Skip to main content

Tougher Scrutiny on Cybersecurity at Banks in 2016

Philip R. Stein

Cybersecurity has been a focus as part of bank exams for years. Now the Federal Deposit Insurance Corp. (FDIC) is increasing its scrutiny of banks’ cybersecurity practices to ensure that the issue is getting appropriate attention from bank executives and boards. Bank regulators are planning to make cybersecurity a higher priority during bank exams as early as the second quarter of next year. The FDIC will revise its community bank examination program to break cybersecurity out as its own separate issue in examination comments.

Regulators want to ensure that there is an understanding of “cyber risk as it overlays into business decisions that you make at the board level,” an FDIC risk management official recently commented. Though outdated data security systems have typically been viewed as a “budget capital improvement” matter, the threat environment has changed. Now, the FDIC’s approach has changed along with it.

If an institution has a cyber-breach, “it will not be a capital event; it will be an operational event” and compared to a liquidity problem, according to the FDIC. The FDIC’s shift in approach follows the release of a cybersecurity assessment tool that was published by the Federal Financial Institutions Examination Council earlier this year. The tool maps to the National Institute of Standards and Technology’s cybersecurity framework and helps guide banks as they assess their cybersecurity defenses. It is voluntary, but examiners will be using it in the field when assessing banks.

“Use of the tool is optional, but in reality the bankers are saying that when the examiners come into their institutions that they are asking to see whether they have completed the self-assessment and asking to look at its contents,” said Pamela Perdue, executive vice president of regulatory operations at Continuity, a compliance management solutions provider for community banks.

Other changes to the bank exam process will include the addition of a questionnaire that a bank will get roughly three months before an exam. An institution will have two weeks to fill out the seven-page form, which will replace a phone call or interview that has been done in the past. The FDIC will also drop the 15-page IT officers’ questionnaire.

The FDIC is also working on similar changes to exams for third party service providers and creating an assessment tool for them. The agency wants banks to review their contracts with third party service providers and make sure the contracts and performance meet their expectations. This underscores how serious an issue cybersecurity has become to regulators, and the scrutiny that banks can face even when they receive IT related services from third-party providers.

The FDIC is in the process of finalizing the new exam program and once approved, a pilot test program will be used in selected offices in the first quarter of 2016 with implementation planned for mid-2016.

Related Practices
Speaking Engagement June 12, 2023
Judge Michael A. Hanzman participates in a panel titled Conversation on the Surfside Settlement Negotiation at the Greater Miami Jewish Federation Attorneys’ Division Program.
Client Alert May 31, 2023
Recent amendments to the Florida Telephone Solicitation Act combined with court developments involving the U.S. Telephone Consumer Privacy Act have made it more difficult for plaintiffs and potential plaintiffs to make claims under both federal and Florida law. Learn about how these developments wil...
Blog May 26, 2023
The regulatory authority of the U.S. Securities and Exchange Commission (“SEC”) over the cryptocurrency industry has recently been challenged on various accounts. A lawsuit filed by the SEC and, separately, a petition filed against the SEC are two examples of these recent events. The out...