<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Don’t Blow It at Exam Time - Pay Attention to the FFIEC Cybersecurity Assessment Tool

author Michael Berman
3 min read
Nov 1, 2016

Remember when you were in college and had to decide if you’d do the recommended reading for a class? It wasn’t exactly mandatory, but you never knew if that material would show up on a test. You were taking a risk if you chose to ignore it.

Financial institutions run the same risk today if they ignore the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool. Released last year, the assessment tool helps institutions identify their risks and determine their cybersecurity preparedness by providing “a repeatable and measurable process for financial institutions to measure their cybersecurity preparedness over time.”

Now the FFIEC has released a Frequently Asked Questions about the assessment tool. While banks and credit unions have been disappointed in the limited amounts of new information in the FAQ, there’s something to be said about how it repeats a common and slightly misunderstood word: voluntary.

The FFIEC continues to say the tool is voluntary, but the truth is the FFIEC itself doesn’t really have much enforcement authority. That’s the domain its members, which is what makes the answer to Question 12, “How are the FFIEC members using this Assessment?,” extremely important.

The answer: “To obtain additional information about a particular FFIEC member’s use of the Assessment, financial institution management should contact its institution’s regulator directly.”

Wait. So the FFIEC says it’s voluntary, but check with your regulator to make sure it’s really voluntary. What do the agencies have to say?

OCC. In a press release announcing the assessment tool last year the OCC said: “While use of the Assessment is optional for financial institutions, OCC examiners will use the Assessment to supplement exam work to gain a more complete understanding of an institution’s inherent risk, risk management practices, and controls related to cybersecurity. OCC examiners will begin incorporating the Assessment into examinations in late 2015.”

FDIC. In a press release introducing the assessment, the FDIC said using the assessment was “voluntary.” It also noted that “FDIC examiners will discuss the Cybersecurity Assessment Tool with institution management during examinations to ensure awareness and assist with answers to any questions.”

Fed. In a supervision and regulation letter last July, the Fed said, “Beginning in late 2015 or early 2016, the Federal Reserve plans to utilize the assessment tool as part of our examination process when evaluating financial institutions’ cybersecurity preparedness in information technology and safety and soundness examinations and inspections.”

NCUA. The agency’s website says “NCUA examiners will use the tool as a guide for assessing cybersecurity risks in credit unions. Credit unions may choose whatever approach they feel appropriate to conduct their individual assessments, but the assessment tool would still be a useful guide.”

Meanwhile in what may become a trend, the Texas Department of Banking “encourages banks to use the FFIEC Cybersecurity Assessment Tool, as it is the only methodology [for measuring inherent cyber risks and cybersecurity preparedness] specifically designed for the banking industry, particularly community banks.”

That clears it up, doesn’t it? It’s optional, but it may be part of the exam process. You don’t have to study, but the material might be on the test.

So what’s the right thing to do?

  1. Accept that the assessment tool is here to stay. Financial institutions have pointed out flaws with the tool, but the FFIEC has made it clear that it’s not changing anything. Hoping it will be different or disappear is a waste of time.
  2. Think long and hard about the risk assessment process your FI uses to identify inherent risk and cybersecurity preparedness. Chances are you’re already engaging in many of the activities recommended by the assessment in different departments at your institution—from IT to vendor management.
  3. Consider a tool to break those silos and simplify and unify elements of the FFIEC’s exercise throughout your institution. Ncontracts offers Ncyber, an automated workflow tool designed to walk you through the FFIEC’s Cybersecurity Assessment Tool.

However your institution chooses to treat the assessment tool, make sure you seriously consider its implications—and make a strategic decision about its use. You don’t want any surprises come exam time.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Much Ado About Nothing: Update to the FFIEC Cybersecurity Assessment Tool Barely Worth a Mention
Risk & Compliance

Much Ado About Nothing: Update to the FFIEC Cybersecurity Assessment Tool Barely Worth a Mention

Jun 27, 2017 1 min read
FFIEC Guidelines
Risk & Compliance

FFIEC Guidelines

Nov 13, 2018 1 min read
New BCP Guidance from the FFIEC
Risk & Compliance

New BCP Guidance from the FFIEC

Feb 26, 2015 1 min read