Posts by:
At Tandem, we occasionally receive questions from our clients on the topic of an "IT audit risk assessment," most often in reference to an examination request list item. Where did this concept come from, what exactly is it, and how would you begin to conduct one? Let's find out.
When you search the web for the "definition of risk," you will likely be greeted by a series of images which look something like this.
On August 29, 2024, the FFIEC published a statement announcing the sunset of their Cybersecurity Assessment Tool (CAT). The tool will be sunset on August 31, 2025. Please take careful consideration of this announcement as you read this article.
To promote the security of payment systems, the Federal Reserve has an initiative in place called the FedLine Solutions Security and Resiliency Assurance Program. This program requires organizations who use FedLine services to (1) complete an assessment, (2) develop a remediation plan, and (3) submit proof of compliance with the security requirements to the Federal Reserve.
Organizations invest in technology because it improves efficiency, communications, data storage, and business growth opportunities. With increased use of technology comes an increased attack exposure from threat actors, so it is important to evaluate and manage cyber risk related to new and existing technologies.
In October 2020, the National Institute of Standards and Technology (NIST) published NISTIR 8286 over Integrating Cybersecurity and Enterprise Risk Management (ERM). The document provides an overview of ERM and how cybersecurity should be integrated with ERM to ensure the organization is better able to recognize, assess, and control risk across the organization.
On July 19, 2021, the Federal Deposit Insurance Corporation (FDIC), Federal Reserve (FRB), and Office of the Comptroller of the Currency (OCC) published in the Federal Register a Proposed Interagency Guidance on Third-Party Relationships: Risk Management.
There is no question that when an incident occurs, there are a lot of people who may need to be notified, especially if you work for a financial institution. Who do you contact and when should you contact them? In this article, we will answer these questions, as we talk about incident response plan communication guidelines.
On June 30, 2021, the Federal Financial Institutions Examination Council (FFIEC) released a new Architecture, Infrastructure, and Operations (AIO) booklet, as part of their IT Examination Handbook. This new booklet supersedes and replaces the previous Operations (OPS) booklet, incorporating and expanding on information technology topics in the context of enterprise goals and objectives.
When a security incident occurs, an early step in the analysis stage is to answer the question, "How bad is it?" Having an intentional approach to answering this question will help you facilitate decision making, prioritize responses, and ultimately, improve your organization's security. In this article, we will review the steps you can take to ensure incidents are classified effectively.