Posts by:
Picture this: You have a big event coming up, like an audit, an exam, a board report, you get the idea. You know they are going to ask for your policy review meeting minutes. What exactly are you going to give them?
It's no secret that phishing tests are a commonly used form of security awareness training. In fact, the 2022 Tandem State of Cybersecurity Report found that 92% of surveyed financial institutions are implementing phishing tests. This makes it the most common form of training right now.
If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.
Since the effective date for the incident notification rule for banks, we have received several questions asking about whether an incident would be classified as a "notification incident" or not. For example:
During the development of our Incident Management product, we spent a lot of time researching and reviewing guidance, so we could know exactly what should be included in a financial institution's incident management program. While not an exhaustive list, if you are looking for guidance regarding what to include in your plan, the resource below will help you get started.
On May 13, 2022, the FFIEC published an entry to the IT Examination Handbook Infobase What's New page stating that they had rescinded the E-Banking booklet. If you're anything like me, you may be asking questions like "why" and "what am I expected to do now?" If that's you, you've come to the right place. Let's answer those questions.
If you work in a financial institution, you may be familiar with using the terms "electronic banking," "internet banking," and "mobile banking" interchangeably. With the publication of the FFIEC's new Authentication and Access to Financial Institution Services and Systems guidance, a new term appeared: "digital banking." The introduction of this new term made me wonder, what does it all mean? Should these terms be used interchangeably and if not, what exactly are the differences among them?
On July 21, 2022, the National Credit Union Administration (NCUA) published a new proposed rule titled "Cyber Incident Notification Requirements for Federally Insured Credit Unions." In this article, we will review the proposed rule; compare the requirements with the recently published incident notification rule for banks by the FDIC, OCC, and Federal Reserve; and discuss what credit unions can do in response.
Every member of your staff is responsible for doing their part to help secure the organization from incidents, but do they know that? Employee training is a significant component of an effective incident management program. In this article, we are going to explore training benefits, target audience, potential topics, and available resources.
As distributed ledger technology has evolved over the last few years, the National Credit Union Administration (NCUA) has stepped into the unknown and has provided their supervised entities with guidance on the topic. In fact, they published two: