Back to Blog

Recent Guidance on Authentication

By Finosec

September 16, 2021

Get notified on new insights from Finosec now!

Be the first to know about new Finosec blogs to grow your knowledge of the cybersecurity governance industry today!

The FFIEC has released an update titled “Authentication and Access to Financial Institution Services and Systems.” It ​​replaces two previously released FFIEC issued pieces: “Authentication in an Internet Banking Environment” released in 2005, and the “Supplement to Authentication in an Internet Banking Environment” released in 2011. The guidance has been expanded to include employees, third party vendors, and APIs with increased expectation in regards to controls and risk management. This update is clearly focused on an understanding of the threat landscape, having a current risk assessment, ensuring layered security, and a general increase in authentication implementation. Take a few minutes to watch Finosec President and CEO Zach Duke unpack this information.

Here are some of the key components of this guidance and some first steps on understanding how it can apply to you.  

First, it is important that you have a current inventory of information systems, digital banking services, and customers. Next, you’ll want to identify which customers and users should be classified as high risk, based on transactions and role/responsibility respectively. This high-risk identification, coupled with the inventory, are a great place to start ensuring that you are on track with risk assessment best practices. Finally, these elements will also provide clear direction on how to best implement layered security, which users should have MFA enforced, and more. In short, the risk management construction will trickle down into other areas of authentication implementation. 

If you would like to read this new guidance in its entirety, you can download the PDF by signing up for Finosec Academy. Simply visit to get signed up and find the PDF along with plenty of other updates surrounding cybersecurity. Don’t hesitate to reach out to Finosec if you have questions or concerns about this guidance! 

Finosec’s User Access reporting directly addresses this guidance! To learn more simply visit

More from Finosec

Partnering for Peace of Mind and Effective Oversight

Partnering for Peace of Mind and Effective Oversight

Pendleton Community Bank, a $700 Million Dollar Bank with 133 Employees in Franklin, WV, led by CEO Bill Loving, faced a critical challenge when their Information Security Officer departed, leaving a significant void in their oversight capabilities. Their goal was clear: establish an effective process for information security governance and cybersecurity oversight to ensure compliance and peace of mind.

Talk To An Expert Now
Talk To An Expert Now 770.268.2765