughout the entire organization as well as consult on the IT budget; performance management; professional development and training; and participate in planning activities while also working with auditors, both internal and external, to test and validate controls. The ISO should be able to point to documentation that acts as evidence of the institution’s practices, including reports, logs, meeting minutes, completed checklists, etc. This is the most time-consuming element of the ISO role, but it’s the only way to prove that all compliance areas are aligned and working as intended.

Meeting all these expectations and requirements can be challenging for an ISO, especially one employed by a smaller institution with fewer resources. However, financial institutions can capitalize on the services of a third-party, virtual ISO (VISO). A VISO platform serves as a risk management solution that addresses the regulatory expectations and responsibilities of the ISO. While a virtual ISO cannot replace the need for an actual ISO at a financial institution, it can certainly help manage the responsibilities and streamline the local ISO’s duties. A VISO does not only provide additional technical knowledge, but it can give institutions the peace of mind of knowing an expert will always be available to help the internal ISO meet regulatory requirements, bank compliance, and other responsibilities.

25 Jul 2019
Resource Center
Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

New Resource Center Features Banking Technology, Security, and Compliance Insights for Financial Institutions

Resource Center

In today’s fast-paced environment, it’s important for financial institutions to have access to trusted information related to technology, compliance, and security trends. To help facilitate this, Safe Systems has launched a new online Resource Center which provides community banks and credit unions with access to a centralized knowledge base of free materials. The Resource Center can easily be reached from any page of our website in the top navigation bar.

Meeting Your Interests and Needs

What is currently top of mind for your institution? What is keeping you awake at night? What are you most interested in learning to help you improve your performance?

Whether you are searching for information that will help your institution understand how to stop a cybersecurity attack; identify what to do when your IT administrator leaves; or recognize the top compliance and security areas where you should focus; our new online Resource Center can help. You’ll find the relevant information you need to help you worry less and focus more on banking.

 

Browse Our Resouces

Key Features and Benefits

Our Resource Center is designed to not only be useful but easy to use. There is a wide variety of content, ranging from videos to white papers to case studies. You have the freedom to search by topic and browse at your own pace to find the information most valuable to you, in the format you most prefer. When you make a selection, you’re taken to a secure page where you can choose to view the material instantly in our online environment or download it to your computer to view later at your convenience.

Whether you are trying to find a solution to a specific problem, stay on top of the latest trends and industry regulations, or simply discover new insights, our Resource Center allows you to conduct your research in an easy and meaningful way. Here are five features to help you find what you are looking for:

  • Categories – Assets are grouped in three main categories, compliance, technology, and security, allowing you to dive into specific pieces based on these themes.
  • Search box – You can conduct a search by category, keyword, or title to find your desired content faster.
  • Suggested content – Recommendations for related materials are highlighted on each page to help you find the most relevant content based on your search.
  • Dynamic environment – The Resource Center is updated frequently with new materials to provide timely and up-to-date information.
  • Archiving – Most materials remain in the center permanently allowing you to access relevant content on an ongoing basis as your needs change.

An Ever-evolving Resource

The Resource Center will continue to evolve as a virtual library. Website visitors can look forward to encountering a constantly-expanding cache of information making it a worthwhile experience for any financial institution.

 

Browse Our Resouces

11 Jul 2019
The Cybersecurity Threat - How Concerned Should the CEO and Senior Management Be Featured Blog Image
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

Evaluating Threats: Should Financial Institution CEOS Be Concerned About Cybersecurity in Banking?

The Cybersecurity Threat - How Concerned Should the CEO and Senior Management Be Featured Blog Image

Cybersecurity-related attacks on the financial sector are increasing at an alarming rate, and a recent IMF estimate suggests that “…average annual potential losses from cyber-attacks may be …around $100 billion”. Another study indicates that “…financial services firms also fall victim to cybersecurity attacks 300 times more frequently than businesses in other industries.” These two metrics make cybersecurity a critical issue for banks and credit unions, and in fact, we consistently find this issue in the top 3 concerns for financial institution CEOs, boards, and senior management.
What is the best way to approach this critical issue? We think there are three important questions the CEO and senior management should be asking about cybersecurity:

New call-to-actionTop IT Areas Where CEOs Should Focus to Enhance Cybersecurity Posture  Get a Copy

  1. How much cyber risk is “acceptable” to my institution?

    2. “Acceptable” risk levels are also referred to as “risk appetite”, because if management determines that residual risk levels are within their pre-established risk appetite, those residual risks are, by definition, acceptable.

    Risk appetite is broadly defined as the amount of risk an entity is willing to accept in pursuit of its strategic mission. According to the FFIEC Cybersecurity Assessment Tool (CAT), the Board and senior management should establish a risk appetite level consistent with their strategic goals and objectives. Risk appetite is clearly an important concept to regulators, as the term is repeated 17 times in the CAT.

    But is it reasonable that a single risk appetite level should apply to the entire enterprise? Institutions offering products and services online are willing to accept a higher level of cyber risk then those who don’t. Even among online services, some might be riskier than others. For example, offering simple online access to account information vs. offering funds management services like investment accounts. For this reason, we recommend risk appetite levels be established at the business process level. These individual levels can then be rolled up to an overall composite risk appetite.

  2. How do I determine my current level of cyber risk?

    3. To determine an institution’s cybersecurity posture, the CAT provides a regulator designed and approved, repeatable methodology that utilizes a two-step process. First, establish an Inherent Risk Profile, and second, determine your Cybersecurity Control Maturity. The Inherent Risk Profile identifies the institution’s inherent risk before implementing controls. The Cybersecurity Control Maturity includes domains, assessment factors, contributing components, and individual declarative statements across five maturity levels to identify specific controls and practices that are currently in place.

    By reviewing your institution’s inherent risk profile and control maturity levels across the enterprise, management can conduct a gap analysis to determine whether its maturity levels are acceptable in relation to its risk. In other words, are our residual risks within pre-established risk appetite levels? If they’re not, the institution must either reduce the level of risk, or (more commonly) increase the levels of control maturity.

    One more thing about cyber risk; of the 3 categories of controls (preventative, detective, and corrective/responsive), often preventive and detective controls aren’t applicable, leaving only corrective/responsive measures. That’s why testing is so critical, which brings us to the final question…

  3. When was the last time we conducted a cyber incident response test?

    4. The answer should be recently. Here’s why: Not all traditional disasters have a cyber element to them, but many cyber events have a system recovery element that may impact your ability to deliver products and services to your customers. Cyber incidents can also often indicate a violation or deviation from your security policies and best practices, for example if an employee or third-party either intentionally or inadvertently caused the incident. This may lead to policy changes, or at least the need for additional internal training.

    Senior management must ensure their institutions have adequate incident response capabilities so they can detect incidents (whenever possible), contain and control the impact, and ultimately recover. Testing is the only way to definitively verify that your institution has effective cyber incident resilience and recovery capabilities. Periodic testing also helps to ensure an incident response plan is being maintained in a state of constant readiness so that you can react quickly. Unlike a natural disaster which will often provide at least a short window of warning, a cyber event typically does not. In fact, recent studies indicate that more often than not, it is the customer that first detects a cyber event, not the institution.

    Lastly, financial institutions should conduct testing based on the probability and impact of the event or incident being simulated. Since it is far more likely that you’ll be impacted by a cyber event as opposed to a catastrophic natural disaster, incident response capabilities should be tested at least as often as your BCP, or at least annually.

Final Thoughts

New types of security-related incidents are constantly emerging. Consequently, CEOs and senior management of financial institutions must be prepared to keep IT resources ahead of the current threat environment. When we address Boards on cybersecurity matters, we often get asked why cybersecurity spending should increase even if our risk profile hasn’t. The threat environment is increasing and evolving, so even if your inherent risk profile isn’t changing you must still increase control maturity levels over time to maintain your residual risk within your risk appetite levels. As the FFIEC IT Handbook’s Information Security Handbook states,

“…because of the frequency and severity of cyber-attacks, the institution should place an increasing focus on cybersecurity controls, a key component of information security. Institutions should also assess and refine their controls on an ongoing basis. The condition of a financial institution’s controls, however, is just one indicator of its overall security posture. Other indicators include the ability of the institution’s board and management to continually review the institution’s security posture and react appropriately in the face of rapidly changing threats, technologies, and business conditions.”

There are many other areas related to cybersecurity that CEOs and senior management should be considering. To gain more insight into those areas, as well as other key topics for CEOs to be aware of, download our white paper, Top IT Areas Where CEOs of Financial Institutions Should Focus: Important Questions and Answers.

14 Jun 2019
5 Key Areas of Focus for a New Bank Information Security Officer
Banks, Compliance, Credit Unions Jackie Marshall 0 comment

5 Key Areas of Focus for a New Bank Information Security Officer

5 Key Areas of Focus for a New Bank Information Security Officer

In today’s business environment, cyber threats are constantly evolving, and financial institutions are among the most highly targeted industries. Financial institutions are considered part of the critical national infrastructure, and protecting NPI (non-public information) and financial transactions is a high priority for banks and credit unions as they strive to address ransomware, account takeovers, mobile banking exploitation, and other cybercrimes.

Download PDFRole of the ISO: Regulatory Expectations and Requirements of a Financial Institution’s ISO Get a Copy

The role of the Information Security Officer (ISO) is an important strategic IT and business role with a high level of visibility, responsibility, and associated accountability. The Information Security Officer is required to interact with the IT steering committee, board of directors, auditors, examiners, and others to provide periodic status updates on the institution’s information security program. To date, we have identified 7 distinct areas of responsibility for the ISO, consisting of 35 individual metrics requiring reporting and documentation.

Qualities for this role include leadership skills, political influence, thorough knowledge and understanding of regulatory requirements, the ability to work with internal management and third parties, and an in-depth understanding of the organization’s technology infrastructure and operations. This is a tall order for any organization much less a community financial institution that may lack individuals with expected qualifications, bandwidth, and experience. The vast majority of community financial institutions do not have dedicated ISO’s, but instead add the title (and associated responsibility and accountability) to someone that may already wear multiple hats.

To assist those taking on the role of an ISO at a community financial institution, we’ve provided five areas of focus for success:

  1. Ensure the Protection of Information

    2. The ISO’s primary responsibility is to safeguard the security and confidentiality of nonpublic information (NPI) as well as the institution’s financial transactions. In doing so, the ISO must lead efforts to ensure adequate administrative, technical, and physical controls based on risk are in place. Information assets encompass everything from hardcopies archived in a file cabinet, to information stored in a computer system to data being transmitted over the internet (including remote deposit capture and mobile banking transactions).

  2. Understand Key Regulations and Requirements for Compliance

    3. The ISO must adhere to the Gramm-Leach-Bliley Act (GLBA), which is also known as the Financial Modernization Act of 1999. The GLBA, which requires financial institutions to explain how they share and protect their customers’ private information, provides a strong framework for information security. So does the Federal Financial Institutions Examination Council (FFIEC). The FFIEC is a five-member agency responsible for establishing consistent guidelines and uniform practices and principles for financial institutions. They have published, and periodically update, 12 handbooks for information security requirements and best practices. The ISO must understand the regulatory expectations of both GLBA and FFIEC.

  3. Be Proficient in Cybersecurity and the Cyber Assessment Tool (CAT)

    4. Cybersecurity, according to the FFIEC, is the evolving process for protecting consumer and bank information by preventing detection and responding to attacks. The FFIEC outlines specific cybersecurity standards within the CAT, which is designed to help institutions determine their cyber risks and control maturity levels. Although financial institutions are not required to use the CAT to conduct their annual cyber assessment, they are expected to annually assess their cyber posture and report that status to the Board. Since the CAT is the defacto standard for cybersecurity measurement, it is the most common methodology. ISO’s must also be familiar with the FFIEC IT Examination Handbook and cybersecurity standards, which cover business continuity planning, IT/information security policies, audit, incident response planning, and other important topics.

  4. Perform Duties Beyond Overseeing and Coordinating Proactive Security Efforts

    5. Since no environment is ever 100% secure all the time, the ISO is also responsible for responding to attempted/actual cyber-attacks in a timely manner which may include potential involvement in legal proceedings; interacting with the cyber insurance coverage carrier; accountability for commercially reasonable security controls; strategic planning for internal infrastructure change; growth/acquisition; overall IT/cyber risk appetite; risk assessments for new technology; and customer-facing online banking services.

  5. Review Periodic Tasks That Include Effective Systems Management and Security

    6. The institution’s ISO needs to have visibility and accountability into existing technology driven security measures, including implementing approved software, anti-malware efforts, software patches, encryption, and multi-factor authentication to prevent unauthorized access to information. The ISO should also ensure the financial institution has adequate intrusion detection and intrusion prevention systems in place; review back up failures; and evaluate activities for high-risk online banking customers (ACH/wires).

Cybersecurity is a constant challenge for financial institutions, especially smaller banks and credit unions with limited resources. Because of the ever-expanding expectations for the role, institutions often struggle with hiring and retaining individuals with the extensive expertise needed to fill the ISO’s shoes. However, financial institutions that require assistance are increasingly turning to trusted third-party providers to ensure that information security requirements are properly addressed on a periodic basis.

06 Jun 2019
The Ultimate Guide To Business Continuity Management for Banks and Credit Unions
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

The Ultimate Guide To Business Continuity Management for Banks and Credit Unions

The Ultimate Guide To Business Continuity Management for Banks and Credit Unions

The Ultimate Guide To Business Continuity Management for Banks and Credit Unions

By Tom Hinkel

In November 2019, the Federal Financial Institution Examination Council (FFIEC) updated its BCP IT Examination Handbook and expanded its focus from Business Continuity Planning (BCP) to Business Continuity Management (BCM). The change makes sense, because “planning” is only one part of the business continuity process. Business continuity management encompasses the entire process by integrating resilience, incident response, crisis management, third-party integration, disaster recovery, and business process continuity.

In the financial industry, community banks and credit unions are required to develop compliant business continuity plans that identify business processes along with their interdependencies that provide resilience to, and recovery from, all potential threats to the financial institution. BCM is designed to help organizations, regardless of their size, location or activity, minimize the impact of disruptions of any kind, natural or man-made, including cyber.

The new BCM guidance represents the first major update since 2015 and calls for all “entities” to rethink their approach to business continuity and be prepared to make appropriate plan revisions to meet these expectations. Entities are defined as depository financial institutions, nonbank financial institutions, bank holding companies, and third-party service providers. The use of this term is significant, as it essentially pulls all interdependencies into the planning process.

With so much at stake, it is important for financial institutions to understand the BCM process and the key requirements to develop the business continuity plan:

  • Regulatory requirements relevant to a compliant BCM Program
  • How to develop the business continuity management plan (BCMP)
  • Pandemic planning and business continuity strategy
  • The importance of integrating vendor management into the BCMP
  • Steps to effectively update and test the plan
  • The benefits of automating the BCM process

Regulatory Requirements

 
To comply with regulatory expectations, financial institutions are required to focus on an enterprise-wide, process-oriented approach that considers technology, business operations, testing, and communication strategies that are critical to business continuity management for the entire organization, not just the information technology department. Regulations make it clear that institutions need to plan to perform their critical business functions, even if technology may be impaired or unavailable.

Auditors and examiners are also scrutinizing business continuity plans to verify that the institution’s methodology and plan structure closely adhere to the 2019 regulatory guidance. A key change in the guidance is the increased focus on resilience. Resilience is the ability to prepare for—and adapt to—changing conditions and both withstand and recover rapidly from disruptions, whether that includes deliberate attacks, accidents or naturally occurring threats or incidents. Two keys for understanding resiliency are the terms “withstand” and “recover”, with an emphasis on withstanding adverse events. In the past, business continuity planning has been focused more on recovery, but now the FFIEC has placed a heavy focus on resiliency. The ultimate goal is for financial institutions to be more proactive and minimize having to implement traditional recovery measures down the road. When going through the BCM process, resilience must be included from the very beginning of the process to successfully meet regulatory expectations.

How to Develop a BCMP – What to Include in the Plan

 
It’s safe to say that most banks and credit unions have some sort of a BCMP in place, yet many struggle with determining what to include in the plan to ensure it is both recoverable and compliant. With the new changes to the guidance, many community banks and credit unions may also be wondering what specific changes they’ll need to make to meet these new expectations.

While each financial institution has a unique operating model based on its services, demographic profile, organizational processes, and technologies, the first step when drafting or updating the BCMP is to have a thorough understanding of all the functions and processes that make up those operations. This process, which we refer to as Enterprise Modeling, involves identifying all departments or functional units, with all associated processes and functions (including all internal and external interdependencies), and determining the team owners and members responsible for each department. Having representatives from each department take an active role in the planning process ensures the technologies and responsibilities for each area are accurately represented. This also helps the financial institution develop a more accurate assessment of its recovery time objectives and actual recovery capabilities. It is not realistic to have a single individual with all the knowledge and unique skill set required to put together a comprehensive BCMP.

A plan should consist of all the steps required to ensure key products and services remain available to customers or members. The BCMP consists of five phases including risk management (Business Impact Analysis, Risk/Threat Assessment); continuity strategies (Interdependency Resilience, Continuity and Recovery); training and testing (aka Exercises); maintenance and improvement; and board reporting.

Furthermore, the BCMP should be a “live” document that keeps pace with any changes in infrastructure, strategy, technology, and human resources. As soon as a plan is board approved, it should be tested, and a new draft plan should be initiated. At any point in time you should have both an approved plan, as well as a live draft to accommodate changes.

Pandemic Planning and Business Continuity Strategy

 
In the past, financial institutions were required to have a separate pandemic plan, but the new FFIEC guidance instead expects community banks and credit unions to assess and manage pandemic risk alongside all other possible disasters. This means the BCM plan is the pandemic plan, and financial institutions must analyze the impact a pandemic can have on the organization; determine recovery time objectives (RTOs); and build out a recovery plan.

As we’ve all learned, pandemic planning is very different from natural disasters, technical disasters, malicious acts, or terrorist events because the impact of a pandemic is much more difficult to determine due to the differences in scale and duration. Pandemics also directly impact financial institution and third-party employees rather than targeting infrastructure or technology-based interdependencies. Cross training and succession planning should be a key part of the pandemic planning process to ensure operations can continue even if key individuals are unavailable.

FFIEC guidance states that the financial institution’s BCMP should include five key elements to address the unique challenges posed by a pandemic event:

  1. A preventive program including monitoring of potential outbreaks; educating employees; communicating and coordinating with critical service providers and suppliers; and providing appropriate hygiene training and tools to employees
  2. A documented strategy that provides for scaling the institution’s pandemic efforts to align with the current six-stage CDC framework
  3. A comprehensive framework of facilities, systems, or procedures that provide the organization the capability to continue its critical operations in the event that large numbers of the institution’s staff are unavailable for prolonged periods
  4. A testing program to ensure that the institution’s pandemic planning practices and capabilities are effective and will allow critical operations to continue
  5. An oversight program to ensure ongoing review and updates to the pandemic plan

The Importance of Integrating Vendor Management into the BCMP

 

The vast majority of banks and credit unions today rely on third-party service providers, or vendors, to conduct business on a day-to-day basis. When financial institutions outsource key functions to a service provider, it creates a reliance on that third-party and exposes the institution to the risk of not being able to resume operations within pre-defined recovery time objectives in the event of a disruption. The FFIEC now expects critical third-party providers to be active participants in the BCM program, and it’s likely that regulators will require financial institutions to have a detailed understanding of the resilience capabilities of their core/technology service providers, cloud providers and others moving forward. When creating a BCMP, financial institutions have to account for all interdependent third-party relationships and identify the potential consequences a third-party disruption might have on its operations.

The criticality of the product or service the vendor provides is directly related to the criticality of the dependent process it supports, as identified by the business impact analysis. Some questions financial institutions should consider include:

  • How important is this vendor to what we do?
  • If they fail, how many of our dependent services would be negatively impacted?
  • How challenging would it be to replace this vendor?

Vendor criticality is expressed in terms of Recovery Time Objectives (RTOs), and each bank or credit union determines and assigns the same RTOs to the third-party vendor as they have to the underlying process they support. In other words, if you’ve identified a two-day recovery time objective for a particular process, any underlying vendors will also inherit that same two-day RTO. In the event that the vendor cannot match your RTO (validated by testing), you must have a contingency plan in place such as alternative procedures or providers to compensate for the gap.

Successfully integrating vendor management and business continuity planning is essential for financial institutions to truly understand their actual recovery capabilities by validating whether or not their third-party providers “have sufficient recovery capabilities” to meet your recovery objectives.

Importance of Exercises and Tests When Updating the BCMP

 
Exercises and tests are important parts of the process, and in fact, the BCMP is not complete until the plan has been thoroughly tested. The new handbook makes an important distinction between exercises and tests in the BCMP process, defining an exercise as “a task or activity involving people and processes that is designed to validate one or more aspects of the BCMP or related procedures.” On the other hand, a test is often performed “to verify the quality, performance, or reliability of system resilience in an operational environment.” The handbook emphasizes the importance of both exercises and tests to demonstrate resilience and recovery capabilities.

Exercises and testing verify the effectiveness of the plan by validating all recovery time objectives; helps train the team on what to do in a real-life scenario; and identifies areas where the plan needs to be strengthened. In addition, examiners are also verifying that a BCMP has been tested, and the financial institution is able to execute the plan if and when the need arises. Because the financial industry is considered part of the nation’s critical infrastructure, testing, exercises, and training will continue to be a focus going forward.

Every test should start with a realistic scenario drawn from the top threats as identified by the risk management phase of the planning process. Top threats are those determined to have both high impact and high probability ratings. While initial testing of a plan can be relatively straightforward, a bank or credit union should strive to extend the scope and severity of the exercise with each consecutive test by making the tests consecutively more complex and including different individuals. Conducting the very same test with the same participants every year will not satisfy examiners nor will it give your management the assurance they need.

In addition to the senior management and information security roles defined in a plan, the testing team should include key department heads with detailed knowledge of the processes and functions impacted by the scenario. Tests should cover the steps departmental managers must take to complete functions manually or in an alternate way. In addition, all departmental specialists should be included in the exercise and testing program. There are two reasons for that, the first is so they are familiar with alternate procedures in emergency scenarios, the second is to make sure you have backups, or successors, to your primary recovery resources. Succession planning is another hot button item with examiners now because of the pandemic.

While regulators require proof of exercises and testing annually, more frequent testing is indicated whenever a previous test uncovered significant gaps in the plan, or if there are significant internal changes to processes or infrastructure or personnel.

Automating the Planning Process

 

To help streamline this time-consuming process, banks and credit unions can automate repetitive portions of business continuity planning. Automating these activities eliminates the need to update cumbersome spreadsheets and manually copy/paste information from various reports and previous assessments. The 2019 guidance requires a number of changes to your existing plan, some subtle and some significant.

An automated BCP solution will also help guide banks and credit unions through the entire BCMP process, assuring that all required elements are included as they are necessitated by regulatory guidance changes. Automating the planning process makes it easier and much less time-consuming to perform annual plan updates by allowing static portions of the plan to carry forward, while incorporating changes wherever necessary. Any automated solution should also allow you to identify all material plan changes from year-to-year, so management and board approval is easier.

Conclusion

 
Business Continuity Management is a critical process for banks and credit unions regardless of size and location, and the plan is central to that effort. To streamline the planning process, financial institutions should integrate business continuity into all business decisions; conduct periodic reviews of the plan; and perform regular testing. Everyone in the organization — from the tellers to the Board — should understand the importance of business continuity planning and how his or her unique role fits into the financial institution’s overall business continuity strategy.

09 May 2019
Why Succession Planning is Essential for the Bank Information Security Officer Role
Banks, Compliance, Credit Unions Safe Systems 0 comment

Why Succession Planning is Essential for the Bank Information Security Officer Role

Why Succession Planning is Essential for the Bank Information Security Officer Role

Succession planning is crucial to business continuity planning and maintaining an organization’s growth, longevity, and legacy. A succession plan is essentially a strategy for transferring key roles when individuals leave due to retirement, resignation, or whenever circumstances such as Pandemic or natural disaster impact the availability of your key employees. While a typical succession plan may focus on the transition of senior executives, such as the CEO, CFO, COO, executive director, or bank president or manager, it is also important to include other key employees in which you may have a concentration of duties, such as the Information Security Officer (ISO).

Why plan for transitions?

While everyone has a part to play in supporting an institution’s information security, compliance processes, and cybersecurity activities, no one is more central to this endeavor than the ISO. Those taking on the role of ISO assume a wide range of responsibilities, as well as the associated accountability. Financial institutions should be prepared and know how to proceed should the ISO leave or be unavailable or unable to perform their job duties. This means not only identifying alternate personnel for this key position, but also having those folks properly trained in advance.

Download the PDFThe 2019 IT Outlook for Community Banking Get a Copy

In addition, regulators are increasingly requiring financial institutions to have a formal succession plan for key employees, and we’ve seen an uptick in findings related to this issue. The Federal Financial Institution Examination Council’s (FFIEC) IT Examination Handbook requires financial institutions to include cross-training and succession planning in the business continuity plan to ensure back-up personnel are identified for key operational positions. In addition, the FFIEC guidance also states that institutions should designate at least one information security officer responsible and accountable for implementing and monitoring the information security program. ISOs should report directly to the board or senior management and have sufficient authority, stature within the organization, knowledge, background, training, and independence to perform their assigned tasks. To ensure appropriate segregation of duties, the information security officers should be independent of the IT operations staff and should not report to IT operations management.

Yet many institutions approach ISO succession planning in general, let alone for the ISO, as an afterthought (if at all) and are ill-prepared to address and manage the ever-growing list of ISO responsibilities. Studies show that while a succession plan is crucial, less than half of banks have a long-term and emergency succession plan in place, according to research by Bank Director. Also, approximately 37 percent of banks identified succession planning among their top three board composition challenges, reported the 2018 Bank Director survey. Another 25 percent of those surveyed expressed dissatisfaction with their bank’s succession planning efforts.

Regardless of the situation, planning (and cross training) ahead of time can help minimize uncertainty, prevent unnecessary stress and assure continuity in the information security/cybersecurity process. Considering that the ISO is responsible for oversight and coordination of the security and confidentiality of Non-Public Information (NPI) , as well as FFIEC compliance and regulatory requirements, a misstep or lack of guidance in these areas can cause operational, regulatory, and reputational risks to the financial institution.

Creating a succession plan for the ISO

Succession planning generally entails identifying and developing successors who can replace vital roles. Strategies for succession planning vary based on the size, type, and goals of the organization, but there are some basic steps to follow:

  • Assess requirements and responsibilities — A good place to begin the planning process is to understand the primary responsibilities, expertise, and requirements of the ISO position. Although this continues to evolve, to date we’ve identified 35 distinct elements in 7 categories ranging from information security to BCP, Vendor Management, and Strategic IT planning.

  • Evaluate internal talent — Identify which employees may be the most qualified to take on these tasks, bearing in mind that in all likelihood you may need multiple resources. Commit to cross training these individuals through hands-on training, classroom education, and mentorship.

  • Recruit externally — If there is a shortage of internal talent to fill the ISO role, institutions might consider identifying potential resources outside their organization, such as a virtual ISO service.

Succession planning for the ISO is a matter of information security continuity, and any gaps in this area may impact the entire enterprise, including the senior management, employees, customers, shareholders, and other stakeholders. Banks and credit unions should keep in mind that succession planning in general is not a one-and-done undertaking. Because of the evolving nature of information security, it is an ongoing exercise, and succession plans should be reassessed regularly and updated as needed. Effective succession planning and cross training will make transitions (planned or unplanned) a more positive experience for everyone in the organization.

21 Mar 2019
Safe Systems Launches Customer Referral Program
Banks, Compliance, Credit Unions, Security, Technology Darren Bridges 0 comment

Safe Systems Launches Customer Referral Program

Safe Systems Launches Customer Referral Program

According to our third annual report, “2019 IT Outlook for Community Banking”, nearly 91% of survey respondents claim to turn to their peer network for information when researching a new solution or vendor.

Download the PDFThe 2019 IT Outlook for Community Banking Get a Copy

These confidants provide valuable first-hand information from trusted individuals who have knowledge of the industry and are experiencing similar situations and issues. So, we wanted to provide an opportunity for our customers to conveniently share our more than 25-year journey serving the community banking industry, unique customer experience, and dedicated strategic advisor service, by simply sending their peers to this new webpage – The Safe Systems Way.

In addition to facilitating the easy exchange of information, we have launched a formal customer referral program that provides existing customers with a simple online process to refer Safe Systems to their peers. Customers will be awarded a small gift thanking them for each peer referral, and new customers who come through the referral program will receive an exclusive welcome gift.

At Safe Systems, we strive to provide a high degree of customer service by paying close attention to our customers’ pain points and keeping their needs a priority. This has enabled us to build strong relationships with clients. These relationships combined with extensive knowledge of community banks and credit unions, enables Safe Systems to be a valued partner and true extension of our financial institution clients. We truly understand the complexity that financial institutions face in managing the constant evolution of technology, compliance, and security. Our team works to streamline IT processes for banks and credit unions and ensure regulatory requirements are met or exceeded.

28 Feb 2019
IT Outlook Blog Featured Image
Banks, Compliance, Credit Unions Tom Hinkel 0 comment

5 Key Ways to Meet Examiner Expectations and Maintain Bank Compliance

IT Outlook Blog Header

Banks and credit unions alike have grown accustomed to the frequent and often strenuous regulatory exams and audits that have become a large part of their day-to-day life. Perhaps not surprisingly, according to our third annual report, “2019 IT Outlook for Community Banking,” compliance issues remain a big concern for these institutions, especially in terms of meeting examiner expectations. Financial institutions continue to struggle across critical areas such as: vendor management, business continuity planning, cybersecurity, audits, and exams. Risk assessments, which according to survey results, is a big struggle as 65% of respondents claim it is currently their greatest IT challenge.

Continuously changing interpretations of guidance that is already in place, along with new guidance, has made the exam process — starting with the preparation all the way through to accurate documenting steps taken to remediate findings — an extremely time-consuming and stressful endeavor.

Download the PDFThe 2019 IT Outlook for Community Banking Get a Copy

At the beginning of the exam process, the examiner typically sends a list of items they want to review; certain areas they plan to examine; and items they plan to discuss. This list normally includes a number of reports and documents the financial institution must prepare ahead of the review and subsequently provide to the reviewing agents before the on-site visit. While some exams only require a handful of reports to prepare up-front, others can request more than 60 different reports, including:

  • Organizational Charts
  • Financial Reports
  • Business Continuity Plans
  • Disaster Recover Plans and Test Results
  • Vendor Management Policies
  • Security Policies

In addition to gathering and preparing the reports and documents the examiner requests, there are certain steps banks and credit unions can do before the exams to help streamline the process, feel more confident and prepared, and better meet examiner expectations:

  1. Review All Relevant Guidance and Significant Changes

    2. The management team and compliance officers should familiarize themselves with all relevant guidance for their institution, and make sure they are up-to-date on any changes that might affect them. In addition, they should review recent significant changes to internal technology infrastructure, risk assessments for customer or member facing electronic banking services and as well as the financial institution’s cyber risk appetite statement.

  2. Review Previous Examination Reports 


    3. Review the previous exam reports for any comments or matters that required attention. It is critical that all exam findings from previous examinations be addressed, with corrective actions documented.

  3. Review Any Non-Finding Comments (If There Have Been Any)

    4. If the institution received any comments from the examiner that did not rise to the level of a finding, they should be prepared to discuss how (or if) the institution plans to address these items in the future. In some cases, management may decide these items do not require corrective actions. However, they should still be discussed, and any rationale (action or inaction) documented.

  4. Review the Compliance Plan

    5. Each financial institution needs to be able to show examiners how they identify, track and respond to compliance issues. Often referred to as a Compliance Management System (CMS), this typically includes everything from how they introduce new initiatives and new vendors, how they implement and manage the initiatives, and how they respond and prepare for expansions and organizational changes, to how they track audit and exam findings.

  5. Automate Compliance Tasks

    6. Finding the time to collect all the requested reports and adequately prepare for exams can be a challenge. In fact, 55% of survey respondents admit to struggling with finding the time to work and focus on compliance-related activities. This struggle has led banks and credit unions alike to search for a more efficient way to manage compliance tasks and leverage automation to manage compliance responsibilities. Approximately 33% of survey respondents outsource their compliance needs, and 59% have increased their compliance spending in the past 18 months.

Regardless of location and size, banks and credit unions are all subject to largely the same regulations. Working with a managed services provider who works exclusively with financial institutions and understands the unique challenges of the exam process, greatly increases the chances that you are not only prepared for an exam, but can confidently meet all examiner expectations both before, and after, the exam.

To gain more insights into the key challenges, goals and opportunities facing banks and credit unions today, please download the full report here.

21 Feb 2019
Identifying Top Priorities for 2019 - IT Outlook Survey
Banks, Compliance, Credit Unions, Security, Technology Christine Ray 0 comment

3 Top Challenges from the 2019 IT Outlook for Community Banking

Identifying Top Priorities for 2019 - IT Outlook Survey

For the third consecutive year, we surveyed community banks and credit unions to gain a better understanding of their current IT situation, top IT priorities and challenges, security and compliance issues as well as future technology investments on the horizon. Our third annual report, “2019 IT Outlook for Community Banking,” analyzes survey feedback from approximately 164 respondents representing a range of community banks and credit unions across the U.S. with asset sizes from less than $100 million to more than $1 billion.

This report is designed to offer community banks and credit unions with valuable peer data that can provide guidance for key IT, compliance and security decisions in 2019 and beyond. The data reinforces that community financial institutions continue to recognize the importance of using technology in the current banking environment and remain committed to investing in new technologies and services as needs evolve. However, they continue to face certain challenges, often related to technology, heading into 2019.

Here are some key IT challenges and trends from the survey results:

Information Security Continues to be the Top Challenge

According to 43% of survey respondents, information security continues to be a top challenge. Falling victim to security breaches and associated attacks is very costly for community banks and credit unions, both from a financial and reputational standpoint. According to Cybersecurity Ventures, the global cost of cybercrime damages will hit $6 trillion annually by 2021. This includes damage and destruction of data, theft of personal and financial data, and disruption to the normal business operations, among others. In addition, as the number of security threats continues to increase in the financial services industry, regulators are taking a closer look at financial institutions’ policies and procedures to ensure that they can effectively safeguard confidential and non-public information. All of this has led to 57% of respondents planning to strengthen and increase budgets for IT security solutions in 2019.

Personnel Expertise and Resources Becoming a Greater Concern

According to 42% of respondents, having the right personnel resources is now a top challenge for their financial institution. Managing an IT network is a very demanding responsibility. An IT administrator needs to truly understand the increasing complexity of IT operations, continuously changing regulatory requirements, FFIEC compliance guidelines, and evolving security threats. However, many community banks and credit unions are often located in areas that lack the qualified personnel resources to efficiently manage these responsibilities, making it financially challenging for them to employ the seasoned IT technology team required. This trend is encouraging community financial institutions to augment their IT departments with outsourced service providers who are able to help them navigate technology, security, and compliance required today.

Keeping Up With Changing Customer Expectations Continues to be a Challenge

Download the PDFThe 2019 IT Outlook for Community Banking Get a Copy

Approximately 42% of survey respondents claim that keeping up with changing customer expectations is their greatest challenge moving into the New Year. The advancement of technology, online banking services, compliance and regulatory requirements plus the growing demand from customers to have 24/7 access to their financial lives, have made the business of banking more challenging. This challenge has led to many institutions making additional technology investments in customer satisfaction or solutions to better meet market needs. According to 55% of survey respondents, this is the main reason or factor for making technology investments in the coming year. Customer satisfaction has become increasingly important and delivering a great customer experience is what gives banks and credit unions a competitive advantage.

Other areas of survey respondents mentioned as challenges include automating manual processes, managing budget restraints, eliminating redundant technology, remaining compliant with changing regulations, reporting and exam preparation, disaster preparedness, and providing secure mobile technology. This is the first year mobile technology was mentioned, but it is no surprise, as more and more consumers are turning to their mobile phones for basic banking tasks, such as depositing checks, checking their balances, and transferring money between accounts.

To gain more insights into the key challenges, goals and opportunities facing banks and credit unions today, please download the full report here.

© 2024 Safe Systems, Inc. All Rights Reserved. Privacy Policy