tandem - kn

"What is the difference between a risk assessment and a cybersecurity control self-assessment?" 

On Tuesday, October 24, 2023, the state bank regulators (CSBS), Bankers' Electronic Crimes Task Force, and United States Secret Service published an updated version of the Ransomware Self-Assessment Tool (R-SAT). In this blog, we'll discuss what the R-SAT is, what got updated, and what you need to do about it. 

On June 6, 2023, the Federal Deposit Insurance Corporation (FDIC), Federal Reserve (FRB), and Office of the Comptroller of the Currency (OCC) published new Interagency Guidance on Third-Party Relationships: Risk Management. Here are eight things community banks need to know about it. 

If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.

Since the effective date for the incident notification rule for banks, we have received several questions asking about whether an incident would be classified as a "notification incident" or not. For example:

During the development of our Incident Management product, we spent a lot of time researching and reviewing guidance, so we could know exactly what should be included in a financial institution's incident management program. While not an exhaustive list, if you are looking for guidance regarding what to include in your plan, the resource below will help you get started. 

On May 13, 2022, the FFIEC published an entry to the IT Examination Handbook Infobase What's New page stating that they had rescinded the E-Banking booklet. If you're anything like me, you may be asking questions like "why" and "what am I expected to do now?" If that's you, you've come to the right place. Let's answer those questions.

If you work in a financial institution, you may be familiar with using the terms "electronic banking," "internet banking," and "mobile banking" interchangeably. With the publication of the FFIEC's new Authentication and Access to Financial Institution Services and Systems guidance, a new term appeared: "digital banking." The introduction of this new term made me wonder, what does it all mean? Should these terms be used interchangeably and if not, what exactly are the differences among them?  

Every member of your staff is responsible for doing their part to help secure the organization from incidents, but do they know that? Employee training is a significant component of an effective incident management program. In this article, we are going to explore training benefits, target audience, potential topics, and available resources.

On December 9, 2021, the Federal Trade Commission (FTC) published their revised Standards for Safeguarding Customer Information (16 CFR Part 314) in accordance with the Gramm-Leach-Bliley Act (GLBA). This updated rule exists to improve how financial institutions regulated by the FTC develop and implement their information security programs.