<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Much Ado About Nothing: Update to the FFIEC Cybersecurity Assessment Tool Barely Worth a Mention

author Michael Berman
1 min read
Jun 27, 2017

When the FFIEC announced an update to Cybersecurity Assessment Tool last month, my team and I dug in ready to assess the changes.

There’s not much to report. The change barely even registers a blip on the proverbial radar.

None of the cybersecurity risks or maturity declarative statements changed. The cybersecurity maturity evaluation process added the ability to answer ‘yes with compensating controls’ and some additional references were provided for Appendix A: Mapping Baseline Statements to FFIEC IT Examination Handbook. It’s a blink-and-you’ll-miss-it adjustment—but it took a team of three experts scouring the 137-page guidance document to ensure we weren’t missing anything.

Implementing the change into Ncyber

The change, minor though it may be, has already been implemented into Ncyber, an online, easy-to-use version of the FFIEC Cybersecurity Assessment Tool. That means the financial institutions using the product not only didn’t have to waste time understanding this minuscule change, but when they next review the tool, it will be easy to see if the edits to the question impact their institution’s cybersecurity assessment.

It’s all about keeping pace. When it comes to regulators, regulation, laws, and guidance, it’s essential to be thorough. You don't ever want to miss anything! Our team of experts speak fluent legalese and dig through every change to see if adjustments need to be made to any of our products—or in the guidance and analysis we provide our clients.

Conclusion

Whatever you do to analyze new regulatory output, make sure it’s done regularly by someone with the knowledge to understand what it all means. Avoid the risk of misinterpretations when translating legalese into plain English.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Regulatory Brief for October 2022: CFPB continues rulemaking while fending off legal challenges & regulators getting serious about “unfair” fees and expanding the Durbin amendment
Risk & Compliance

Regulatory Brief for October 2022: CFPB continues rulemaking while fending off legal challenges & regulators getting serious about “unfair” fees and expanding the Durbin amendment

Nov 8, 2022 2 min read
Business Resiliency: Your Guide to Business Continuity Management
Banks

Business Resiliency: Your Guide to Business Continuity Management

Sep 23, 2020 6 min read
FFIEC Guidelines
Risk & Compliance

FFIEC Guidelines

Nov 13, 2018 1 min read