FDIC bank examinations generally include a focus on the IT systems of banks with a particular focus on information security. The federal banking agencies issued Interagency Guidelines Establishing Information Security Standards (“Interagency Guidelines”) in 2001. In 2005, the FDIC developed the Information Technology—Risk Management Program (IT-RMP), based largely on the Interagency Guidelines, as a risk-based approach for conducting IT examinations at FDIC-supervised banks. The FDIC also uses work programs developed by the Federal Financial Institutions Examination Council (“FFIEC”) to conduct IT examinations of service providers.

The examination process relies on bank management attestations regarding the extent to which IT risks are being managed and controlled. Examiners focus their efforts on management-identified weaknesses and may confirm selected safeguards described by management as adequate. Nonetheless, reports by the Office of the Inspector General within the FDIC indicate that examiners may not be consistent in their review of bank compliance with the Interagency Guidelines and do not regularly provide a clear statement of adequacy on intrusion detection programs and incident response plans. The following provides a snapshot of information concerning FDIC IT examinations.

 What bank directors should be thinking about when preparing for an examination:

1. Is the Board comfortable that the Bank has management qualified to oversee all aspects of the Bank’s IT operations, including compliance with all applicable data security laws and regulations?
2. Is there a designated Vendor Management Coordinator in the Bank with an appropriate level of due diligence and vendor risk modeling experience for the type and quality of the Bank’s IT services?
3. Do the directors understand what IT services are being outsourced and whether the Bank’s Vendor Management Program meets the requirements and guidance of the FFIEC IT Examination Handbook, Outsourcing Technology Services?
4. Does the Bank’s Business Continuity Planning/Disaster Recovery Plan (“BCP/DR” Plan) adequately address the sudden loss of IT services?
5. When did senior management last review the organization’s incident response portion of the BCP/DR Plan?
6. Has the incident response plan been strategically tested (e.g., a breach tabletop simulation)?
7. Has the incident response plan been operationally tested (e.g., a breach simulation)?
8. Does the organization have a plan for how it would communicate a breach to bank customers, regulators and law enforcement?
9. Has the organization retained cyber insurance coverage? Does management understand what is, and what is not, covered under the policy?
10. Does the organization have external resources already identified, and under contract, to provide assistance in the event of a security incident?

1. FDIC Office of Inspector General, Report No. EVAL-15.003 (Mar. 2015).

2. Id.

3. Id.