For bank customers, a discussion of cybersecurity standards can sound like either an alarm or a reassurance. The notice published October 26, 2016 was neither a report of a particular breach nor a guarantee against one. The Federal Reserve, FDIC and Office of the Comptroller of the Currency were seeking comments on potential enhanced standards for large, interconnected financial entities. [2016-25871]

The agencies described their aim as increasing operational resilience and reducing the financial-system impact of a cyber event. Their five areas included governance, risk management, dependencies inside and outside an organization, and incident response and resilience. The public-interest issue is continuity: the proposal addressed how institutions withstand disruption, rather than simply whether they possess a cybersecurity policy. [2016-25871]

The October 19 joint announcement also defined important boundaries. The agencies were considering coverage of depository institutions and holding companies with at least $50 billion in consolidated assets, and foreign banking organizations' U.S. operations with at least $50 billion in U.S. assets. Certain Board-supervised financial infrastructure and nonbank companies were also contemplated. The enhanced standards would not apply to community banks. [fed-cyber-release]

Our reading is that customers should distinguish an institutional resilience objective from a demonstrated improvement in their own service. Potential higher standards for sector-critical systems remained under consideration, and comments were due January 17, 2017. The announcement and Register notice belong to the same regulatory effort, not two independent confirmations of safety. They establish what regulators wanted to explore, not what protections had already delivered. [2016-25871][fed-cyber-release]

Source documents

  1. Enhanced Cyber Risk Management Standardshttps://www.govinfo.gov/content/pkg/FR-2016-10-26/html/2016-25871.htm
  2. Agencies issue advance notice of proposed rulemaking on enhanced cyber risk management standardshttps://www.federalreserve.gov/newsevents/pressreleases/bcreg20161019a.htm