In October 2020, the National Institute of Standards and Technology (NIST) published NISTIR 8286 over Integrating Cybersecurity and Enterprise Risk Management (ERM). The document provides an overview of ERM and how cybersecurity should be integrated with ERM to ensure the organization is better able to recognize, assess, and control risk across the organization.
On July 19, 2021, the Federal Deposit Insurance Corporation (FDIC), Federal Reserve (FRB), and Office of the Comptroller of the Currency (OCC) published in the Federal Register a Proposed Interagency Guidance on Third-Party Relationships: Risk Management.
Welcome to the first of our eight-part content series based on data pulled from our 2021 State of Cybersecurity Report. Earlier this year, Tandem surveyed more than 230 financial institution cybersecurity professionals and built a report with the latest information on the industry's current state of cybersecurity. Security and compliance experts from Tandem evaluated data collected from the survey and encountered several significant findings.
There is no question that when an incident occurs, there are a lot of people who may need to be notified, especially if you work for a financial institution. Who do you contact and when should you contact them? In this article, we will answer these questions, as we talk about incident response plan communication guidelines.
On June 30, 2021, the Federal Financial Institutions Examination Council (FFIEC) released a new Architecture, Infrastructure, and Operations (AIO) booklet, as part of their IT Examination Handbook. This new booklet supersedes and replaces the previous Operations (OPS) booklet, incorporating and expanding on information technology topics in the context of enterprise goals and objectives.
When a security incident occurs, an early step in the analysis stage is to answer the question, "How bad is it?" Having an intentional approach to answering this question will help you facilitate decision making, prioritize responses, and ultimately, improve your organization's security. In this article, we will review the steps you can take to ensure incidents are classified effectively.
At Tandem, we recognize there are a few GRC (governance, risk, and compliance) solutions on the market. So, why should you pick Tandem? Based on feedback from individuals who have chosen Tandem, here are 10 reasons, in no particular order, why over 1400 organizations have chosen Tandem over other solutions.
In recent months, there has been a noted increase in the number of questions and conversations about the Bank Service Company Act (or "BSCA"). In this article, responses will be offered for several frequently asked questions, such as:
In February 2021, the Internal Revenue Service (IRS) published an alert regarding a new tax phishing scam. According to the alert, the malicious actor is impersonating the IRS and attempting to steal personally identifiable information, such as Electronic Filing Identification Numbers (EFINs) and drivers' license numbers. According to IRS Commissioner, Chuck Rettig, attempts like these are coming from bad actors who are "very active and very creative."
According to the Tandem State of Cybersecurity 2020 Survey Report, the top three incidents experienced in 2019 by financial institutions were social engineering (phishing), third-party compromise, and accidental security incidents by employees.