This month, the National Credit Union Administration (NCUA) issued a Risk Alert (19-RISK-01) describing the increasing frequency of and losses related to business email compromise fraud schemes. This is the first Risk Alert issued by the NCUA in six years.
The concept of a multifactor authentication (MFA) risk assessment has recently become a topic of conversation in the information security community. Perhaps these discussions around an MFA risk assessment have led you to ask, "Am I required to perform an MFA risk assessment?"
If you are a credit union, you should expect to see the ACET during your next IT examination. The NCUA began piloting this new examination tool in 2018 with larger credit unions, but we anticipate it will be used in most credit union examinations in 2019. As you prepare for the ACET, here is a list of frequently asked questions for you to review.
In 2018, the NCUA began piloting the use of the Automated Cybersecurity Examination Tool (ACET) based on the FFIEC's Cybersecurity Assessment Tool (CAT) to review credit unions. While the ACET mirrors the CAT in content, ACET provides additional features and details to help credit unions and the NCUA examine and benchmark the industry's cybersecurity preparedness.
The article was published in the September 2018 edition of the Kansas Banker Magazine.
On January 19, 2018, the General Assembly of the State of Colorado introduced House Bill 18-1128, Concerning Strengthening Protections for Consumer Data Privacy. The regulation was signed into law on May 29, 2018 and goes into effect on September 1, 2018.
How do you know what due diligence documents to gather from each of your vendors? There are many methods available, but some result in more accurate documentation than others. Today, I'm going to review two of the primary methods and discuss the effectiveness of each method.
Ideally, reviewing a SOC Report will take you 15 minutes or less (once you get the hang of it). If you are a financial institution and you have vendors, then you have plenty of SOC Reports to review every year.
In September 2016, the Federal Financial Institutions Examination Council (FFIEC) released an updated Information Security Booklet as part of the IT Examination Handbook. Among other contemporary concepts, the FFIEC placed an increased emphasis on the role of Information Security Officers (ISOs) in financial institutions. In section I.B Responsibility and Accountability (Page 5), the FFIEC provides a list of six key qualities of the ISO role. Here are the six qualities and a brief interpretation of how this can be applied in your organization.
This article was published in the Jan/Feb 2018 edition of the Nebraska Banker magazine.