Financial Services

“FRFIs should establish and maintain an Enterprise Disaster Recovery Program (EDRP) to support its ability to deliver technology services through disruption and operate within its risk tolerance.”

“FRFIs should align the disaster recovery program with its business continuity management program.”

“FRFIs should manage key dependencies required to support the EDRP, such as: Information security requirements for data security and storage (e.g., encryption); and, Location of technology asset centres, backup sites, service provider locations and proximity to primary data centre”

“FRFIs should regularly validate and report on their disaster recovery strategies, plans and/or capabilities against severe but plausible scenarios...The FRFI's backup and recovery capabilities and processes to validate resiliency strategies, plans and actions, and confirm the org”

“Critical third-party technologies and integration points with upstream and downstream dependencies, including both on- and off-premises technology.”

“These scenarios should be forward-looking and consider, where appropriate: New and emerging risks or threats; Material changes to business objectives or technologies; Situations that can lead to prolonged outage; and, Previous incident history and known technology complexities or”

“FRFIs should define standards and implement processes for incident and problem management. Standards should provide an appropriate governance structure for timely identification and escalation of incidents, restoration and/or recovery of an affected system, and investigation and ”

“Developing and implementing incident response procedures that mitigate the impacts of incidents, including internal and external communication actions that contain escalation and notification triggers and processes...Establishing and periodically testing incident management proce”

“Performing periodic testing and exercises using plausible scenarios in order to identify and remedy gaps in incident response actions and capabilities; Conducting periodic exercises and testing of incident management process, playbooks, and other response tools (e.g., coordinatio”

“FRFIs should develop problem management processes that provide for the detection, categorization, investigation and resolution of suspected incident cause(s). Processes should include post-incident reviews, root cause and impact diagnostics and identification of trends or pattern”

“Using a risk-based approach, systems and associated infrastructure should be designed and implemented to achieve availability, scalability, security (Secure-by-Design) and resilience (Resilience-by-Design), commensurate with business needs.”

“Documented interdependencies between critical technology assets, where appropriate, to enable proper change and configuration management processes, and to assist in response to security and operational incidents, including cyber attacks.”

“FRFIs should continuously monitor the currency of software and hardware assets...It should proactively implement plans to mitigate and manage risks stemming from unpatched, outdated or unsupported assets and replace or upgrade assets before maintenance ceases.”

“FRFIs should ensure that changes to technology assets in the production environment are documented, assessed, tested, approved, implemented and verified in a controlled manner...The standard should also define emergency change and control requirements to ensure that such changes ”

“FRFIs should establish technology service management standards with defined performance indicators and/or service targets that can be used to measure and monitor the delivery of technology services. Processes should also provide for remediation where targets are not being met.”

“FRFIs should define performance and capacity requirements with thresholds on infrastructure utilization. These requirements should be continuously monitored against defined thresholds to ensure technology performance and capacity support current and future business needs.”

“FRFIs should establish a cyber incident response team with tools and capabilities available on a continuous basis to rapidly respond, contain and recover from cyber security events and incidents that could materially impact the FRFI's technology assets, customers and other stakeh”

“FRFIs should maintain a cyber security incident management process and playbooks to enable timely and effective management of cyber security incidents.”

“FRFIs should ensure the alignment and integration between their cyber security, technology, crisis management and communication protocols. This should include capabilities to enable comprehensive and timely escalation and stakeholder coordination (internal and external) in respon”

“FRFIs should conduct a forensic investigation for incidents where technology assets may have been materially exposed. For high-severity incidents, the FRFI should conduct a detailed post-incident assessment of direct and indirect impacts...including a root cause analysis to ident”

“FRFIs should ensure continuous security logging for technology assets and different layers of defence tools...FRFIs should implement minimum security log retention periods and maintain cyber security event logs to facilitate a thorough and unimpeded forensic investigation of cybe”

“FRFIs should proactively identify, defend, detect, respond and recover from external and insider cyber security threats, events and incidents to maintain the confidentiality, integrity and availability of its technology assets.”

“FRFIs should employ enhanced controls and functionality to rapidly contain cyber security threats, defend its critical technology assets and remain resilient against cyber attacks...Designing application controls to contain and limit the impact of a cyber attack.”

“Technology and cyber risk appetite and measurement (e.g., limits, thresholds and tolerance levels)...Management of unique risks posed by emerging threats and technologies...Reporting to Senior Management on technology and cyber risk appetite measures, exposures and trends.”

“Critical operations should be identified and assessed for their ability to withstand disruptions... Once identified, critical operations should be mapped for internal and external dependencies.”

“Tolerances for disruption should set out the maximum level of disruption a financial institution can withstand across a range of severe but plausible scenarios.”

“Regular scenario testing improves understanding of when tolerances for disruption would be breached... a variety of testing methodologies should be used, including table-top exercises, simulations, and live-systems testing.”

“A business impact analysis assesses the risks and potential impacts of a range of disruptive events on operations. It should identify and measure: The impact of disruptions. The maximum limits on recovery objectives before severe consequences or losses occur.”

“Business continuity plans set out the response and recovery actions for a range of potential threats... This should include: Establishing protocols for invoking the plan... Defining roles and responsibilities... Setting targets for recovery levels and times.”

“Business continuity plan tests should provide reasonable assurance that plans are effective... Tests should consider a range of severe but plausible circumstances, including scenarios with disruptions that: Are long in duration. Are simultaneous in nature. Involve critical third ”

“A crisis management plan should be established that ensures effective, coordinated, and timely responses to potential crises... It should include: Protocols for escalation to senior management and the board. Criteria for invoking the plan. Internal and external communications pro”

“A crisis management team can help ensure effective communication, expedited recovery, and an effective response to the crisis.”

“Business continuity risk management is the process of planning for, and recovering from, disruptions to operations. It should be integrated with and strengthen operational resilience. Over time, its focus should evolve from business processes to critical operations end to end.”

“Staff should be provided with training on business continuity plans, including their activation and how operations will be managed during disruption.”

“Where a third party is identified as critical, sufficient information should be obtained to assess its resilience... The financial institution should also coordinate with critical third parties, where possible, to conduct broader exercises.”

“Critical third parties should also demonstrate robustness in their own business continuity plans and testing. There should be processes to address gaps identified during testing, as well as contingency plans for critical third parties.”

“It should also comprise a specific data risk management framework that includes a data risk management strategy and program... Processes for escalating and responding to data breaches and other data-related incidents.”

“Effective data risk management ensures that data is accurate, complete, timely, secure, and protected... Methodologies for ensuring the integrity, adaptability, confidentiality, and availability of data throughout its lifecycle.”

“A critical technology failure, infiltration, or loss of data can result in wide-scale disruption impacting operations. Sound technology and cyber risk management is fundamental to bolstering operational resilience.”

“Threats to operational resilience can arise from critical third-party arrangements, including disruption at the third party or the loss or corruption of critical data. Accordingly, effective third-party risk management is an important contributor to operational resilience.”

“Scenario analysis should be conducted using appropriate techniques at both the business unit and enterprise-wide levels and incorporate a range of severe but plausible scenarios... Scenario analysis results may be used to inform operational resilience scenario testing.”

“Senior management and the board of directors should also receive the results of scenario analysis... and scenario testing... This should include: Analysis of deficiencies. An assessment of operational resilience, and whether critical operations can be maintained within establishe”

“Ensuring breaches of tolerances for disruption are appropriately escalated and addressed.”

“Deploy tested contingency plans in the event a change fails. Test the change on systems and processes before introducing it.”

“Ongoing monitoring should be conducted to help prepare for, and respond to, changes in operational risks. It should assess adherence to the operational risk appetite statement and operational risk limits, as well as tolerances for disruption.”

“Operational risk event data exceeding established limits should be captured to assess: What the root cause of the operational risk event is... What corrective measures ought to be taken to address deficiencies or control failures.”

“The independent risk and compliance functions oversee and challenge the risk and resilience activities... Internal audit or a similar function should provide independent assurance to senior management and the board of directors that operational risk management controls, policies ”

“Lessons-learned exercises should be undertaken following a crisis and incorporated into the plan. The crisis management plan should be regularly tested and shared with the relevant business units in the financial institution and any impacted external parties, as appropriate.”

“Addresses a comprehensive set of third-party risks within an expanded third-party ecosystem, placing emphasis on governance and risk management programs and setting outcomes-focused, principles-based expectations”

“apply the Guideline in a manner that is proportionate to the level of risk and criticality of each arrangement and to the size, nature, scope, complexity, and risk profile of the FRFI”

“FRFIs managing subcontractor risk according to the level of risk and criticality of the given third-party arrangement”

“taking reasonable steps to manage concentration risks related to their own third-party arrangements”

“assessing systemic concentration risk to the greatest extent possible”

“third-party arrangements commencing on or after the effective date adhere to the guideline”

“those entered into prior are being reviewed and updated at the earliest opportunity so that they adhere to the guideline by its effective date or as soon as possible thereafter”

“"Cybersecurity program" means the policies, procedures, and practices that protect personal information from unauthorized access, destruction, use, modification, or disclosure; and protect against unauthorized activity resulting in the loss of availability of personal information”

“"Cybersecurity audit report" means the document that every business must create as part of its cybersecurity audit. The cybersecurity audit report includes the information set forth in section 7123, subsection (e).”

“"Penetration testing" means testing the security of an information system by attempting to circumvent or defeat its security features by authorizing attempted penetration of the information system.”

“"Privileged account" means any authorized user account or service account that can be used to perform functions that other user accounts are not authorized to perform, including but not limited to the ability to add, change, or remove other accounts, or make configuration changes”

“"Information system" means the resources (e.g., network, hardware, and software) organized for the processing of personal information or that can provide access to personal information. The business's information system includes the resources organized for the business's processi”

“shall be taken into account when ensuring compliance with those requirements.”

“shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use.”

“shall be designed and developed in such a way that they achieve an appropriate level of accuracy, robustness, and cybersecurity, and that they perform consistently in those respects throughout their lifecycle.”

“shall assign a rank to each ICT third-party service provider.”

“shall use the templates set out in Annex I to IV to maintain and update the register of information in accordance with Article 28(3) of Regulation (EU) 2022/2554, at entity level, or at sub-consolidated and consolidated level.”

“shall include in the register of information, in accordance with the instructions set out in Annex I, the following information: (a) general information on the financial entity maintaining and updating the register of information at entity, sub-consolidated and consolidated level”

“shall assess whether any financial entity is required to perform TLPT, taking into account the impact of those financial entities, their systemic character and their ICT risk profile, on the basis of all of the following criteria: (a) impact-related and systemic character related”

“shall assign the responsibility for coordinating TLPT-related activities to a TCT.”

“shall appoint a control team lead which shall be responsible for the day-to-day management of the TLPT and the decisions and actions of the control team.”

“shall assess the risks associated with the testing of live production systems of critical or important functions of the financial entity, including potential impacts on: (a) the financial sector;”

“shall conduct its own risk assessment and establish its own risk management measures.”

“shall take measures to manage the risks relating to the TLPT and shall in particular ensure that, for each TLPT: (a) the threat intelligence provider and external testers provide the control team with a detailed curriculum vitae and copies of certifications that, according to rec”

“shall follow each of the steps set out in Articles 9 to 15.”

“shall initiate a TLPT following a notification from the TLPT authority that a TLPT is to be carried out.”

“shall analyse generic and sector-specific threat intelligence relevant for the financial entity.”

“shall prepare the red team test plan that shall contain the information set out in Annex IV.”

“shall provide the remediation plans and the documentation referred to in Article 26(6) of Regulation (EU) 2022/2554 to the TLPT authority and, where different, to the financial entity’s competent authority.”

“shall establish all of the following arrangements for the use of internal testers: (a) the establishment and implementation of a policy for the management of internal testers in a TLPT;”

“shall measure the duration of an incident as referred to in Article 18(1), point (b), of Regulation (EU) 2022/2554, from the moment the incident occurs until the moment when it is resolved.”

“shall assess whether the incident has or had an impact in other Member States, and in particular the significance of the impact in relation to any of the following: (a) clients and financial counterparts in other Member States;”

“shall take into account the following: (a) in relation to the availability of data, whether the incident has rendered the data on demand by the financial entity, its clients or its counterparts temporarily or permanently inaccessible or unusable;”

“shall assess whether the incident: (a) affects or has affected ICT services or network and information systems that support critical or important functions of the financial entity;”

“shall be considered a major incident for the purposes of Article 19(1) of Regulation (EU) 2022/2554 where it has affected critical services as referred to in Article 6 and where either of the following conditions is fulfilled: (a) the materiality threshold referred to in”

“shall be considered as one major incident where they meet all of the following conditions: (a) they have occurred at least twice within 6 months;”

“shall be considered significant where all of the following conditions are fulfilled: (a) the cyber threat, if materialised, could affect or could have affected critical or important functions of the financial entity, or could affect other financial entities, third-party providers”

“shall be based on whether the incident has a root cause originating from another Member State or whether the incident has or has had a significant impact in another Member State in relation to any of the following: (a) clients or financial counterparts;”

“shall contain the same level of information, without any anonymisation, as the notifications and reports of major incidents received from financial entities in accordance with Article 19(4) of Regulation (EU) 2022/2554.”

“shall take into account the size and the overall risk profile of the financial entity, and the nature, scale and elements of increased or reduced complexity of its services, activities and operations, including elements relating to: (a) the type of ICT services included in the co”

“shall ensure that the policy is implemented consistently in all financial entities that are part of the group and is adequate for the effective application of this Regulation at all relevant levels of the group.”

“shall review the policy at least once a year and update it where necessary.”

“shall specify the requirements, including the rules, the responsibilities and the processes, for each main phase of the lifecycle of the contractual arrangement, covering at least the following: (a) the responsibilities of the management body, including its involvement, as approp”

“shall require that the business needs of the financial entity are defined before a contractual arrangement is concluded.”

“shall specify that the relevant contractual arrangement are to be in written form and are to include all the elements referred to in Article 30(2) and (3) of Regulation (EU) 2022/2554.”

“shall require that the contractual arrangements specify the measures and key indicators to monitor, on an ongoing basis, the performance of ICT third party service providers, including measures to monitor compliance with requirements regarding the confidentiality, availability, i”

“shall contain requirements for a documented exit plan for each contractual arrangement and for the periodic review and testing of the documented exit plan.”

“shall be taken into account, including elements relating to: (a) encryption and cryptography;”

“shall ensure that their ICT security policies, information security, and related procedures, protocols, and tools as referred to in Article 9(2) of Regulation (EU) 2022/2554 are embedded in their ICT risk management framework.”

“shall develop, document, and implement ICT risk management policies and procedures that shall contain all of the following: (a) an indication of the approval of the risk tolerance level for ICT risk established in accordance with Article 6(8), point (b), of Regulation (EU) 2022/2”

“shall develop, document, and implement a policy on management of ICT assets.”

“shall develop, document, and implement a procedure for the management of ICT assets.”

“shall process data in use in a separated and protected environment, or take equivalent measures to ensure the confidentiality, integrity, authenticity, and availability of data.”

“shall adopt mitigation and monitoring measures that ensure resilience against cyber threats.”

“shall develop, document, and implement policies and procedures to manage the ICT operations.”

“shall develop, document, and implement vulnerability management procedures.”

“shall develop, document, and implement a data and system security procedure.”

“shall, as part of the safeguards against intrusions and data misuse, develop, document, and implement logging procedures, protocols and tools.”

“shall, as part of the safeguards ensuring the security of networks against intrusions and data misuse, develop, document, and implement policies, procedures, protocols, and tools on network security management, including all of the following: (a) the segregation and segmentation ”

“shall develop, document and implement a policy governing the acquisition, development, and maintenance of ICT systems.”

“shall include in the ICT change management procedures referred to in Article 9(4), point (e), of Regulation (EU) 2022/2554, in respect of all changes to software, hardware, firmware components, systems, or security parameters, all of the following elements: (a) a verification of ”

“shall specify, document, and implement a physical and environmental security policy.”

“shall include in their human resource policy or other relevant policies all of the following ICT security related elements: (a) the identification and assignment of any specific ICT security responsibilities;”

“shall develop, document, and implement an ICT-related incident policy through which they shall: (a) document the ICT-related incident management process referred to in Article 17 of Regulation (EU) 2022/2554;”

“shall be considered a sector-specific Union legal act for the purposes of”

“shall have in place an internal governance and control framework that ensures an effective and prudent management of ICT risk, in accordance with”

“shall define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework referred to in Article 6(1).”

“shall use and maintain updated ICT systems, protocols and tools that are: (a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the proportionality principle as referred to in Article 4;”

“shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk.”

“shall continuously monitor and control the security and functioning of ICT systems and tools and shall minimise the impact of ICT risk on ICT systems through the deployment of appropriate ICT security tools, policies and procedures.”

“shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure.”

“shall put in place a comprehensive ICT business continuity policy, which may be adopted as a dedicated specific policy, forming an integral part of the overall business continuity policy of the financial entity.”

“shall have in place capabilities and staff to gather information on vulnerabilities and cyber threats, ICT-related incidents, in particular cyber-attacks, and analyse the impact they are likely to have on their digital operational resilience.”

“shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.”

“shall, through the Joint Committee, in consultation with the European Union Agency on Cybersecurity (ENISA), develop common draft regulatory technical standards in order to: (a) specify further elements to be included in the ICT security policies, procedures, protocols and tools ”

“shall not apply to small and non-interconnected investment firms, payment institutions exempted pursuant to Directive (EU) 2015/2366;”

“shall define, establish and implement an ICT-related incident management process to detect, manage and notify ICT-related incidents.”

“shall classify ICT-related incidents and shall determine their impact based on the following criteria: (a) the number and/or relevance of clients or financial counterparts affected and, where applicable, the amount or number of transactions affected by the ICT-related incident, a”

“shall take into account the criteria set out in Article 4(2), as well as international standards, guidance and specifications developed and published by ENISA, including, where appropriate, specifications for other economic sectors.”

“shall notify the competent authority about it via alternative means.”

“shall prepare a joint report assessing the feasibility of further centralisation of incident reporting through the establishment of a single EU Hub for major ICT-related incident reporting by financial entities.”

“shall, upon receipt of the initial notification and of each report as referred to in Article 19(4), acknowledge receipt and may, where feasible, provide in a timely manner relevant and proportionate feedback or high-level guidance to the financial entity, in particular by making ”

“shall also apply to operational or security payment-related incidents and to major operational or security payment-related incidents, where they concern credit institutions, payment institutions, account information service providers, and electronic money institutions.”

“shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.”

“shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning so”

“shall carry out at least every 3 years advanced testing by means of TLPT.”

“shall contract external testers every three tests.”

“shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: (a) financial entities that have in place contractual arrangements for the use of ICT”

“shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of the most up-to-date and highest quality information security standards.”

“shall be clearly allocated and set out in writing.”

“shall: (a) designate the ICT third-party service providers that are critical for financial entities, following an assessment that takes into account the criteria specified in paragraph 2;”

“shall conduct the oversight of the assigned critical ICT third-party service providers and shall be, for the purposes of all matters related to the oversight, the primary point of contact for those critical ICT third-party service providers.”

“shall adopt a clear, detailed and reasoned individual oversight plan describing the annual oversight objectives and the main oversight actions planned for each critical ICT third-party service provider.”

“shall have the following powers in respect of the critical ICT third-party service providers: (a) to request all relevant information and documentation in accordance with Article 37;”

“shall conclude administrative cooperation arrangements with the relevant authority of the third country in order to enable the smooth conduct of inspections in the third country concerned by the Lead Overseer and its designated team for its mission in that third country.”

“shall define the conditions for participation and, where appropriate, shall set out the details on the involvement of public authorities and the capacity in which they may be associated to the information-sharing arrangements, on the involvement of ICT third-party service provide”

“shall be ensured by the following competent authorities in accordance with the powers granted by the respective legal acts: (a) for credit institutions and for institutions exempted pursuant to Directive 2013/36/EU, the competent authority designated in accordance with Article 4 ”

“shall cooperate closely with each other and exchange information to carry out their duties pursuant to Articles 47 to 54.”

“recover from Cybersecurity Events and restore normal operations and services”

“systems operations and availability concerns”

“incident response”

“designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the Covered Entity”

“audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations”

“the availability and effectiveness of controls to protect Nonpublic Information and Information Systems”

“qualified cybersecurity personnel...sufficient to manage the Covered Entity's cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.2(b)(1)-(6)”

“periodic assessment of such Third Party Service Providers based on the risk they present and the continued adequacy of their cybersecurity practices”

“notice to be provided to the Covered Entity in the event of a Cybersecurity Event directly impacting the Covered Entity's Information Systems or the Covered Entity's Nonpublic Information being held by the Third Party Service Provider”

“written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting...the continuing functionality of any aspect of the Covered Entity's business or operations”

“the definition of clear roles, responsibilities and levels of decision-making authority”

“external and internal communications and information sharing”

“identification of requirements for the remediation of any identified weaknesses in Information Systems and associated controls”

“documentation and reporting regarding Cybersecurity Events and related incident response activities”

“the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event”

“no event later than 72 hours from a determination that a Cybersecurity Event has occurred...Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operation(s) of the Covered Entity”

“no event later than 72 hours from a determination that a Cybersecurity Event has occurred...Cybersecurity Events impacting the Covered Entity of which notice is required to be provided to any government body, self-regulatory agency or any other supervisory body”

“monitoring and testing, developed in accordance with the Covered Entity's Risk Assessment, designed to assess the effectiveness of the Covered Entity's cybersecurity program...annual Penetration Testing...bi-annual vulnerability assessments”

“maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the Covered Entity's Information Systems”

“respond to identified or detected Cybersecurity Events to mitigate any negative effects”

“minimum cybersecurity practices required to be met by such Third Party Service Providers in order for them to do business with the Covered Entity”

“All documentation and information relevant to the Covered Entity's cybersecurity program shall be made available to the superintendent upon request”

“maintain for examination by the Department all records, schedules and data supporting this certificate for a period of five years...document the identification and the remedial efforts planned and underway”

“vendor and Third Party Service Provider management”

“Covered Entities should address AI-related risks in the following areas: the organization's own use of AI, the AI technologies utilized by TPSPs and vendors, and any potential vulnerabilities stemming from AI applications that could pose a risk to the confidentiality, integrity, ”

“The Cybersecurity Regulation requires Risk Assessments to be updated at least annually and whenever a change in the business or technology causes a material change to a Covered Entity's cybersecurity risk to ensure new risks, including those posed by AI, are assessed.”

“One of the most important requirements for combatting AI-related risks is to maintain TPSP policies and procedures that include guidelines for conducting due diligence before a Covered Entity uses a TPSP that will access its Information Systems and/or NPI.”

“Covered Entities should require TPSPs to provide timely notification of any Cybersecurity Event that directly impacts the Covered Entity's Information Systems or NPI held by the TPSP, including threats related to AI.”

“Covered Entities must have a monitoring process in place that can identify new security vulnerabilities promptly so remediation can occur quickly.”

“Covered Entities must monitor the activity of Authorized Users as well as email and web traffic to block malicious content and protect against the installation of malicious code on their Information Systems.”

“As of November 2025, the Cybersecurity Regulation will require MFA to be in place for all Authorized Users attempting to access Covered Entities' Information Systems or NPI, including customers, employees, contractors, and TPSPs.”

“The controls must limit an Authorized User's access privileges to only those necessary for that Authorized User's job functions, and limit the number of Authorized Users with elevated permissions and access to NPI.”

“Covered Entities should maintain and update data inventories as they are crucial for assessing potential risks and ensuring compliance with data protection regulations. Data inventories further help entities track NPI so that if there is a breach, they know what NPI may have been”

“Entities should identify all Information Systems that use or rely on AI, including, if applicable, the Information Systems that maintain, or rely on, AI-enabled products and services... and prioritize implementing mitigations for those systems that are critical for ongoing busine”

“Entities should implement data governance procedures that include data collection, storage, processing, and disposal. Moreover, if an entity uses AI or relies on a product that uses AI, controls should be in place to prevent threat actors from accessing the vast amounts of data m”

“Covered Entities must now provide at least annual cybersecurity awareness training that includes social engineering. Training on social engineering, including on deepfake attacks, can be effectively delivered through simulated phishing, and voice and video impersonation exercises”

“If deploying AI directly, or working with a TPSP that deploys AI, relevant personnel should be trained on how to secure and defend AI systems from cybersecurity attacks, and how to design and develop AI systems securely.”

“The Cybersecurity Regulation requires the Senior Governing Body to have sufficient understanding of cybersecurity-related matters (including AI-related risks), exercise oversight of cybersecurity risk management, and regularly receive and review management reports about cybersecu”

“DFS strongly recommends Covered Entities consider, among other factors, the threats facing TPSPs from the use of AI and AI-enabled products and services; how those threats, if exploited, could impact the Covered Entity; and how the TPSPs protect themselves from such exploitation.”

“our rules only require firms to identify their important business services for the purposes of operational resilience”

“firms will need to review their important business services at least once per year, or whenever there is a material change to their business or the market in which they operate”

“firms should set their impact tolerances at the first point at which a disruption to an important business service would cause intolerable levels of harm to consumers or risk to market integrity”

“we are proceeding as consulted to require that firms use time/duration as a mandatory metric to measure their impact tolerances”

“firms should set and review their impact tolerances at least once per year or if there is a relevant change to the firm's business or the market in which it operates”

“Firms must be able to remain within their impact tolerances as soon as reasonably practicable, but no later than 3 years after the rules come into effect on 31 March 2022”

“firms have a clear picture of the resources that enable an important business service to function... by identifying and documenting the people, processes, technology, facilities and information that support them”

“internal processes... which are necessary to the provision of important business services and should be captured by firms as part of their mapping exercises”

“firms need to test their impact tolerances in a range of severe but plausible scenarios. This approach will give firms a clear idea when they initially test their impact tolerances of where such unexpected events may mean they cannot remain within tolerance”

“multiple important business services could be disrupted simultaneously due to an external factor directly affecting the service. For example, this could be due to a cyber-attack which hits a wide range of operational assets”

“for substitute services which rely on the same systems, processes or people, firms should not assume, as part of their testing plans, that these services won't be affected in the event of disruption”

“firms need to understand which staff are pivotal to delivering an important business service, with contingency plans if those staff become incapacitated”

“if despite extensive scenario testing a firm finds itself not able to remain within impact tolerance for any reason, it should report the issue to the FCA in line with SYSC 15A.2.11G”

“firms should consider such circumstances in their testing plans and report any issue with remaining in tolerance to the FCA in line with SYSC 15A.2.11G”

“When a firm is using a third-party provider in the provision of important business services, it should work effectively with that provider to set and remain within impact tolerances. Ultimately, the requirements... remain the responsibility of the firm”

“the pandemic highlighted increasing dependence on third parties and outsourcing arrangements... some firms experienced challenges with offshore third-party providers... which affected continuity of service to UK consumers”

“some firms experienced challenges with offshore third-party providers, particularly where providers were under lockdown in another geographical location, which affected continuity of service”

“users of the service should be identifiable so that the impacts of disruption (through process, cyber security or technology failures) are clear”

“Consideration of the needs of vulnerable consumers is central to a firm's setting of an impact tolerance, and firms should consider these groups when considering how much disruption could be tolerated. Firms should also construct communications and alternative mechanisms to minim”

“For dual-regulated firms, we maintain the position that these firms should set up to 2 impact tolerances. This is to ensure that firms consider their impact tolerances in line with the statutory objectives of each authority”

“its recovery and response arrangements are also appropriate for the longer tolerance (ie recovery and response arrangements must be viable for both shorter and longer time periods)”

“In situations where an entity sets an impact tolerance at a lower level than that set by the group, the group's Board should consider and approve... and ensure that the entity has appropriate resources to meet its identified tolerance”

“firms should consider whether (a) the degraded service can safely resume without causing further detriment and (b) the benefits of resuming a degraded service outweigh the negatives of keeping the service unavailable until the issues have been remediated”

“payments firms only have to apply our operational resilience proposals to their payments and/or e-money activities. To clarify this, we have amended SYSC 15A.1 (Application)”

“A critical third party must have in place sound, effective and comprehensive strategies, controls, processes and systems that enable it to comply with the rules in CTPS.”

“A critical third party must ensure that its governance arrangements promote the resilience of any systemic third party service it provides, including by... establishing, overseeing and implementing an approach that covers... prevent, respond and adapt to, as well as recover from,”

“implementing lessons learned from CTP operational incidents and any testing and exercising undertaken, including but not limited to that undertaken in accordance with CTPS 5.”

“A critical third party must manage effectively risks to its ability to deliver a systemic third party service including by: (1) identifying and monitoring relevant external and internal risks; (2) ensuring that it has in place risk management processes... (3) regularly updating i”

“A critical third party must... identify and manage any risks to its supply chain that could affect its ability to deliver a systemic third party service.”

“A critical third party must take reasonable steps to ensure that its key nth-party providers and persons connected with a critical third party that are part of its supply chain: (1) are informed of the CTP duties... (2) cooperate... (3) provide the regulators with access to any i”

“A critical third party must... take reasonable steps to ensure the resilience of any technology that delivers, maintains or supports a systemic third party service, including by having: (1) sound, effective and comprehensive strategies... to adequately manage risks to its technol”

“A critical third party must ensure that it has a systematic and effective approach to dealing with changes to a systemic third party service... implementing any change... in a way that minimises appropriately the risk of any CTP operational incident occurring; and ensuring that p”

“A critical third party must: (1) within 12 months of being designated by the Treasury, identify and document: (a) the resources... used to deliver, support and maintain each systemic third party service... and (b) any internal and external interconnections and interdependencies..”

“A critical third party must manage effectively CTP operational incidents including by: (1) implementing appropriate measures to respond to and recover from CTP operational incidents... (2) setting an appropriate maximum tolerable level of disruption... (3) maintaining and operati”

“maintaining and operating an incident management playbook... which sets out the plans and procedures to be followed by the critical third party in the event of a CTP operational incident in order to: (a) respond to and recover from the CTP operational incident; and (b) facilitate”

“cooperating and coordinating with the regulators and affected firms in response to CTP operational incidents, including through collective incident response frameworks.”

“A critical third party must have in place appropriate measures to respond to a termination of any of its systemic third party services... including by putting in place: (1) arrangements to support the effective, orderly and timely termination of that service... (2) provision for ”

“A critical third party must be able to demonstrate to the regulators its ability to comply with CTPS.”

“a critical third party must carry out regular scenario testing of its ability to continue providing each systemic third party service within its appropriate maximum tolerable level of disruption... in the event of a severe but plausible disruption... identify an appropriate range”

“a critical third party must assess the effectiveness of its incident management playbook regularly, including undertaking an appropriate incident management playbook exercise with a representative sample of the firms... within 12 months of the critical third party being designate”

“A critical third party must, as soon as is practicable, prepare and submit to the regulators a report of the incident management playbook exercise undertaken under CTPS 5.3.1R (including any actions taken in the light of the results of that exercise).”

“A critical third party must provide to the regulators: (1) within 3 months... an interim self-assessment; and (2) annually thereafter, an annual self-assessment, of the critical third party's compliance with CTPS... must keep a copy... for a period of at least 3 years.”

“A critical third party must have in place effective and secure processes and procedures to ensure sufficient and timely information is given to a firm... including... results of testing and exercising... the annual self-assessment... the appropriate maximum tolerable level of dis”

“A critical third party must, as soon as is practicable after the occurrence of a CTP operational incident... submit the following information... (a) a description of the CTP operational incident... (d) the anticipated amount of time it will take to resolve the CTP operational inc”

“A critical third party must, as soon as is practicable after any significant change in circumstances... provide the regulators and the affected firms with information further to that already disclosed in relation to the CTP operational incident, including... any steps taken to re”

“A critical third party must, within a reasonable time of the CTP operational incident being resolved, provide the regulators and the affected firms with the following information... (2) a description of the root causes... (3) a description of any remedial actions... (4) a descrip”

“A critical third party must notify the regulators immediately where there is an actual or potential circumstance or event that seriously and adversely impacts, or could seriously and adversely impact, the critical third party's ability to deliver any of its systemic third party s”

“A critical third party must take reasonable steps to ensure that all information it gives to the regulators and firms... is: (1) factually accurate or, in the case of estimates and judgements, fairly and properly based... (2) complete... If a critical third party becomes aware...”

“When a critical third party appoints a skilled person, the critical third party must, in a contract with that person: (1) require and permit the skilled person during and after the course of their appointment: (a) to cooperate with the regulators in connection with the discharge ”

“A firm must submit a report to the FCA in accordance with (2) or (3), as applicable, as soon as is practicable after the occurrence of an operational incident which the firm reasonably believes meets one or more of the notification thresholds”

“For this initial phase of the report, an enhanced reporting firm must submit to the FCA, so far as it is aware, the information in accordance with columns (1) and (2) of the table in SUP 15 Annex 15.1R.”

“For the intermediate phase of the report, an enhanced reporting firm must, so far as it is aware, submit to the FCA the additional information in accordance with columns (1) and (3) of the table in SUP 15 Annex 15.1R, as soon as is practicable after any significant change in circ”

“For the final phase of the report, an enhanced reporting firm must submit to the FCA the additional information in accordance with columns (1) and (4) of the table in SUP 15 Annex 15.1R: (1) within 30 working days; or (2) where this is impracticable, as soon as is practicable but”

“A firm other than an enhanced reporting firm must submit to the FCA, so far as it is aware, information in accordance with the table in SUP 15 Annex 15.2R.”

“A firm must submit the information required under this section to the FCA online through the appropriate systems accessible from the FCA's website.”

“A payment service provider must submit the report in SUP 15.18.6R to the FCA within 4 hours of first detecting a major operational or security incident.”

“What proportion of an impact tolerance has been used?... Service downtime... Number of affected customers... Percentage of service users affected... Percentage of transactions affected... Value of transactions affected... Number of transactions affected”

“Describe the lesson identified... Not applicable... Not applicable... Mandatory... Describe the remedial action being taken... Not applicable... Not applicable... Mandatory”

“Third party provider name (note 7)... Mandatory... Mandatory... -... Third party provider legal entity identifier (note 7)... Mandatory... Mandatory... -”

“A firm must give the FCA notice when entering into, or significantly changing, a material third party arrangement.”

“A firm must submit the notice required in SUP 15.19.6R to the FCA: (1) by providing the information in accordance with columns (1) and (2) of the table in SUP 15 Annex 16.1R; and (2) online through the appropriate systems accessible from the FCA's website.”

“A firm must: (1) maintain a register of information relating to its material third party arrangements; and (2) submit the register of material third party arrangements annually to the FCA.”

“The firm must submit the register of material third party arrangements specified in SUP 16.33.6R(2) to the FCA: (1) by providing the information in accordance with columns (1) and (3) of the table in SUP 15 Annex 16.1R; and (2) online through the appropriate systems accessible fr”

“Substitutability of the service provider... Mandatory... Mandatory... Ability of reintegration of the service... Mandatory... Mandatory... The impact of discontinuing the contractual arrangement... Mandatory... Mandatory”

“Does the contractual arrangement support an important business service?... Mandatory... Mandatory... If yes, which important business service does the contractual arrangement support... Does the service provider support a core element of the important business service?”

“Impact tolerance - FCA - client harm... Mandatory... Mandatory... Impact tolerance - FCA - market integrity... Mandatory... Mandatory”

“Date of the most recent risk assessment... Mandatory... Mandatory... Outcome of the most recent risk assessment... Mandatory... Mandatory... Date of the most recent audit... Mandatory... Mandatory... Outcome of the most recent audit... Mandatory... Mandatory”

“Date of cyber risk due diligence... Mandatory... Mandatory... Outcome of cyber risk due diligence... Mandatory... Mandatory”

“Has this contractual arrangement been reviewed and signed off by an SMF holder or an accountable person of an FMI?... Mandatory... Mandatory... If not, which governance committee reviewed it?... Date of governance approval... Mandatory... Mandatory”

“Country where the data is stored... Mandatory... Mandatory... Country where the service is delivered from... Mandatory... Mandatory”

“SUP 16.33.6R(1) Material third party arrangements Register of information relating to material third party arrangements Not specified Not specified”

“Is the affected service classified as an important business service?... Optional (note 2)... Mandatory... -”

“Any notification required under both SUP 15.3.8G(1)(e) and SUP 15.19 (Notification of material third party arrangements) must be made in accordance with SUP 15.19.”

“Supply chain ranking... Mandatory... Mandatory... Notice period for the service provider... Mandatory... Mandatory... Notice period for the firm... Mandatory... Mandatory”

“firms must identify their important business services...defined as the services a firm provides which, if disrupted, could pose a risk to a firm's safety and soundness or...the financial stability of the UK.”

“firms to set an impact tolerance for each of their important business services...An impact tolerance must, in all cases, include a time-based metric to measure the tolerable level of disruption.”

“require firms to set their impact tolerances at the point at which any further disruption to the important business service would pose a risk to the firm's safety and soundness...policyholder protection...financial stability of the UK.”

“firms to ensure they are able to deliver their important business services within impact tolerances in severe but plausible scenarios...no later than Monday 31 March 2025.”

“firms to develop and implement effective remediation plans for the important business services that would not be able to remain within their impact tolerance...speed at which vulnerabilities are remediated should be commensurate with the potential impact.”

“require firms to identify and document the necessary people, processes, technology, facilities, and information...required to deliver each of their important business services...irrespective of whether the resources are being provided wholly or in part by a third party.”

“The PRA expects firms to update their mapping annually at a minimum, or following significant change if sooner.”

“require firms to test regularly their ability to remain within impact tolerances in severe but plausible disruption scenarios...The PRA expects firms to focus on recovery and response arrangements.”

“firms to develop a testing plan that details how they will gain assurance that they can remain within impact tolerances...nature and frequency of a firm's testing should be proportionate to the potential impact that disruption could cause.”

“firms to be able to remain within impact tolerances for important business services, irrespective of whether or not they use third parties in the delivery of these services...effectively manage their use of third parties to ensure they can meet the required standard.”

“Firms should understand the reliance placed on sub-outsourcing arrangements and if these arrangements pose a threat to their operational resilience.”

“one of the severe but plausible scenarios that firms may select for this testing could involve a failure or disruption at a third party, or their supply chain, based on previous incidents or near misses.”

“contractual agreements for material outsourcing arrangements to include 'requirements for both parties to implement and test business contingency plans. For the firm, these should take account of firms' impact tolerances for important business services.'”

“firms to develop communication strategies for both internal and external stakeholders as part of their planning for responding to operational disruptions...plans should include the escalation paths they would use to manage communications during an incident.”

“The PRA expects firms to review their important business services annually at a minimum, or sooner if a significant change occurs, and to determine whether any changes are required to their list of important business services.”

“a firm's board must approve and regularly review the firm's important business services, impact tolerances, and written self-assessment...boards must regularly review assessments...and the scenario analyses of its ability to remain within the impact tolerance.”

“the Chief Operations Senior Management Function (SMF) 24 should hold overall responsibility for implementing operational resilience policies and reporting to the board.”

“require firms to document a self-assessment of their compliance with the Operational Resilience Part...Firms' boards are accountable for and should approve the information provided in these documents.”

“list their important business services...specify the impact tolerances...detail their approach to mapping...describe their strategy for testing...identify any lessons learned...identify the vulnerabilities that threaten their ability...identify any additional risks...from elsewhe”

“requirements might include capacity specifications, recovery time objectives, and recovery point objectives. These requirements should be set to enable the firm to deliver the important business service within its impact tolerance.”

“CRR consolidation entities...or an insurer...to identify a proportionate number of important group business services and respective impact tolerances at the level of the group.”

“the CRR consolidation entity would have regular dialogue with other members of its group so the CRR firm (or CRR firms) can take account of any additional risks to their safety and soundness when assessing their ability to remain within impact tolerance.”

“firms to manage risk and make appropriate arrangements to be able to remain within impact tolerance, whether using third parties that are other entities within their group or external providers.”

“Firms are expected to have a prioritised plan which sets out how they will comply with the requirement to be able to remain within their impact tolerances within a reasonable time...firms must have started putting the plan into effect by Thursday 31 March 2022.”

“firms' business continuity plans under General Organisational Requirements 2.5 and 2.6 (banks) and Conditions Governing Business 2.6 (insurers) should take into account: the possibility that the quality of the provision of material outsourced services deteriorates”

“Exit strategies and termination processes, including a requirement for a documented exit plan for material outsourcing arrangements...explicitly catering for the unexpected termination of an outsourcing agreement (a stressed or unplanned exit), and taking into account possible se”

“Business continuity planning (BCP) (see paragraph 4.10)”

“If a non-material outsourcing or third party arrangement becomes material due to a severe but plausible scenario, such as a pandemic, firms should consider whether additional measures to safeguard their operational resilience are warranted, such as revisions to contractual provis”

“Firms should determine the materiality of all third party arrangements using all relevant criteria in this chapter...Materiality may vary throughout the duration of an arrangement and should therefore be (re)assessed: prior to signing the written agreement; at appropriate interva”

“a firm should generally consider an outsourcing or third party arrangement as material where a defect or failure in its performance could materially impair the...operational resilience, ie its ability to continue providing important business services”

“all relevant requirements in the Operational Resilience and Insurance – Operational Resilience Parts of the PRA Rulebook”

“PRA Fundamental Rules 2, 3, 5 and 6, and 7...Rule 2 in the General Organisational Requirements Part of the PRA Rulebook...In particular, the requirements on business continuity, contingency planning, and data protection”

“EBA ICT GL, including but not limited to Sections 3.2.3, 3.3.2, 3.4.5, and 3.7 (in particular, paragraph 86). These GL should be interpreted consistently with: the Operational Resilience/Insurance – Operational Resilience Parts, the expectations in this SS, and SS1/21”

“the PRA also encourages firms to take into account global standards on ICT risk management, including but not necessarily limited to the toolkit in the FSB Effective Practices (in particular, paragraphs 13, 18, 19 and 20, 33 and 36), and the G7 Third party Elements.”

“the PRA expects firms to assess the materiality and risks of all third party arrangements irrespective of whether they fall within the definition of outsourcing...Where a firm deems a non-outsourcing third party arrangement 'material' or 'high risk', it should implement proportio”

“Firms' boards should: set 'the control environment throughout the firm, including the appetite and tolerance levels in respect of outsourcing'...appropriately 'identifying and [having an] understanding of the firm's reliance on critical service providers'”

“Firms' boards should approve, regularly review, and implement a written outsourcing policy...This policy should align to and draw upon other relevant firm policies and strategies. For instance: business continuity...ICT...information and cyber security...operational resilience”

“firm or group-wide business continuity plans and exit strategies. Systemic wholesale branches should, however, take reasonable steps to develop local business continuity, contingency planning, and exit strategies (if available) covering any activities or services which they provi”

“rely on business continuity, contingency, and exit plans developed at group level, provided that they adequately safeguard their operational resilience.”

“the EBA Outsourcing GL expect banks to maintain an up-to-date register of information on all their outsourcing arrangements, distinguishing between those which are material and those which are not ('Outsourcing Register').”

“The PRA expects all firms to keep appropriate records of their outsourcing arrangements...The records should also be sufficient to enable the firm to fulfil the expectations concerning concentration risk set out in 5.24.”

“the PRA expects firms to define, document, and understand their and the service provider's respective responsibilities. In the case of cloud computing, the term commonly used to help firms and cloud providers understand their respective obligations is the 'shared responsibility m”

“The records should also be sufficient to enable the firm to fulfil the expectations concerning concentration risk set out in 5.24.”

“Procedures for the ongoing assessment of service providers' performance, including where appropriate: day-to-day oversight, including incident reporting, periodic performance assessment against service level agreements...being notified and responding to changes to an outsourcing ”

“Where a firm expects an outsourcing or third party arrangement to become material in the future, it should take reasonable steps to ensure that it can comply with all applicable expectations for material outsourcing arrangements in Chapters 6 to 10 on or before the materiality th”

“Firms should make outsourced and third party providers aware of relevant internal policies, including those on outsourcing, ICT, information security, or operational resilience.”

“effective processes and mechanisms for escalating concerns, issues, and regulatory feedback relating to their intragroup outsourcing arrangements to the whole firm or group.”

“if a significant organisational change at the service provider or a material sub-outsourced service provider takes place that could materially change the nature, scale, and complexity of the risks inherent in the outsourcing arrangement, including a significant change to the serv”

“The potential impact of a disruption, failure, or...business continuity, operational resilience, and operational risk, including: conduct risk”

“Firms may also leverage their end-to-end mapping of important business services under Chapter 4 of the Operational Resilience – CRR Firms and Operational Resilience – Solvency II Parts of the PRA Rulebook to document and map their intragroup and other dependencies.”

“they are third party arrangements that can give rise to significant risks to the PRA's objectives and should be subject to appropriate monitoring and risk-based controls...to manage relevant risks and promote an appropriate level of resilience.”

“If a covered person or service provider does not have adequate password management policies and practices, it is unlikely they would succeed in showing countervailing benefits to consumers or competition that outweigh the potential harms, thus triggering liability.”

“If covered persons or service providers do not routinely update systems, software, and code (including those utilized by contractors) or fail to update them when notified of a critical vulnerability, it is unlikely they would succeed in showing countervailing benefits”

“It also includes the use of versions of software that are no longer actively maintained by their vendors.”

“Inadequate security for the sensitive consumer information collected, processed, maintained, or stored by the company can constitute an unfair practice in violation of 12 U.S.C. 5536(a)(1)(B).”

“Each insured depository institution shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the institution”

“Protect against any anticipated threats or hazards to the security or integrity of such information”

“Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.”

“Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information.”

“Response programs that specify actions to be taken when the institution suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies”

“Measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.”

“Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the institution's risk assessment. Tests should be conducted or reviewed by independent third parties or staff independent”

“Each institution shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the institution's own changing busi”

“Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems”

“Exercise appropriate due diligence in selecting its service providers”

“Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines”

“Where indicated by the institution's risk assessment, monitor its service providers to confirm that they have satisfied their obligations...an institution should review audits, summaries of test results, or other equivalent evaluations of its service providers.”

“Each institution shall report to its board or an appropriate committee of the board at least annually...addressing issues such as: Risk assessment; risk management and control decisions; service provider arrangements; results of testing; security breaches or violations”

“every financial institution should also develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems that occur nonetheless.”

“Assessing the nature and scope of an incident, and identifying what customer information systems and types of customer information have been accessed or misused”

“Notifying its primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information”

“Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence”

“an institution's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to the financial institution's customer information, including notification to the institution as soon as possible of an”

“The board of directors or an appropriate committee of the board of each insured depository institution shall: 1. Approve the institution's written information security program; and 2. Oversee the development, implementation, and maintenance of the institution's information securi”

“Train staff to implement the institution's information security program.”

“Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.”

“Where an incident of unauthorized access to customer information involves customer information systems maintained by an institution's service providers, it is the responsibility of the financial institution to notify the institution's customers and regulator.”

“manage its operational risks by establishing a robust operational risk-management framework that is approved by its board of directors”

“business continuity plan that (1) incorporates the use of a secondary site at a location with a distinct risk profile from the primary site”

“is designed to enable critical systems to recover and resume operations no later than two hours following disruptive events”

“is designed to enable it to complete settlement by the end of the day of the disruption, even in case of extreme circumstances”

“is tested at least annually”

“conduct tests of its systems, policies, procedures, and controls in accordance with a documented testing framework”

“a designated FMU's testing assess whether its systems, policies, procedures, or controls function as intended”

“conduct a review of the design, implementation, and testing of systems, policies, procedures, and controls after the designated FMU experienced any material operational incidents”

“review the design, implementation, and testing of systems, policies, procedures, and controls after significant changes to the environment in which it operates”

“remediate, as soon as possible and following established governance processes, any deficiencies identified during tests and reviews”

“establish a documented framework for incident management that provides for the prompt detection, analysis, and escalation of an incident; appropriate procedures for addressing an incident; and incorporation of lessons learned following an incident”

“include a plan for notification and communication of material operational incidents. This plan, among other things, would need to identify the entities that would be notified of operational incidents, including non-participants”

“notify the Board immediately when it activated its business continuity plan or had a reasonable basis to conclude that (1) there was an actual or likely disruption, or material degradation, to any of its critical operations or services”

“unauthorized entry or a vulnerability that could allow unauthorized entry, into the designated FMU's computer, network, electronic, technical, automated, or similar systems that affects or has the potential to affect its critical operations or services”

“a designated FMU must notify the Board of incidents 'in accordance with the process established by the Board'”

“establish criteria and processes, including the appropriate methods of communication, to provide for timely communication and responsible disclosure of material operational incidents to its participants or other relevant entities”

“notify affected participants immediately in the event of actual disruptions or material degradation to its critical operations or services or to its ability to fulfill its obligations on time”

“notify all participants and other relevant entities in a timely and responsible manner of all other material operational incidents that require immediate notification to the Board”

“identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls that are reviewed, audited, and tested periodically and after major changes”

“identify, monitor, and manage the operational risks it may pose to other FMUs and trade repositories”

“have adequate, scalable capacity to handle increasing stress volumes”

“address potential and evolving vulnerabilities and threats”

“The board of directors of a credit union is responsible for establishing a vital records preservation program within six months of its insurance certificate being issued. The program must be in writing and contain procedures for maintaining duplicate vital records at a vital reco”

“The procedures must include: (1) Designated staff responsible for vital records preservation”

“The procedures must include: (2) A schedule for the storage and destruction of vital records”

“A records preservation log as determined by the credit union that will aid in locating and easily accessing the vital records. The log may be in electronic or any other format as determined by the credit union.”

“contain procedures for maintaining duplicate vital records at a vital records center... a storage facility...at any location far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of a catastrophic act.”

“Vital records are the most recent and current versions of the records a credit union needs to restore vital member services. These records are: (1) A list of share, deposit, and loan balances... (2) A financial report... (3) Bank reconcilements... (4) A list of the credit union's”

“A credit union that has some or all of its vital records maintained by an off-site data processor is considered to be in compliance for the storage of those records if the service agreement specifies the data processor safeguards against the simultaneous destruction of production”

“A credit union must maintain, or contract with a third-party service provider to maintain, any equipment or software for its vital records center necessary for the credit union to access its records.”

“If a credit union contracts with a third-party service provider to maintain its records, the credit union must maintain effective oversight of the third-party service provider to ensure the records meet the requirements of this section.”

“Preserved vital records may be in any format that can be used to reconstruct the credit union's vital records. The format used must accurately reflect the information in the record, remain accessible to all persons entitled to access by statute, regulation, or rule of law, and be”

“The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident”

“Each federally insured credit union must notify the appropriate NCUA-designated point of contact of the occurrence of a reportable cyber incident via email, telephone, or other similar methods that the NCUA may prescribe.”

“A substantial loss of confidentiality, integrity, or availability of a network or member information system...that results from the unauthorized access to or exposure of sensitive data, disrupts vital member services...or has a serious impact on the safety and resiliency of opera”

“A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.”

“A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.”

“within 72 hours of being notified by a third-party, whichever is sooner.”

“a FICU board of directors establish a written succession plan that addresses specified positions and contains certain information”

“a credit union board must review its succession plan no less than every 24 months, as opposed to the annual review that would have been required under the proposed rule”

“newly appointed members of the board of directors have a working familiarity with the succession plan no later than six months after appointment”

“The final rule does not require the FICU use a specific date, but suggests some possible proxies, including the individual's anticipated retirement date or announced departure date. A credit union can also note that a retirement or departure date is unknown.”

“succession plans are intended to cover senior leadership positions responsible for the oversight of the FICU or its day-to-day management”

“other personnel the board of directors deems critical given the [FICU's] size, complexity, or risk of operations. This includes new positions that may be required due to planned changes in operations, supervisory landscape, or corporate structure.”

“a FISCU must adhere to the succession planning requirements 'to the extent these regulatory provisions do not conflict with an applicable state requirement.'”

“Each federally insured credit union will develop a written security program within 90 days of the effective date of insurance.”

“Each federally insured credit union will notify the regional director within 5 business days of any catastrophic act that occurs at its office(s).”

“Within a reasonable time after a catastrophic act occurs, the credit union shall ensure that a record of the incident is prepared and filed at its main office.”

“The NCUA must receive this notification as soon as possible but no later than 72 hours after a federally insured credit union reasonably believes that it has experienced a reportable cyber incident.”

“A disruption of business operations, vital member services, or a member information system resulting from a cyberattack or exploitation of vulnerabilities.”

“A disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider or by a supply chain compromise.”

“A comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.”

“Approve the credit union's written information security policy and program; and oversee the development, implementation, and maintenance of the credit union's information security program.”

“Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of member information or member information systems.”

“Response programs that specify actions to be taken when the credit union suspects or detects that unauthorized individuals have gained access to member information systems, including appropriate reports to regulatory and law enforcement agencies.”

“Measures to protect against destruction, loss, or damage of member information due to potential environmental hazards, such as fire and water damage or technical failures.”

“Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into member information systems.”

“Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the credit union's risk assessment.”

“Exercise appropriate due diligence in selecting its service providers; Require its service providers by contract to implement appropriate measures designed to meet the objectives of these guidelines.”

“Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its member information, internal or external threats to information, and the credit union's own changing business arrangements.”

“Each credit union should report to its board or an appropriate committee of the board at least annually. This report should describe the overall status of the information security program and the credit union's compliance with these guidelines.”

“Every credit union should also develop and implement a risk-based response program to address incidents of unauthorized access to member information in member information systems that occur nonetheless.”

“Assessing the nature and scope of an incident, and identifying what member information systems and types of member information have been accessed or misused.”

“Notifying the appropriate NCUA Regional Director, and, in the case of state-chartered credit unions, its applicable state supervisory authority, as soon as possible when the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member info”

“Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of member information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence.”

“A credit union's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to or use of the credit union's member information, including notification of the credit union as soon as possible of an”

“The president or managing official of each federally insured credit union must certify compliance with the requirements of this part in its Credit Union Profile annually through NCUA's online information management system.”

“Design its information security program to control the identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of the credit union's activities.”

“must establish and document a contingency funding plan (CFP) that meets the requirements of paragraph (d) of this section.”

“Policies to manage a range of stress environments, identification of some possible stress events, and identification of likely liquidity responses to such events;”

“Lines of responsibility within the institution to respond to liquidity events;”

“The frequency that the institution will test and update the plan.”

“All credit unions must have a written program that includes plans for safeguarding records and reconstructing vital records.”

“The board of directors of a credit union is responsible for establishing a vital records preservation program within 6 months after its insurance certificate is issued.”

“The program must be in writing and contain procedures for maintaining duplicate vital records at a vital records center.”

“The procedures must include: designated staff responsible for vital records preservation, a schedule for the storage and destruction of records...”

“a records preservation log detailing for each record stored, its name, storage location, storage date, and name of the person sending the record for storage.”

“A credit union must maintain or contract with a third party to maintain any equipment or software for its vital records center necessary to access records.”

“A vital records center is defined as a storage facility...at any location far enough from the credit union's offices to avoid the simultaneous loss of both sets of records in the event of a catastrophic act.”

“The format used must accurately reflect the information in the record, remain accessible to all persons entitled to access by statute, regulation or rule of law, and be capable of reproduction by transmission, printing, or otherwise.”

“Credit unions which have some or all of their records maintained by an off-site data processor are considered to be in compliance...if the service agreement specifies the data processor safeguards against the simultaneous destruction of production and back-up information.”

“(1) A business impact analysis to evaluate potential threats;”

“(2) A risk assessment to determine critical systems and necessary resources;”

“A written plan addressing: i. Persons with authority to enact the plan;”

“ii. Preservation and ability to restore vital records;”

“iii. A method for restoring vital member services through identification of alternate operating location(s) or mediums to provide services, such as telephone centers, shared service centers, agreements with other credit unions, or other appropriate methods;”

“iv. Communication methods for employees and members;”

“v. Notification of regulators as addressed in 12 CFR 748.1(b);”

“vi. Training and documentation of training to ensure all employees and volunteer officials are aware of procedures to follow in the event of destruction of vital records or loss of vital member services;”

“vii. Testing procedures, including a means for documenting the testing results.”

“(4) Internal controls for reviewing the plan at least annually and for revising the plan as circumstances warrant, for example, to address changes in the credit union's operations;”

“(5) Annual testing.”

“a banking organization must notify its primary Federal regulator of any computer-security incident that rises to the level of a notification incident as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred”

“the final rule requires a bank service provider to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines it has experienced a computer-security incident that has caused, or”

“all banking organizations must have a sufficient understanding of their lines of business to be able to determine which business lines would, upon failure, result in a material loss of revenue, profit, or franchise value to the banking organization, so that they can meet their no”

“a banking organization will be required to notify its primary Federal regulator when it has suffered a computer-security incident that has a reasonable likelihood of materially disrupting or degrading the banking organization or its operations.”

“a banking organization should evaluate whether the loss is material to the organization as a whole.”

“requiring that notice be provided to a bank-designated point of contact, rather than to at least two individuals at each banking organization customer.”

“the agencies are replacing the 'good faith belief' standard with a banking organization's determination. The agencies agree with commenters who criticized the proposed 'believes in good faith' standard as too subjective and imprecise.”

“Ability to carry out banking operations, activities, or processes, or deliver banking products and services to a material portion of its customer base, in the ordinary course of business.”

“operations, including associated services, functions and support, as applicable, the failure or discontinuance of which would pose a threat to the financial stability of the United States.”

“the agencies would encourage those banking organizations providing sector-critical services that currently notify their primary Federal regulator of these types of incidents on a same-day basis to continue to do so.”

“when the bank service provider determines it has experienced a computer-security incident that has caused, or is reasonably likely to cause, a material service disruption or degradation for four or more hours.”

“prompt notification will allow the banking organization to assess whether the incident has or is reasonably likely to have a material impact on the banking organization and thus trigger the banking organization's own notification requirement.”

“while the agencies agree that incident notification is generally addressed by contract, we believe that this issue is important enough to warrant an independent regulatory requirement that ensures consistency and enforceability, without the necessity of revising contractual provi”

“banking organizations have become increasingly reliant on third parties to provide essential services. Such third parties may also experience computer-security incidents that could disrupt or degrade the provision of services to their banking organization customers.”

“The OCC must receive this notification from the banking organization as soon as possible and no later than 36 hours after the banking organization determines that a notification incident has occurred.”

“A banking organization must notify the appropriate OCC supervisory office, or OCC-designated point of contact, about a notification incident through email, telephone, or other similar methods that the OCC may prescribe.”

“Notification incident is a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, a banking organization's— (i) Ability to carry out banking operations...in the ordinary course of business...”

“A bank service provider is required to notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrup”

“If the banking organization customer has not previously provided a bank-designated point of contact, such notification shall be made to the Chief Executive Officer and Chief Information Officer of the banking organization customer, or two individuals of comparable responsibilitie”

“A bank-designated point of contact is an email address, phone number, or any other contact(s), previously provided to the bank service provider by the banking organization customer.”

“Maintaining a complete inventory of its third-party relationships and periodically conducting risk assessments for each third-party relationship supports a banking organization's determination of whether risks have changed over time”

“banking organizations engage in more comprehensive and rigorous oversight and management of third-party relationships that support higher-risk activities, including critical activities.”

“effective planning allows a banking organization to evaluate and consider how to manage risks before entering into a third-party relationship... when critical activities are involved, plans may be presented to and approved by a banking organization's board of directors”

“incident response and management, including the third party's ability to respond to and recover from incidents that could disrupt operations”

“information security, including the third party's information security program and its ability to protect the banking organization's systems, data, and customers”

“operational resilience, including the third party's ability to withstand and recover from disruptions”

“incident notification, requiring the third party to promptly notify the banking organization of any incidents that may affect the third party's ability to provide the contracted services”

“performance standards and service level agreements, including measurable standards for performance and consequences for failure to meet the standards”

“audit and examination rights, including the right to conduct audits and examinations of the third party and its subcontractors”

“default and termination rights, including the ability of the banking organization to terminate the contract and transition the activities to another third party or in-house”

“ongoing monitoring should include reviewing the third party's business continuity and disaster recovery capabilities, including test results”

“information security, including monitoring changes to the third party's security controls and any security incidents that may affect the banking organization”

“concentration risk, including assessing the banking organization's reliance on a single third party for critical activities and the potential impact on the banking organization's operations”

“maintaining contingency plans for terminating the relationship, including identifying and transitioning to alternative third parties or moving the activities in-house”

“assessing whether a third party's use of subcontractors may heighten or raise additional risk to the banking organization and applying mitigating factors, as appropriate”

“require the third party to bind its subcontractors to any obligations and standards of the third party”

“independent reviews of the banking organization's third-party risk management processes and controls, including those related to critical activities”

“the board has ultimate oversight responsibility to ensure that the banking organization operates in a safe and sound manner... senior management implements the board-approved policies”

“documentation and reporting sufficient to support the banking organization's third-party risk management processes and to facilitate examination by the agencies”

“banking organizations should consider taking steps to mitigate the risks or, if the risks cannot be mitigated, to determine whether the residual risks are acceptable”

“asked for additional flexibility for banking organizations to manage relationships with third parties in relatively concentrated industries, mentioning cloud computing as an example”

“use of any collaborative efforts does not abrogate the responsibility of banking organizations to manage third-party relationships in a safe and sound manner... evaluate the conclusions from such collaborative efforts based on the banking organization's own specific circumstances”

“It is important to involve staff with the requisite knowledge and skills in each stage of the risk management life cycle... experts across disciplines, such as compliance, risk, or technology, as well as legal counsel”

“Each national bank or Federal savings association shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity”

“The board of directors or an appropriate committee of the board of each national bank or Federal savings association shall: 1. Approve the national bank's or Federal savings association's written information security program; and 2. Oversee the development, implementation, and ma”

“Identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.”

“Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information.”

“Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;”

“Response programs that specify actions to be taken when the national bank or Federal savings association suspects or detects that unauthorized individuals have gained access to customer information systems, including appropriate reports to regulatory and law enforcement agencies;”

“Measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures.”

“Regularly test the key controls, systems and procedures of the information security program. The frequency and nature of such tests should be determined by the national bank's or Federal savings association's risk assessment. Tests should be conducted or reviewed by independent t”

“Exercise appropriate due diligence in selecting its service providers;”

“Require its service providers by contract to implement appropriate measures designed to meet the objectives of these Guidelines;”

“Where indicated by the national bank's or Federal savings association's risk assessment, monitor its service providers to confirm that they have satisfied their obligations as required by section D.2. As part of this monitoring, a national bank or Federal savings association shou”

“Each national bank or Federal savings association shall monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and th”

“Each national bank or Federal savings association shall report to its board or an appropriate committee of the board at least annually. This report should describe the overall status of the information security program...risk assessment; risk management and control decisions; ser”

“every financial institution should also develop and implement a risk-based response program to address incidents of unauthorized access to customer information in customer information systems that occur nonetheless. A response program should be a key part of an institution's info”

“Assessing the nature and scope of an incident, and identifying what customer information systems and types of customer information have been accessed or misused;”

“Notifying its primary Federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information, as defined below;”

“Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence;”

“an institution's contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to the financial institution's customer information, including notification to the institution as soon as possible of an”

“Where an incident of unauthorized access to customer information involves customer information systems maintained by an institution's service providers, it is the responsibility of the financial institution to notify the institution's customers and regulator. However, an institut”

“Train staff to implement the national bank's or Federal savings association's information security program.”

“Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.”

“The institution should, therefore, ensure that it has reasonable policies and procedures in place, including trained personnel, to respond appropriately to customer inquiries and requests for assistance.”

“require covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information”

“Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization”

“Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information”

“Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with the notification obligations discussed below”

“covered institutions will be required to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring of service providers, including to ensure that affected individuals receive any requi”

“the final amendments require covered institutions to ensure that their service providers provide notification as soon as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred”

“The safeguards rule requires brokers, dealers, investment companies, and registered investment advisers to adopt written policies and procedures that address administrative, technical, and physical safeguards to protect customer records and information”

“covered institutions generally should consider reviewing and updating the assessment procedures periodically to ensure that the procedures remain reasonably designed”

“the final amendments will permit covered institutions to delay providing notice after the Commission receives a written request from the Attorney General that this notice poses a substantial risk to national security or public safety”

“An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material.”

“a registrant shall make a materiality determination regarding a cybersecurity incident as soon as reasonably practicable after discovery of the incident.”

“Registrants must describe their processes, if any, for the assessment, identification, and management of material risks from cybersecurity threats.”

“Describe the board's oversight of risks from cybersecurity threats.”

“FPIs must: Describe management's role in assessing and managing material risks from cybersecurity threats.”

“A registrant may delay filing as described below, if the United States Attorney General determines immediate disclosure would pose a substantial risk to national security or public safety.”