Back to Blog

What key processes in IT Controls does your institution have in place?

By Finosec

June 2, 2022

Get notified on new insights from Finosec now!

Be the first to know about new Finosec blogs to grow your knowledge of the cybersecurity governance industry today!

Managing Risk

Bankers are intrinsically good at managing risk. Credit quality, credit validation, and even loans all involve risk management. Cyber security and information security really aren’t all that different, but the processes can seem a bit more complicated. The CIS controls ties directly back to the 5 pillars of cybersecurity from the NIST framework. There are 18 macro controls around the higher concepts of cybersecurity that then taper off into 153 more specific, practical safeguards. They address items such as: 

  • How do we address user access and permissions? 
  • How can we be sure that we are protecting our infrastructure against malware? 
  • What are our backup defenses and redundancy plans? 

Control Maturity

From there, the controls are broken up into maturity, with the lowest level representing the basic cyber hygiene steps and the highest specifically crafted to help prevent and/or lessen attacks that are more sophisticated in nature. These groups can actually help you ask some vital, leading questions, such as: 

  • From a budgeting standpoint, what were we unable to implement that we should focus on moving forward? 
  • Did our implementation group maturity increase from our previous analysis? Why or why not? 

Assessing Risks and Gaps

You’ve likely realized by now that this framework is actually very similar to the cybersecurity assessment put out by the FFIEC. With this tool you can assess the inherent risk of your institution and then determine what steps can be taken to increase the domain maturity. By examining the controls, and the gaps therein, you can quickly determine what things need to be in place to answer the CAT accurately and ensure that you have reached the desired state of maturity for your institution. Ultimately, this is a circular, continual process, as you will always be evaluating where your institution sits as it evolves and grows, so revisiting the controls and the CAT will consistently be a focus.

IT Controls: Processes Video

If you would like to learn more about this foundational framework, check out this video from FINOSEC CEO and Co-Founder Zach Duke on the 5 Pillars of Cybersecurity.

More from Finosec

Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions

Integrating FFIEC Authentication Guidance: A Blueprint for Your Next Exam With Insights from Recent Regulatory Actions

The Federal Financial Institutions Examination Council (FFIEC) Authentication Guidance update in August 2021 has marked a significant step towards enhancing authentication and security access measures within financial institutions. This update expanded upon previous handbooks from 2005 and 2011, emphasizing a broader scope that now includes employees, third-party vendors, and system-to-system communications via APIs.

The Best Defense Against Ransomware

The Best Defense Against Ransomware

Beth Sumner, our VP of Customer Success, recently had the opportunity to discuss ransomware attacks and the importance of community bankers staying vigilant against these crimes in Independent Banker.  While the number of ransomware attacks continues to increase, so do the sums demanded by the attackers.

Succession Planning: Essential for Sustaining Information Security

Succession Planning: Essential for Sustaining Information Security

In today’s world where cyber threats evolve rapidly, the challenge of replacing an Information Security Officer (ISO) underscores a critical issue: the cybersecurity job market is scorching, yet talent is scarce. This gap has turned recruitment into a high-stakes game for financial institutions, where the departure of an ISO exposes vulnerabilities and regulatory risks. With remote work expanding the competition for skilled professionals, the importance of strategic succession planning has never been more acute, ensuring that institutions remain fortified even in the face of staffing changes.

Talk To An Expert Now
Talk To An Expert Now 770.268.2765