Category: Compliance

Financial institutions are governed by stringent regulations, including strict guidelines for the institution’s information security program. Institutions must undergo regular audits, both internal and external, to help ensure their control environment is sound and compliant. These audits ultimately help the institution prepare for when the examiners come knocking. Regulatory agencies conduct these IT exams to determine if the institution’s policies and procedures are sound, and if daily practices are in line with those standards. Rarely are these experiences fun or care-free.

The IT audit and examination processes can both be very time consuming and stressful for security officers, IT Administrators, and the institution’s executives. IT audits, while invaluable, may result in a laundry list of suggested improvements, most of which come with a price tag. Senior management must decide which suggestions are worth the investment and which constitute acceptable risk. Then, they must be able to defend that position to examiners.
Recent developments, including the FDIC’s introduction of the Information Technology Risk Examination (InTREx) Program, emphasize that it is not enough to have a solid Information Security Policy and procedures. Today’s examiners are requiring ever-increasing amounts of documentation as evidence that your institution is indeed doing what your policies and procedures promise. Financial institution IT professionals, already tasked with the full-time job of keeping systems up and running, are also asked to help the Information Security Officer gather volumes of documentation that make up this paper trail.

Without help, this regulatory burden can be a major challenge for smaller community banks and credit unions that lack the resources and experience to adequately meet ever-growing regulatory demands. However, there are some steps these smaller institutions can take to ease the stresses associated with this near-constant scrutiny.

Be Proactive – Conduct IT Self-assessments

To help ensure better results on bank IT audits and examinations, all financial institutions should complete periodic (quarterly) control self-assessments that enable management to gauge the state of IT performance, system status, and emerging risks. These proactive IT self-assessments are essential for ongoing monitoring of security controls and ensuring prompt corrective action of significant deficiencies. These regular reviews are not just beneficial, they are also mandatory. FFIEC guidance dictates that financial institutions perform regular self-assessments to “validate the adequacy and effectiveness of the control environment.”

At Safe Systems our strategic advisors work with each client to perform quarterly technology self-assessments. While this assessment helps the institution ensure all things related to IT network technology controls are working and up to date, it also serves as time for the strategic advisor to educate bank personnel on new or changing government regulations. This helps the bank to remain in compliance and sets the institution up for success in audits and exams.

Auditor feedback from our clients indicates that financial institutions that work with experienced IT outsourcing vendors and have an effective internal self-assessment process in place generally demonstrate a much more evolved risk management process and have a smoother IT audit. Simply put, this results in fewer, and less severe, audit findings. These institutions tend to identify, correct and control weaknesses prior to an audit, as opposed to waiting for the auditor to identify them. Since one of the first things the examiner wants to see when they arrive is the most recent IT audit, this often results in fewer examination findings as well.

7 Reasons Why Small Community Banks Should Outsource IT Network Management

This is a free white paper that addresses key issues smaller financial institutions face when managing their networks and the benefits of outsourcing these tasks.

Automate Reporting for IT Examinations

Documentation and reporting make up the paper trail that examiners are looking for to help validate your information security program. Being able to provide comprehensive reports that are easy-to-understand and provide clear and concise summary information is vital to any IT audit or exam. You may be asked for documentation on who is involved in technology reviews, frequency of meetings, minutes from each meeting, IT issues the bank is addressing, technology inventory management, patch management reports, testing policies and procedures, and disaster recovery plans, to name a few. These reports can be a time-consuming hassle to generate. However, with a financial institution specific reporting solution in place that automates the process and provides detailed on-demand reports, financial institutions can easily generate much of the appropriate documentation in a time efficient manner.

Preparing for an IT audit or exam can certainly be a headache! However, working with Safe Systems can provide your bank with peace of mind because by the time the examiner gets there, you are well prepared and can feel confident of the upcoming exam result. Safe Systems provides financial institutions with a trusted resource and technology advisor, leading to improved IT audit and examination ratings. With an experienced IT services provider, bankers can get back to the business of banking while compliance-oriented IT professionals work to ensure network components, servers and workstations are operating properly and securely; all while helping to ensure that your institution is meeting regulatory requirements.

To help ensure better results on bank audits and examinations, all financial institutions should complete periodic (generally quarterly) control self-assessments that allow management to gauge IT performance, system status, and emerging risks. These proactive self-assessments are key in providing ongoing monitoring of security controls and ensuring prompt corrective action of significant deficiencies. FFIEC guidance dictates that financial institutions perform regular self-assessments to “validate the adequacy and effectiveness of the control environment.”

Auditor feedback indicates that financial institutions with an effective internal self-assessment process in place generally demonstrate a much more evolved risk management process. Simply put, this results in fewer, and less severe, audit findings. This makes sense because these institutions tend to identify, correct, and control weaknesses prior to an audit, as opposed to waiting for the auditor to identify them. Since one of the first things the examiner wants to see when they arrive is the most recent audit, this often results in fewer examination findings as well.

Specific areas that should be reviewed in the assessment

• Network Compliance Reporting

  • Antivirus, Patch Management, Server Health and Warranty Analysis

• Network Security Reporting

• Vulnerability Assessment

• Policy and Procedure Verification

  • Vendor Management, Network/Internet, Information Security

• Regulatory Trends and Changes

• Site/Server Recovery and Disaster Recovery Plans

Expect support from your IT network management provider

Actually conducting the self-assessment can be a challenge, and requires a mix of regulatory and technical understanding. One way to improve this process is by working with an experienced IT network service provider who is knowledgeable in financial regulatory requirements. You should expect your account manager to help with every step of the self-assessment by providing structure, feedback, and an impartial outside perspective. This control self-assessment is also a time for the financial institution to share with account managers issues and pain points they have come across. This way the account manager is able to provide informed guidance, and help the bank utilize the right tools and procedures to adequately address any issues.

At Safe Systems our account managers work with each client to perform quarterly technology self-assessments. This assessment is a tool to help the institution ensure all things related to IT network technology controls are working and up to date. However, the self-assessment is more than a simple diagnostic procedure. This is a time for the account manager to educate bank personnel on new or changing government regulations, helping the bank to remain in compliance, and setting the institution up for success in audits and exams.

Regulatory compliance is always on a financial institution’s mind. Quarterly control self-assessments provide the bank with peace of mind, because by the time the examiner gets there, they have already had a trial run and feel well prepared and confident of the upcoming exam result. Working with Safe Systems provides financial institutions with a trusted resource and technology advisor, leading to improved audit and examination ratings!

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Let’s face it, managing multiple vendor relationships can be a headache! Today many financial institutions are looking to streamline their IT vendor relationships as much as possible and want vendors and core providers that will include all their products and services in a single contract. While that may seem nice and easy from a vendor management perspective, it increases risk with that vendor, which is against the FFIEC guidance regulations.

Understanding the Compliance Risks

In fact, earlier this year the FFIEC issued an update to the Business Continuity Handbook to help financial institutions in understanding and managing the risks associated with outsourcing a bank activity to a service provider. The new appendix, appendix J, entitled Strengthening the Resilience of Outsourced Technology Services, focuses on third-party oversight and cybersecurity, confirming that these two areas will come under ever-increasing scrutiny.

One-Stop Shops Increase Your Compliance Risks

While having one vendor to manage may seem like a good idea, putting all your eggs in one basket concentrates your risk factors. It is wiser to work with several vendors, which spreads out risk and does not force an institution to rely solely on one service provider. This can be a challenge if you work with a core vendor or processor that bundles all services together.

The intertwined relationship between the financial institution and the core processor that bundles all services makes it difficult for the institution to make IT changes and leaves little room for negotiation with their network monitoring services. The more services your institution has with core processors, the less you are able to negotiate on renewal pricing. In addition, if you switch core processors, you run the risk of being charged a fee for converting from one platform to another. If your financial institution’s internal network servers are intermixed with core banking servers and you decide to switch your core system, your IT network and IT management system will need to change or be modified.

A majority of core providers have acquired their IT network management provider. The acquired companies usually have a large cross section of core clients, but once acquired, these IT service providers are primarily interested in servicing and growing their core provider relationships. Core processors that build their own IT managed services internally often don’t have the experience and understanding of how to make other core systems run optimally with IT networks.

Working with an IT network management provider that is owned by a core banking software provider that is different from your bank’s core system is not a good long term strategic fit for your bank. The core-owned IT management services companies are focused on their company’s core banking systems. Their knowledge of other core systems will diminish over time, and their interest is really being in a one-stop shop for their core clients. There are often issues and finger pointing between a bank and its core provider over network issues and these situations will only be exacerbated by such a relationship.

Assessing Non-Compliance Risk and Minimize It

When determining your institution’s risk assessment when it comes to IT network management, some areas to think about are the timing of your bank’s core renewal, the likelihood your bank may change core processors, and the likelihood your bank may acquire another bank. In addition, track the year-over-year count of banks with your same core processing solution supported by your IT services provider.   If that number is going down, the risks of losing expertise specific to your institution’s configuration also goes down.

In order to avoid these pitfalls, it is important to separate IT network operations providers from your core system. Having separate support providers also strengthens the network from a security standpoint, increases flexibility and addresses the FFIEC vendor diversification issue. This separation provides you with the flexibility needed to make changes easily or independently, make the best decisions on internal network management, and not be tied to one vendor to manage IT network activities and core banking functions.

Dispelling 5 IT Outsourcing Myths within Financial Institutions

Learn why five of the most commonly believed “facts” about IT outsourcing within community financial institutions are actually myths.

Look around today’s financial institution and you’ll be hard-pressed to find a department that technology doesn’t touch. Most modern institutions are highly interconnected and dependent on their network infrastructure. In fact, technology is the lifeblood of the modern financial institution.

There is another sometimes overlooked area where technology can facilitate the financial institution’s success – compliance.

It is a full time job for community bank IT professionals to make sure the network is running, email is working, applications are up to date and patched, and all users have just enough access to the network resources needed to do their jobs. This doesn’t even include the extra time spent with auditors, examiners, and the Board to ensure procedures are documented and actual practices align with compliance standards.

While outsourcing some of these processes can alleviate most of the day-to-day pressure of administering and maintaining IT for a financial institution, it doesn’t absolve an institution of the oversight and documentation requirements necessary to ensure secure, up-to-date, and compliant operations.

Instead of being a daily chore, network monitoring, patch management, and troubleshooting can provide the foundation for the institution to build a better compliance posture. How? Automation and documentation.

There are three things examiners look for in a financial institution – written policies, written procedures and documented practices. Most institutions have the right policies and procedures in place but often maintain inadequate documentation of the work being performed; thus, they can tell an examiner they are adhering to appropriate compliance measures, but are not able to show thorough proof of that through documentation.

A typical community financial institution may have multiple software products to manage software patches, monitor network resources, and administer security and antivirus tools that keep machines safe from threats. Each of these systems requires different steps be taken to pull reports and provide the documentation needed to ensure adherence to policies and regulations. When making improvements that will significantly improve an institution’s ability to produce the documentation examiners are looking for the IT staff has two choices – manually pull all the necessary documentation from disparate systems, or build an internal process to centralize and automate it. Either way, an institution needs a certain amount of technology to be able to pull this off.

A centralized IT dashboard and reporting system can pull data and documentation from multiple systems and assemble the information. The right solution can automate the reporting process for bank examiners and bring critical documentation to your bank’s management team’s fingertips.

All those various systems your IT staff has to manage become one. A centralized and automated reporting system helps break down the silos that can make working with different reports from different systems so time consuming and difficult. Ultimately, a centralized IT reporting system can not only reduce administrative overhead, but also help improve your bank’s compliance posture.

Partnering with Safe Systems to co-manage your bank’s IT infrastructure ensures your financial institution will have the right technology in place to meet IT compliance requirements. With the right policies, procedures, practices, and the documentation to prove it, your financial institution will have the best opportunity to meet your examiner’s expectations. With automated systems and a centralized dashboard from which to monitor processes and generate reports, IT administrators can proactively ensure their institution maintains a strong compliance posture.

At Safe Systems we understand the ever-growing complexity of community financial institution IT operations and the enhanced regulatory requirements these institutions must meet. By making the decision to partner with Safe Systems, your organization will benefit from time saving automation and an in-depth view of your IT network environment. We want to provide you with assurance that your institution’s IT network is functioning efficiently, optimally, securely, and, most importantly, is compliant with FFIEC regulations.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

The FFIEC just issued new BCP Guidance in the form of a 16 page addendum to the existing 2008 IT Handbook on Business Continuity Planning. It is titled “Appendix J: Strengthening the Resilience of Outsourced Technology Services”, and it has significant implications for both the financial institution and the service provider across the entire business relationship.

Resiliency

It begins by stressing that although outsourced relationships with technology service providers (TSP’s) are an effective way for institutions to perform or support critical operations, the responsibility for overseeing these relationships resides with the Board and senior management. It focuses on these 4 key elements of resiliency:

1. Managing the continuity risks of critical third-party relationships.
2. Understanding the “concentration” risk when a third-party provides multiple services to you, or to multiple clients.
3. Validating BCP’s (theirs and yours) through testing.
4. Assuring that your BCP can accommodate a disruption caused by a cyber-event.

The third party management life-cycle begins prior to engaging the service provider, in the due diligence phase. At this point in the pre-contract stage, institutions should evaluate and thoroughly understand both the effectiveness of the vendor’s BCP, as well as the process the vendor uses to manage its subcontractors. Institutions should also make sure the vendors recovery time objectives (RTO’s) are in alignment with their own RTO’s for processes dependent upon vendor services. For example, if the institution has a 24 hour RTO for its teller processes, it must assure that any outsourced services required for those processes meet or exceed that RTO.

Important Contract Provisions

Once the decision is made to engage the service provider, a contract is the best way to define the obligations on both sides. Some important contract provisions are:

• The right-to-audit clause. This gives the institution the right to either audit the provider directly, or have access to any audit reports addressing the provider’s recovery capabilities. For most institutions, the ideal audit report to establish confidence in the resiliency of the provider is the SOC 2 report.
• Contractually defined service level agreements (SLA’s) relating to business continuity, such as clear recovery time and recovery point objectives.
• In the event that the service provider defaults or otherwise does not meet their contractual obligations, what are your potential remedies?
• If the vendor subcontracts, all contractual provisions (including SLA’s) must also apply to the subcontractor.
• Because foreign countries may have different data and information security standards, the contract must specify that any contractor based in a foreign country must agree to adhere to U.S. regulatory standards.
• The contract should specify BCP testing requirements for service providers, including test frequency, and the ability of the financial institution to periodically participate.
• Data governance, including data ownership, backup and handling during and after the relationship.
• Service providers must respond and adhere to all relevant regulatory guidance, and contracts should allow the institution to request those responses.
• Contracts must clearly specify how the provider addresses a security incident, including when and how the institution is notified.

Business continuity requirements and capabilities on both sides of the relationship will change over time, making on-going monitoring the critical last phase in the management life-cycle. Periodic summary reports should be presented to the appropriate management committee(s) and to the Board, and any material changes should be reflected in the institutions BCP and (if necessary) in the vendor contract.

Replacing Vendors

The guidance also requires institutions to consider the realization that a critical provider may not be able to fulfill its obligations, and may need to be replaced. This could occur over time, such as with a gradually deteriorating financial condition, or suddenly, because of a severe cyber-event or wide-spread disaster. Regardless of the circumstances, the institution must be prepared to minimize the impact and meet their internal recovery time objectives without the failed service provider. This means having a plan in place to either convert to a new service provider, or (as a last resort) to move the out-sourced operations in-house.

Testing with the third-party is given increased importance, and regulators will expect that institutions either participate in, or at the very least review the results of, service provider testing. Testing scenarios should include service provider outages, disruptions at the financial institution, cyber-events affecting either party, and cyber-attacks affecting both parties simultaneously. Test results should be presented to management committees and the Board for review, with a gap analysis and action plans for strengthening resiliency if necessary.

Cybersecurity

Finally, the guidance addresses the importance of preventing, mitigating, detecting, and responding to a cyber-event. Since the cybersecurity landscape is constantly changing, preparedness is the key to resiliency. This includes periodically updating and testing the institution’s incident response plan, and including the third-party in testing whenever possible. It also includes identifying potential third-party forensic and incident management service providers if necessary.

Driving Compliance Through Technology

Learn how automation and documentation can improve your financial
institution’s compliance posture

The implications of this guidance will be felt throughout the industry. Financial institutions will be expected to gain a much deeper understanding of provider recovery capabilities, which will require service providers to be much more transparent about all aspects of their business resiliency. Existing business continuity plans will require expansion to include more detailed information about recovery capabilities of critical service providers, including their RTO’s and RPO’s. Service provider contracts may need to be modified to include new expectations, and perhaps most significantly, institutions should understand much more about any vendor subcontracted relationships. Simply put, both the vendor and the financial institution must work more closely together across the entire spectrum of the relationship to ensure the optimal resiliency of the institution.