Posts by:
On December 9, 2021, the Federal Trade Commission (FTC) published their revised Standards for Safeguarding Customer Information (16 CFR Part 314) in accordance with the Gramm-Leach-Bliley Act (GLBA). This updated rule exists to improve how financial institutions regulated by the FTC develop and implement their information security programs.
On August 27, 2021, the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (FRB), and the Office of the Comptroller of the Currency (OCC) published a new guide over Conducting Due Diligence on Financial Technology Companies. On September 9, 2021, the Federal Reserve published a supplemental paper titled Community Bank Access to Innovation through Partnerships.
In a recent Tandem "Ask Me Anything" webinar on risk assessments, one of the attendees asked, "What is a GLBA risk assessment?" This is a great question and one that is foundational to the world of information security for financial institutions. Let's talk about what it is and how to do one, with a dash of history for good measure.
Before You Read: This blog is about the original Cyber Incident Reporting Act and may contain outdated information. For an updated overview of the CIRCIA requirements, see our blog: A Financial Institution's Guide to CISA's Proposed CIRCIA Reporting Requirements.
Finding the right person to be your information security officer (ISO) can be a challenge. The person filling this role often wears many hats, most of which are critical to the ongoing success and security of your day-to-day operations. The value provided by an ISO is exactly what makes it all the more painful if they decide it's time to "start seeing other people."
Working in cybersecurity can be exhausting. Not only must Information Security Officers (ISOs) be well-versed in the ever-changing world of technology, but they must also be experts in security, compliance, communication, and the business itself. As a bonus, they get to do all of this while playing from behind the 8-ball, as malicious actors continually try to steal their thunder.
On January 18, 2022, the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) released a new "Insights" memo with a title that is a direct call to action: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats.
In a world increasingly affected by cyber-attacks (e.g., account takeover, compromised credentials, ransomware, etc.), multifactor authentication (MFA) is considered a strong technical control, although it is not without its challenges. In this article, we will discuss answers to the following questions:
In January 2021, we asked a group of 175 financial institution cybersecurity professionals if their organization had a formal incident tracking system.
On November 18, 2021, the FDIC, OCC, and Federal Reserve published a final rule titled "Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers." This guide is designed to break down the new rule and its expectations to prepare you before the rule goes into effect on April 1, 2022.