Posts about:
Since 2017, we have experienced several changes in the NCUA IT examination process, from ACET, to InTREx-CU, to a new acronym, ISE. This article will tell you what you can expect in your 2023 exam and take you through a bit of the history of each acronym.
Since the effective date for the incident notification rule for banks, we have received several questions asking about whether an incident would be classified as a "notification incident" or not. For example:
During the development of our Incident Management product, we spent a lot of time researching and reviewing guidance, so we could know exactly what should be included in a financial institution's incident management program. While not an exhaustive list, if you are looking for guidance regarding what to include in your plan, the resource below will help you get started.
On July 21, 2022, the National Credit Union Administration (NCUA) published a new proposed rule titled "Cyber Incident Notification Requirements for Federally Insured Credit Unions." In this article, we will review the proposed rule; compare the requirements with the recently published incident notification rule for banks by the FDIC, OCC, and Federal Reserve; and discuss what credit unions can do in response.
Every member of your staff is responsible for doing their part to help secure the organization from incidents, but do they know that? Employee training is a significant component of an effective incident management program. In this article, we are going to explore training benefits, target audience, potential topics, and available resources.
Before You Read: This blog is about the original Cyber Incident Reporting Act and may contain outdated information. For an updated overview of the CIRCIA requirements, see our blog: A Financial Institution's Guide to CISA's Proposed CIRCIA Reporting Requirements.
On January 18, 2022, the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) released a new "Insights" memo with a title that is a direct call to action: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats.
In January 2021, we asked a group of 175 financial institution cybersecurity professionals if their organization had a formal incident tracking system.
On November 18, 2021, the FDIC, OCC, and Federal Reserve published a final rule titled "Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers." This guide is designed to break down the new rule and its expectations to prepare you before the rule goes into effect on April 1, 2022.
Organizations invest in technology because it improves efficiency, communications, data storage, and business growth opportunities. With increased use of technology comes an increased attack exposure from threat actors, so it is important to evaluate and manage cyber risk related to new and existing technologies.