On July 21, 2022, the National Credit Union Administration (NCUA) published a new proposed rule titled "Cyber Incident Notification Requirements for Federally Insured Credit Unions." In this article, we will review the proposed rule; compare the requirements with the recently published incident notification rule for banks by the FDIC, OCC, and Federal Reserve; and discuss what credit unions can do in response.
Every member of your staff is responsible for doing their part to help secure the organization from incidents, but do they know that? Employee training is a significant component of an effective incident management program. In this article, we are going to explore training benefits, target audience, potential topics, and available resources.
As distributed ledger technology has evolved over the last few years, the National Credit Union Administration (NCUA) has stepped into the unknown and has provided their supervised entities with guidance on the topic. In fact, they published two:
On December 9, 2021, the Federal Trade Commission (FTC) published their revised Standards for Safeguarding Customer Information (16 CFR Part 314) in accordance with the Gramm-Leach-Bliley Act (GLBA). This updated rule exists to improve how financial institutions regulated by the FTC develop and implement their information security programs.
On August 27, 2021, the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (FRB), and the Office of the Comptroller of the Currency (OCC) published a new guide over Conducting Due Diligence on Financial Technology Companies. On September 9, 2021, the Federal Reserve published a supplemental paper titled Community Bank Access to Innovation through Partnerships.
In a recent Tandem "Ask Me Anything" webinar on risk assessments, one of the attendees asked, "What is a GLBA risk assessment?" This is a great question and one that is foundational to the world of information security for financial institutions. Let's talk about what it is and how to do one, with a dash of history for good measure.
Before You Read: This blog is about the original Cyber Incident Reporting Act and may contain outdated information. For an updated overview of the CIRCIA requirements, see our blog: A Financial Institution's Guide to CISA's Proposed CIRCIA Reporting Requirements.
Finding the right person to be your information security officer (ISO) can be a challenge. The person filling this role often wears many hats, most of which are critical to the ongoing success and security of your day-to-day operations. The value provided by an ISO is exactly what makes it all the more painful if they decide it's time to "start seeing other people."
Working in cybersecurity can be exhausting. Not only must Information Security Officers (ISOs) be well-versed in the ever-changing world of technology, but they must also be experts in security, compliance, communication, and the business itself. As a bonus, they get to do all of this while playing from behind the 8-ball, as malicious actors continually try to steal their thunder.
On January 18, 2022, the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) released a new "Insights" memo with a title that is a direct call to action: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats.