<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Much Ado About Nothing: Update to the FFIEC Cybersecurity Assessment Tool Barely Worth a Mention

author Michael Berman
1 min read
Jun 27, 2017

When the FFIEC announced an update to Cybersecurity Assessment Tool last month, my team and I dug in ready to assess the changes.

There’s not much to report. The change barely even registers a blip on the proverbial radar.

None of the cybersecurity risks or maturity declarative statements changed. The cybersecurity maturity evaluation process added the ability to answer ‘yes with compensating controls’ and some additional references were provided for Appendix A: Mapping Baseline Statements to FFIEC IT Examination Handbook. It’s a blink-and-you’ll-miss-it adjustment—but it took a team of three experts scouring the 137-page guidance document to ensure we weren’t missing anything.

Implementing the change into Ncyber

The change, minor though it may be, has already been implemented into Ncyber, an online, easy-to-use version of the FFIEC Cybersecurity Assessment Tool. That means the financial institutions using the product not only didn’t have to waste time understanding this minuscule change, but when they next review the tool, it will be easy to see if the edits to the question impact their institution’s cybersecurity assessment.

It’s all about keeping pace. When it comes to regulators, regulation, laws, and guidance, it’s essential to be thorough. You don't ever want to miss anything! Our team of experts speak fluent legalese and dig through every change to see if adjustments need to be made to any of our products—or in the guidance and analysis we provide our clients.

Conclusion

Whatever you do to analyze new regulatory output, make sure it’s done regularly by someone with the knowledge to understand what it all means. Avoid the risk of misinterpretations when translating legalese into plain English.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Regulatory Brief for October 2022: CFPB continues rulemaking while fending off legal challenges & regulators getting serious about “unfair” fees and expanding the Durbin amendment
Risk & Compliance

Regulatory Brief for October 2022: CFPB continues rulemaking while fending off legal challenges & regulators getting serious about “unfair” fees and expanding the Durbin amendment

Nov 8, 2022 2 min read
Don’t Blow It at Exam Time - Pay Attention to the FFIEC Cybersecurity Assessment Tool
Risk & Compliance

Don’t Blow It at Exam Time - Pay Attention to the FFIEC Cybersecurity Assessment Tool

Nov 1, 2016 3 min read
FFIEC Guidelines
Risk & Compliance

FFIEC Guidelines

Nov 13, 2018 1 min read