In a world increasingly affected by cyber-attacks (e.g., account takeover, compromised credentials, ransomware, etc.), multifactor authentication (MFA) is considered a strong technical control, although it is not without its challenges. In this article, we will discuss answers to the following questions:
In January 2021, we asked a group of 175 financial institution cybersecurity professionals if their organization had a formal incident tracking system.
On November 18, 2021, the FDIC, OCC, and Federal Reserve published a final rule titled "Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers." This guide is designed to break down the new rule and its expectations to prepare you before the rule goes into effect on April 1, 2022.
At Tandem, we occasionally receive questions from our clients on the topic of an "IT audit risk assessment," most often in reference to an examination request list item. Where did this concept come from, what exactly is it, and how would you begin to conduct one? Let's find out.
When you search the web for the "definition of risk," you will likely be greeted by a series of images which look something like this.
On August 29, 2024, the FFIEC published a statement announcing the sunset of their Cybersecurity Assessment Tool (CAT). The tool will be sunset on August 31, 2025. Please take careful consideration of this announcement as you read this article.
In January 2021, the National Credit Union Administration (NCUA) published their 2021 Supervisory Priorities which stated, "The agency has reprioritized away from performing facilitated Automated Cybersecurity Evaluation Toolbox cybersecurity maturity assessments, to piloting the Information Technology Risk Examination for Credit Unions (InTREx-CU). […] ACET will become a self-assessment resource for credit unions, supported by the NCUA."
To promote the security of payment systems, the Federal Reserve has an initiative in place called the FedLine Solutions Security and Resiliency Assurance Program. This program requires organizations who use FedLine services to (1) complete an assessment, (2) develop a remediation plan, and (3) submit proof of compliance with the security requirements to the Federal Reserve.
Organizations invest in technology because it improves efficiency, communications, data storage, and business growth opportunities. With increased use of technology comes an increased attack exposure from threat actors, so it is important to evaluate and manage cyber risk related to new and existing technologies.
In our recent State of Cybersecurity survey, we set out to find any trends among U.S. financial institutions when it comes to budgeting for IT and cybersecurity. Insight from 237 responding cybersecurity professionals helped us see how financial resources are being used to increase the security posture of responding financial institutions.