State Financial Regulators Issue Ransomware Mitigation Tool

Alston & Bird

On October 13, 2020, state financial regulators in partnership with the Bankers Electronic Crimes Taskforce and the U.S. Secret Service, released the Ransomware Self-Assessment Tool (R-SAT) to help financial institutions mitigate the risks of ransomware.  The R-SAT is a detailed questionnaire designed to evaluate the effectiveness of an institution’s general security controls as well as to assist its executive management and the board of director in identifying, responding, and recovering from a ransomware attack.  For example, the R-SAT includes questions regarding:

  •  Adherence to a comprehensive set of security control frameworks (such as CIS Controls, COBIT, ISO, NIST, or PCI-DSS);
  • Performance of a gap assessment against that security framework;
  • Presence of a valid cyber policy that addresses ransomware;
  • Identification of information resources; and
  • Third-party vendor access controls.

For banks, the R-SAT is not simply general guidance that may result in additional regulatory inquiry.  State banking commissioners across the country are releasing this tool to their institutions, which means that these questions could be asked in the process of regulatory oversight.  In particular, the Texas Division of Banks stated that it will contact institutions in the first half of 2021 to “discuss [the institution’s] progress in implementing ransomware mitigation as well as all aspects of the R-SAT.”  It also noted that information technology examinations scheduled in the first half of 2021 will include a review of the financial institution’s completed R-SAT.

With this release, state financial regulators remind financial institutions to be vigilant against increasingly sophisticated ransomware attacks. Regulators also remind financial institutions that paying a ransom could expose financial institutions (and incident response consultants) to civil penalties if the payment is made to a cybercriminal sanctioned by Treasury’s Office of Foreign Assets Control (OFAC) (Alston recently covered OFAC’s ransomware advisory here).

Although “there is no single measure to prevent ransomware attacks,” state financial regulators stress that strong backup practices and the use of multi-factor authentication are two of the most important. In many respects, the R-SAT continues to affirm good cyber hygiene in accordance with existing cybersecurity frameworks and industry best practices.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Alston & Bird | Attorney Advertising

Written by:

Alston & Bird

Alston & Bird on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.