Posts by:
On May 3, 2024, three of the federal banking agencies published a new Third-Party Risk Management Guide for Community Banks. This guide was published as a supplement to the agencies' Third-Party Relationships: Risk Management guidance ("TPRM Guidance"), published in June 2023.
If you work for a financial institution, you may have heard the term GLBA once or twice. Or a lot. In our experience, people often use the term GLBA to describe several things related to GLBA compliance. In this article, we're going to demystify what GLBA is, and more importantly, what people mean when they say GLBA as it relates to regulatory compliance.
On April 4, 2024, CISA published a proposed rule in the Federal Register titled Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements. Let's take a look at what this proposed rule requires and how it applies to financial institutions.
On February 26, 2024, the National Institute of Standards and Technology (NIST) published an update to their Cybersecurity Framework (CSF). A decade since the framework made its first appearance, the NIST CSF 2.0 includes several significant changes. In this article, we'll cover six of those key updates and talk about what it means for you.
On September 29, 2023, the Federal Deposit Insurance Corporation (FDIC) published FIL-52-2023 announcing the updated Information Technology Risk Examination (InTREx) procedures. If you're curious about what changed, you've come to the right place.
On Tuesday, October 24, 2023, the state bank regulators (CSBS), Bankers' Electronic Crimes Task Force, and United States Secret Service published an updated version of the Ransomware Self-Assessment Tool (R-SAT). In this blog, we'll discuss what the R-SAT is, what got updated, and what you need to do about it.
While findings may be a normal part of an audit or examination, that doesn't make them any less daunting to navigate. Sometimes findings catch us off-guard. To quote one of my colleagues, "findings can be unclear, unusual, unreasonable, or even urgent." So, when you get a finding, how can you respond most effectively? Here are six tips.
In the early 2000's, there was a reality TV show on TLC called "What Not to Wear." The show's premise involved giving poorly dressed individuals a guided shopping spree and the makeover of their dreams. While the show was not about policy writing, believe it or not, the lessons learned from the show can be very much applied to the process of writing a policy.
Subcontractors (also known as "fourth parties" or "nth parties") are an important factor when it comes to vendor management. Through the vendor management process, you take steps to make sure your vendors are secure and resilient, but what about their third parties? Do your vendors hold their subcontractors to the same standard of excellence? How can you know?
The FFIEC Cybersecurity Assessment Tool (CAT) has a rich history. The purpose of this article is to provide a comprehensive timeline of the FFIEC CAT and how its implementation has changed over the years. Bookmark this blog and be sure to come back to see updates as the topic continues to evolve.