The Federal Financial Institutions Examination Council (FFIEC) has recently developed a new tool to help U.S. financial institutions combat the increasing volume and sophistication of cyber attacks. To blunt threats to a financial institution’s computers, computer systems, electronic communications network and infrastructure, the FFIEC’s June 2015 Cybersecurity Assessment Tool is designed to help financial institutions identify their cybersecurity risks and determine their cybersecurity “maturity” across five “domains”.
The Cybersecurity Assessment Tool is consistent with FFIEC’s IT Examination Handbook, the National Institute of Standards Cybersecurity Framework, and industry accepted cybersecurity practices. The Tool provides institutions with a process to inform management about the institution’s risks and cybersecurity preparedness—thereby affording management the ability to adjust their institution’s risk profile and preparedness to appropriate levels.
The Tool is designed to serve as a measurable and repeatable assessment process and consists of two parts: [1] Inherent Risk Profile—the institution’s inherent risks before implementing controls; and [2] Cybersecurity Maturity—the institution’s current state of cybersecurity preparedness for each of the following “domains”: Cyber Risk Management and Oversight; Threat Intelligence and Collaboration; Cybersecurity Controls; External Dependency Management; and Cyber Incident Management and Resilience.
By reviewing the Inherent Risk Profile and the Maturity levels across the five domains initially and periodically (as significant operational and technological changes occur), management should be better equipped to either reduce the levels of risk or increase the level of controls in each of the domains. FFIEC makes note of the fact that the Tool is intended to complement, not replace, an institution’s risk management process and cybersecurity program.
FFIEC membership is comprised of the principals of the Federal Reserve Board, FDIC, NCUA, OCC, CFPB, and State Liaison Committee.