What key processes in IT Controls does your institution have in place?

Managing Risk

Bankers are intrinsically good at managing risk. Credit quality, credit validation, and even loans all involve risk management. Cyber security and information security really aren’t all that different, but the processes can seem a bit more complicated. The CIS controls ties directly back to the 5 pillars of cybersecurity from the NIST framework. There are 18 macro controls around the higher concepts of cybersecurity that then taper off into 153 more specific, practical safeguards. They address items such as:

How do we address user access and permissions?

How can we be sure that we are protecting our infrastructure against malware?

What are our backup defenses and redundancy plans?

Control Maturity

From there, the controls are broken up into maturity, with the lowest level representing the basic cyber hygiene steps and the highest specifically crafted to help prevent and/or lessen attacks that are more sophisticated in nature. These groups can actually help you ask some vital, leading questions, such as:

From a budgeting standpoint, what were we unable to implement that we should focus on moving forward?

Did our implementation group maturity increase from our previous analysis? Why or why not?

Assessing Risks and Gaps

You’ve likely realized by now that this framework is actually very similar to the cybersecurity assessment put out by the FFIEC. With this tool you can assess the inherent risk of your institution and then determine what steps can be taken to increase the domain maturity. By examining the controls, and the gaps therein, you can quickly determine what things need to be in place to answer the CAT accurately and ensure that you have reached the desired state of maturity for your institution. Ultimately, this is a circular, continual process, as you will always be evaluating where your institution sits as it evolves and grows, so revisiting the controls and the CAT will consistently be a focus.

If you would like to learn more about this foundational framework, check out this video from FINOSEC CEO and Co-Founder Zach Duke on the 5 Pillars of Cybersecurity.

Why Management’s FDICIA Attestation Must Include an Understanding of Access Reviews

by Zach Duke | Dec 17, 2024

For financial institutions subject to FDICIA, the Federal Deposit Insurance Corporation Improvement Act, the annual management attestation is a critical declaration of compliance. It signifies that the institution’s internal controls over financial reporting (ICFR) are effective. One key control to validate is how user access reviews are performed.

Mastering Access Management: Best Practices for Effective User Access Reviews

by Zach Duke | Nov 25, 2024

Access management is a critical component of cybersecurity and compliance, especially for financial institutions where security expectations are paramount. The challenges surrounding permissions management, particularly during user access reviews, are increasing due to regulatory expectations and the complexity of banking applications. In this blog post, we’ll explore the regulatory expectations, common exam findings, and best practices that can help your organization manage user access effectively while adhering to the principle of least privilege – limiting user access to only the resources necessary to perform their job functions.

The Critical Link Between Third-Party Risk Management (TPRM) and Access Management

by Zach Duke | Nov 7, 2024

As highlighted in a recent article from the Federal Reserve, managing third-party relationships and the access associated with those relationships is a critical component of Third-Party Risk Management (TPRM). The associated access third party vendors have to banking systems is known as Access Management and is foundational for mitigating risks associated with third-party relationships. Access Management may be easy to overlook because it does not always reside with the same person or team as TPRM; making it difficult to provide critical oversight.

With increased regulatory focus, how should institutions be thinking of Access Management? Here are five steps your institution can take today to strengthen your third-party governance.

The Evolving Role of Access Management: What Financial Institutions Need to Know About the New FFIEC Guidance

by Beth Sumner | Oct 30, 2024

With all eyes focused on AI regulations and the sunset of the Cybersecurity Assessment Tool (CAT), the recently released FFIEC Development, Acquisition, and Maintenance (DA&M) has almost slid under the radar. However, this new booklet is a complete rewrite...

FFIEC Authentication Guidance: Are You Meeting the Expectation?

by Zach Duke | Oct 10, 2024

The FFIEC has updated their expectations for access management with the Authentication and Access to Financial Institution Services and Systems Guidance. This guidance expands beyond traditional customer authentication and places a significant emphasis on...

The Critical Foundation of Managing Access to Banking Systems

by Zach Duke | Sep 26, 2024

Managing access to banking systems has become increasingly complex as financial institutions navigate legacy reporting systems, API access, and cloud solutions. These challenges, along with the risks posed by unmanaged systems, emphasize the need for maintaining a...