[Federal Register Volume 81, Number 207 (Wednesday, October 26, 2016)]
[Proposed Rules]
[Pages 74315-74326]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2016-25871]
========================================================================
Proposed Rules
Federal Register
________________________________________________________________________
This section of the FEDERAL REGISTER contains notices to the public of
the proposed issuance of rules and regulations. The purpose of these
notices is to give interested persons an opportunity to participate in
the rule making prior to the adoption of the final rules.
========================================================================
Federal Register / Vol. 81, No. 207 / Wednesday, October 26, 2016 /
Proposed Rules
[[Page 74315]]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF THE TREASURY
Office of the Comptroller of the Currency
12 CFR Part 30
[Docket ID OCC-2016-0016]
RIN 1557-AE06
FEDERAL RESERVE SYSTEM
12 CFR Chapter II
[Docket No. R-1550]
RIN 7100-AE 61
FEDERAL DEPOSIT INSURANCE CORPORATION
12 CFR Part 364
RIN 3064-AE45
Enhanced Cyber Risk Management Standards
AGENCY: The Board of Governors of the Federal Reserve System; the
Office of the Comptroller of the Currency; and the Federal Deposit
Insurance Corporation.
ACTION: Joint advance notice of proposed rulemaking.
-----------------------------------------------------------------------
SUMMARY: The Board of Governors of the Federal Reserve System (Board),
the Office of the Comptroller of the Currency (OCC), and the Federal
Deposit Insurance Corporation (FDIC) (collectively, the agencies) are
inviting comment on an advance notice of proposed rulemaking (ANPR)
regarding enhanced cyber risk management standards (enhanced standards)
for large and interconnected entities under their supervision and those
entities' service providers. The agencies are considering establishing
enhanced standards to increase the operational resilience of these
entities and reduce the impact on the financial system in case of a
cyber event experienced by one of these entities. The ANPR addresses
five categories of cyber standards: Cyber risk governance; cyber risk
management; internal dependency management; external dependency
management; and incident response, cyber resilience, and situational
awareness. The agencies are considering implementing the enhanced
standards in a tiered manner, imposing more stringent standards on the
systems of those entities that are critical to the functioning of the
financial sector.
DATES: Comments must be received by January 17, 2017.
ADDRESSES: Comments should be directed to:
Board: When submitting comments, please consider submitting your
comments by email or fax because paper mail in the Washington, DC area
and at the Board may be subject to delay. You may submit comments,
identified by Docket No. R-1550 and RIN 7100-AE-61 by any of the
following methods:
Agency Web site: http://www.federalreserve.gov. Follow the
instructions for submitting comments at http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.
Federal eRulemaking Portal: http://www.regulations.gov.
Follow the instructions for submitting comments.
Email: [email protected]. Include docket
and RIN numbers in the subject line of the message.
FAX: (202) 452-3819 or (202) 452-3102.
Mail: Robert deV. Frierson, Secretary, Board of Governors of the
Federal Reserve System, 20th Street and Constitution Avenue NW.,
Washington, DC 20551.
All public comments will be made available on the Board's Web site
at http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as
submitted, unless modified for technical reasons. Accordingly, your
comments will not be edited to remove any identifying or contact
information. Public comments may also be viewed electronically or in
paper form in Room 3515, 1801 K Street NW. (between 18th and 19th
Streets NW.), Washington, DC 20006 between 9:00 a.m. and 5:00 p.m. on
weekdays. For security reasons, the Board requires that visitors make
an appointment to inspect comments. You may do so by calling (202) 452-
3684. Upon arrival, visitors will be required to present valid
government-issued photo identification and to submit to security
screening in order to inspect and photocopy comments.
OCC: Because paper mail in the Washington, DC area and at the OCC
is subject to delay, commenters are encouraged to submit comments
through the Federal eRulemaking Portal or email, if possible. Please
use the title ``Enhanced Cyber Risk Management Standards'' to
facilitate the organization and distribution of the comments. You may
submit comments by any of the following methods:
Federal eRulemaking Portal--``Regulations.gov'': Go to
www.regulations.gov. Enter ``Docket ID OCC-2016-0016'' in the Search
Box and click ``Search.'' Click on ``Comment Now'' to submit public
comments.
Click on the ``Help'' tab on the Regulations.gov home page
to get information on using Regulations.gov, including instructions for
submitting public comments.
Email: [email protected].
Mail: Legislative and Regulatory Activities Division,
Office of the Comptroller of the Currency, 400 7th Street SW., Suite
3E-218, mail stop 9W-11, Washington, DC 20219.
Hand Delivery/Courier: 400 7th Street SW., Suite 3E-218,
mail stop 9W-11, Washington, DC 20219.
Fax: (571) 465-4326.
Instructions: You must include ``OCC'' as the agency name and
``Docket ID OCC-2016-0016'' in your comment. In general, OCC will enter
all comments received into the docket and publish them on the
Regulations.gov Web site without change, including any business or
personal information that you provide such as name and address
information, email addresses, or phone numbers. Comments received,
including attachments and other supporting materials, are part of the
public record and subject to public disclosure. Do not enclose any
information in your comment or supporting materials that you consider
confidential or inappropriate for public disclosure.
You may review comments and other related materials that pertain to
this rulemaking action by any of the following methods:
Viewing Comments Electronically: Go to
www.regulations.gov. Enter ``Docket ID OCC-2016-0016'' in the Search
box and click ``Search.'' Click on ``Open Docket Folder'' on the right
side of the screen and then ``Comments.'' Comments can be filtered by
clicking on
[[Page 74316]]
``View All'' and then using the filtering tools on the left side of the
screen.
Click on the ``Help'' tab on the Regulations.gov home page
to get information on using Regulations.gov. Supporting materials may
be viewed by clicking on ``Open Docket Folder'' and then clicking on
``Supporting Documents.'' The docket may be viewed after the close of
the comment period in the same manner as during the comment period.
Viewing Comments Personally: You may personally inspect
and photocopy comments at the OCC, 400 7th Street SW., Washington, DC
20219. For security reasons, the OCC requires that visitors make an
appointment to inspect comments. You may do so by calling (202) 649-
6700 or, for persons who are deaf or hard of hearing, TTY, (202) 649-
5597. Upon arrival, visitors will be required to present valid
government-issued photo identification and to submit to security
screening in order to inspect and photocopy comments.
FDIC: You may submit comments, identified by RIN 3064-AE45, by any
of the following methods:
Agency Web site: http://www.fdic.gov/regulations/laws/federal/propose.html. Follow instructions for submitting comments on the Agency
Web site.
Email: [email protected]. Include the RIN 3064-AE45 on the
subject line of the message.
Mail: Robert E. Feldman, Executive Secretary, Attention:
Comments, Federal Deposit Insurance Corporation, 550 17th Street NW.,
Washington, DC 20429.
Hand Delivery: Comments may be hand delivered to the guard
station at the rear of the 550 17th Street Building (located on F
Street) on business days between 7:00 a.m. and 5:00 p.m.
Public Inspection: All comments received must include the agency
name and RIN 3064-AE45 for this rulemaking. All comments received will
be posted without change to http://www.fdic.gov/regulations/laws/federal/propose.html, including any personal information provided.
Paper copies of public comments may be ordered from the FDIC Public
Information Center, 3501 North Fairfax Drive, Room E-1002, Arlington,
VA 22226 by telephone at (877) 275-3342 or (703) 562-2200.
FOR FURTHER INFORMATION CONTACT:
Board: Anna Lee Hewko, Associate Director, (202) 530-6260; or
Matthew Hayduk, Manager, (202) 973-6190; or Julia Philipp, Senior
Supervisory Financial Analyst, (202) 452-3940; or Christopher Olson,
Senior Supervisory Financial Analyst, (202) 912-4609, Division of
Banking Supervision and Regulation; or Benjamin W. McDonough, Special
Counsel, (202) 452-2036; or Claudia Von Pervieux, Counsel, (202) 452-
2552; or Michelle Kidd, Counsel, (202) 736-5554, Legal Division; for
persons who are deaf or hard of hearing, TTY (202) 263-4869.
OCC: Bethany Dugan, Deputy Comptroller for Operational Risk, (202)
649-6949; or Kevin Greenfield, Director, Bank Information Technology,
(202) 649-6954; or Eric Gott, Risk Team Lead for Governance and
Operational Risk, Large Bank Supervision, (202) 649-7181; or Patrick
Kelly, Bank Examiner, Critical Infrastructure Protection, (202) 649-
5519; or Carl Kaminski, Special Counsel, Beth Knickerbocker, Counsel,
or Rima Kundnani, Attorney, Legislative and Regulatory Activities
Division, (202) 649-5490, Office of the Comptroller of the Currency,
400 7th Street SW., Washington, DC 20219.
FDIC: Donald Saxinger, Senior Examination Specialist, IT
Supervision Branch, Division of Risk Management Supervision, (703) 254-
0214; or John Dorsey, Counsel, (202) 898-3807. Supervision &
Legislation Branch, Legal Division.
I. Background
With advances in financial technology, financial institutions and
consumers alike have become increasingly dependent on technology to
facilitate financial transactions. In addition, the largest, most
complex financial institutions rely heavily on technology to engage in
national and international banking activities and to provide critical
services to the financial sector and the U.S. economy.
As technology dependence in the financial sector continues to grow,
so do opportunities for high-impact technology failures and cyber-
attacks. Due to the interconnectedness of the U.S. financial system, a
cyber incident or failure at one interconnected entity may not only
impact the safety and soundness of the entity, but also other financial
entities with potentially systemic consequences. For example,
depository institutions and depository institution holding companies
play an important role in U.S. payment, clearing, and settlement
arrangements and provide access to credit for businesses and
households. Nonbank financial companies that the Financial Stability
Oversight Council (FSOC) has determined should be supervised by the
Board (referred to in the ANPR as nonbank financial companies) perform
critical functions for the U.S. financial system, and financial market
infrastructures (FMIs) facilitate the payment, clearing, and recording
of monetary and other financial transactions and services and play
critical roles in fostering financial stability in the United States.
Third parties that provide payments processing, core banking, and other
financial technology services to these participants in the financial
sector also provide services that are vital to the financial sector.
The Board, the OCC, and the FDIC have incorporated information
security into their supervisory review of information technology (IT)
programs at supervised banking organizations for many years. The
agencies also review the services of third-party service providers that
support those entities, and the Board includes information security as
part of the supervisory program for nonbank financial companies and
FMIs.
In response to expanding cyber risks, the agencies are considering
establishing enhanced standards for the largest and most interconnected
entities under their supervision, as well as for services that these
entities receive from third parties. The term ``covered entities'' is
used throughout this document to refer to entities potentially covered
by the standards described in this ANPR. The enhanced standards would
be designed to increase covered entities' operational resilience and
reduce the potential impact on the financial system in the event of a
failure, cyber-attack, or the failure to implement appropriate cyber
risk management.
The agencies are considering implementing the enhanced standards in
a tiered manner, imposing more stringent standards on the systems of
covered entities that are critical to the functioning of the financial
sector, referred to in this ANPR as ``sector-critical systems.''
The agencies are seeking comment on all aspects of the enhanced
standards described in this ANPR. The agencies plan to use information
collected in this ANPR to develop a more detailed proposal for
consideration. The agencies will again invite public comment on a
detailed proposal before adopting any final rule.
II. Relationship to Existing Requirements and Guidance
a. Existing Supervisory Programs
As noted, the agencies have existing supervisory programs that
contain general expectations for cybersecurity practices at financial
institutions and third-party service providers. The enhanced standards
would be integrated into the existing supervisory framework by
establishing enhanced supervisory
[[Page 74317]]
expectations for the entities and services that potentially pose
heightened cyber risk to the safety and soundness of the financial
sector.
Through the Federal Financial Institutions Examination Council
(FFIEC), the agencies issued the Uniform Rating System for Information
Technology (URSIT) in 1978 (revised January 20, 1999).\1\ The URSIT
rating is used by federal and state regulators to uniformly assess IT
risks at financial institutions, their affiliates, and service
providers \2\ for the purpose of identifying those institutions that
require special supervisory attention. The URSIT framework includes
elements to assess data security and other risk management factors
necessary to determine the quality, integrity, and reliability of the
financial institution's or third-party service provider's IT. The
proposed enhanced standards would not replace the URSIT ratings but
could be used, in part, to inform the cyber-related elements of the
URSIT rating for covered entities. For example, supervisory work
related to the proposed external dependency management standard
discussed in this ANPR could be used, in part, to inform the
development and acquisition component of the URSIT rating.
---------------------------------------------------------------------------
\1\ 64 FR 3109, January 20, 1999.
\2\ The agencies have statutory authority to supervise and
examine services provided by third-party service providers to
regulated financial institutions under the Bank Service Company Act
(12 U.S.C. 1867(c)).
---------------------------------------------------------------------------
In 2003, the FFIEC published the first in a series of booklets on
IT that make up the IT Handbook. The IT Handbook provides guidance to
examiners in reviewing financial institutions and services provided by
third parties. Certain booklets, such as the Business Continuity
Planning booklet and the Information Security booklet, incorporate the
agencies' expectations regarding cybersecurity risk management. The IT
Handbook also includes work programs that an examiner may use to aid in
assessing a company's URSIT rating. IT Handbook guidance would continue
to be used for covered entities to assess IT risk management.
In 1999, Title V, Subtitle A of the Gramm-Leach-Bliley Act (GLBA)
\3\ required that each agency establish appropriate administrative,
technical, and physical controls for the safeguarding of financial
institutions' customer information. In 2000, the agencies published the
Interagency Guidelines Establishing Information Security Standards
(Guidelines) implementing the GLBA safeguarding requirements.\4\ The
Guidelines require insured depository institutions to implement
information security programs to ensure the security and
confidentiality of customer information; protect against any
anticipated threats or hazards to the security or integrity of such
information; protect against unauthorized access to or use of such
information that could result in substantial harm or inconvenience to
any customer; and ensure the proper disposal of customer and consumer
information.
---------------------------------------------------------------------------
\3\ 15 U.S.C. 6801-6809.
\4\ See 12 CFR part 208, App. D-2 and 12 CFR part 225, App. F
(Board); 12 CFR 30, App. B (OCC); and 12 CFR part 364, App. B and 12
CFR part 391, subpart B, App. B (FDIC).
---------------------------------------------------------------------------
Additionally, the agencies have interagency guidelines that
establish safety and soundness standards, including operational and
managerial standards, for depository institutions.\5\ These guidelines
require an insured depository institution to have internal controls and
information systems appropriate to the size of the institution and to
the nature, scope, and risk of its activities and that provide for,
among other requirements, effective risk assessment and adequate
procedures to safeguard and manage assets. Insured depository
institutions are also required to have internal audit systems based on
the same criteria that provide for adequate testing and review of
information systems. The Guidelines and safety and soundness standards
would continue to apply to covered entities that are insured depository
institutions.
---------------------------------------------------------------------------
\5\ See 12 CFR part 30, App. A and D, 12 CFR part 208, App. D-1,
12 CFR part 225, App. F.
---------------------------------------------------------------------------
b. FFIEC Cybersecurity Assessment Tool
In June 2015, the FFIEC issued the Cybersecurity Assessment Tool
(Assessment) as a voluntary self-assessment tool that financial
institutions, including covered entities, may use to help assess their
cyber risks and determine their cybersecurity preparedness.
The Assessment provides institutions with a repeatable and
measurable process to determine whether the institutions have
appropriate controls and risk management in place relative to the
inherent risk profile of the institution. The Assessment incorporates
baseline cybersecurity-related categories from the FFIEC IT Handbook,
as well as key concepts from the National Institute of Standards and
Technology (NIST) Cybersecurity Framework (CSF) and other industry best
practices. However, the Assessment does not establish binding minimum
standards.
c. NIST Cybersecurity Framework
The NIST CSF is a voluntary framework for organizations to better
understand, manage, and reduce their cybersecurity risk. The CSF is
intended to be customized by different business sectors and individual
organizations to best suit their risks, situation, and needs. It was
also designed to improve communications, awareness, and understanding
among IT, planning and operating units, and senior executives, to
better address cyber risks. The NIST CSF Core consists of five
concurrent and continuous functions: Identify, Protect, Detect,
Respond, and Recover. Taken together, these functions provide a high-
level, strategic view of the lifecycle of an organization's management
of cybersecurity risk.
Similar to the NIST CSF, the enhanced standards would provide a
clear set of objectives for sound cyber risk management. However, the
binding requirements set forth in the enhanced standards would be
designed specifically to address the cyber risks of the largest, most
interconnected U.S. financial entities.
d. CPMI-IOSCO Guidance
In June 2016, the Committee on Payments and Market Infrastructures
(CPMI) and the Board of the International Organization of Securities
Commissions (IOSCO) released ``Guidance on cyber resilience for
financial market infrastructures.'' \6\ According to CPMI and IOSCO,
the guidance ``aims to add momentum to and instill international
consistency in the industry's ongoing efforts to enhance FMIs' ability
to preempt cyber-attacks, respond rapidly and effectively to them, and
achieve faster and safer target recovery objectives if they succeed.''
\7\ The guidance is intended to supplement the CPMI-IOSCO Principles
for Financial Market Infrastructures (PFMI) and is ``not intended to
impose additional standards on FMIs beyond those set out in the PFMI,
but provides detail related to the preparations and measures that FMIs
should undertake to enhance their cyber resilience capabilities with
the objective of limiting the escalating risks that cyber threats pose
to financial stability.'' \8\ The agencies reviewed the CPMI-IOSCO
guidance and took it into consideration as they developed the proposed
enhanced standards described in this ANPR.
---------------------------------------------------------------------------
\6\ See http://www.bis.org/cpmi/publ/d146.pdf.
\7\ See http://www.bis.org/cpmi/publ/d146.htm.
\8\ See http://www.bis.org/cpmi/publ/d146.pdf.
---------------------------------------------------------------------------
[[Page 74318]]
e. Interagency Paper on Sound Practices To Strengthen the Resilience of
the U.S. Financial System
In April 2003, the Board, the OCC, and the Securities and Exchange
Commission issued the Interagency Paper on Sound Practices to
Strengthen the Resilience of the U.S. Financial System (Sound Practices
Paper).\9\ The Sound Practices Paper focuses on minimizing the
immediate systemic effects of a wide-scale disruption on critical
financial markets and on establishing the appropriate back-up capacity
for recovery and resumption of clearance and settlement activities in
wholesale financial markets. As discussed in sections IV and VI, the
agencies took the Sound Practices Paper into consideration as they
developed the proposed enhanced standards described in this ANPR.
---------------------------------------------------------------------------
\9\ Available at: http://www.sec.gov/news/studies/34-47638.htm.
---------------------------------------------------------------------------
III. Scope of Application
The agencies are considering applying the enhanced standards to
certain entities with total consolidated assets of $50 billion or more
on an enterprise-wide basis. A cyber-attack or disruption at one or
more of these entities could have a significant impact on the safety
and soundness of the entity, other financial entities, and the U.S.
financial sector. The agencies are considering applying the enhanced
standards to these entities on an enterprise-wide basis because cyber
risks in one part of an organization could expose other parts of the
organization to harm.
Each agency would apply these standards to large institutions
subject to their jurisdiction.\10\ Thus, the Board is considering
applying the enhanced standards on an enterprise-wide basis to all U.S.
bank holding companies with total consolidated assets of $50 billion or
more, the U.S. operations of foreign banking organizations with total
U.S. assets of $50 billion or more, and all U.S. savings and loan
holding companies with total consolidated assets of $50 billion or
more.\11\ In this regard, the proposed standards would apply to
subsidiaries of depository institution holding companies (other than
depository institutions supervised by the OCC and FDIC) in view of the
subsidiaries' potential to act as points of cyber vulnerability to the
covered entities. The Board is also considering applying the standards
to nonbank financial companies supervised by the Board pursuant to
section 165 of the Dodd-Frank Wall Street Reform and Consumer
Protection Act (Dodd-Frank Act), which directs the Board to establish
enhanced prudential standards, including overall risk management
standards, for these entities.\12\ Similarly, the Board is considering
applying the standards to financial market utilities designated by FSOC
(designated FMUs) for which the Board is the Supervisory Agency
pursuant to sections 805 and 810 of the Dodd-Frank Act; other FMIs over
which the Board has primary (not backup) supervisory authority because
the FMIs are members of the Federal Reserve System; and FMIs that are
operated by the Federal Reserve Banks (collectively referred to as
``Board-supervised FMIs'').\13\
---------------------------------------------------------------------------
\10\ 12 U.S.C. 321, 1818, 1831p-1 (Board); 12 U.S.C. 1, 93a,
161, 481, 1463, 1464, 1818, 1831p-1, 3901, 3909 (OCC); 12 U.S.C.
1818, 1819, 1831p-1 (FDIC).
\11\ 12 U.S.C. 1467a(g), 5365.
\12\ 12 U.S.C. 5365.
\13\ 12 U.S.C. 5464(a), 5469; 12 U.S.C. 330, 1818, 1831a; 12
U.S.C. 248(j).
---------------------------------------------------------------------------
The OCC is considering applying the standards to any national bank,
federal savings association (and any subsidiaries thereof), or federal
branch of a foreign bank that is a subsidiary of a bank holding company
or savings and loan holding company with total consolidated assets of
$50 billion or more, or any national bank, federal savings association,
or federal branch of a foreign bank that has total consolidated assets
of $50 billion or more that does not have a parent holding company. The
Board is considering applying the standards to any state member bank
(and any subsidiaries thereof) that is a subsidiary of a bank holding
company with total consolidated assets of $50 billion or more, and to
any state member bank that has total consolidated assets of $50 billion
or more that is not a subsidiary of a bank holding company. The FDIC is
considering applying the standards to any state nonmember bank or state
savings association (and any subsidiaries thereof) that is a subsidiary
of a bank holding company or savings and loan holding company with
total consolidated assets of $50 billion or more. Additionally, the
FDIC is considering applying the standards to any state nonmember bank
or state savings association that has total consolidated assets of $50
billion or more that does not have a parent holding company.
As noted, the agencies are considering whether to apply the
standards to third-party service providers with respect to services
provided to depository institutions and their affiliates that are
covered entities (covered services). This would ensure consistent,
direct application of the standards regardless of whether a depository
institution or its affiliate conducted the operation itself, or whether
it engaged a third-party service provider to conduct the operation.
Direct application of the standards to these service providers could
have potential benefits, including facilitating supervisory action in
the event that a covered service was not meeting a proposed standard
and establishing an obligation for meeting the standard on the
depository institution or its affiliate, as well as on the third-party
provider of the covered service. The Board also is considering
requiring nonbank financial companies and Board-supervised FMIs to
verify that any services the nonbank financial company or Board-
supervised FMI receives from third parties are subject to the same
standards that would apply if the services were being conducted by the
nonbank financial company or Board-supervised FMI itself.
Other financial entities, including community banks that are not
covered entities, would continue to be subject to existing guidance,
standards, and examinations related to the provision of banking
services by third parties.
Questions on the Scope of Application
1. How should the agencies consider broadening or narrowing the
scope of entities to which the proposed standards would apply? What, if
any, alternative size thresholds or measures of risk to the safety and
soundness of the financial sector and the U.S. economy should the
agencies consider in determining the scope of application of the
standards? For example, should ``covered entity'' be defined according
to the number of connections an entity (including its service
providers) has to other entities in the financial sector, rather than
asset size? If so, how should the agencies define ``connections'' for
this purpose?
2. What are the costs and benefits of applying the standards to
covered entities on an enterprise-wide basis? If the agencies were to
consider exempting certain subsidiaries within a covered entity from
the standards, what criteria should be used to assess any such
exemptions? What safeguards should the agencies require from a
subsidiary seeking to be exempted from the standards to ensure that an
exempted subsidiary does not expose the covered entity to material
cyber risk?
3. What, if any, special considerations should be made regarding
application of the standards to savings and loan holding companies that
engage significantly in insurance or commercial activities?
[[Page 74319]]
4. What are the most effective ways to ensure that services
provided by third-party service providers to covered entities are
performed in such a manner as to minimize cyber risk? What are the
advantages and disadvantages of applying the standards to services by
requiring covered entities to maintain appropriate service agreements
or otherwise receive services only from third-party service providers
that meet the standards with regard to the services provided, rather
than applying the requirements directly to third-party service
providers?
5. What are the advantages and disadvantages of applying the
standards directly to service providers to covered entities? What
challenges would such an approach pose?
6. What factors are most important in determining an appropriate
balance between protecting the safety and soundness of the financial
sector through the possible application of the standards and the
implementation burden and costs associated with implementing the
standards?
IV. Sector-Critical Systems
The financial sector operates through a network of interrelated
markets and financial participants. As a result, a technology failure
or cyber-attack at one covered entity could have wide-ranging effects
on the safety and soundness of other financial entities, both within
and outside the United States. While this interconnectedness warrants
comprehensive cyber risk management by all financial market
participants, it is especially important in the case of covered
entities with sector-critical systems.
Thus, the agencies are considering establishing a two-tiered
approach, with the enhanced standards applying to all systems of
covered entities, and an additional, higher set of expectations,
referred to in the ANPR as ``sector-critical standards,'' applying to
those systems of covered entities that are critical to the financial
sector.
As discussed below in the ANPR, the agencies are proposing sector-
critical standards in four of the five categories of standards that
would require covered entities with sector-critical systems to
substantially mitigate the risk of a disruption due to a cyber event to
their sector-critical systems.
Previously in the Sound Practices Paper, the Board and the OCC,
together with the Securities and Exchange Commission, introduced
definitions of ``critical financial markets'' and ``firms that play
significant roles in critical financial markets,'' which emphasized the
need to protect the most critical elements of the financial system from
serious new risks posed in the post-September 11 environment. In the
Sound Practices Paper, ``critical financial markets'' are defined as
the markets for federal funds, foreign exchange, and commercial paper;
U.S. Government and agency securities; and corporate debt and equity
securities. The Sound Practices Paper further provides: ``firms that
play significant roles in critical financial markets are those that
participate (on behalf of themselves or their customers) with
sufficient market share in one or more critical financial markets such
that their failure to settle their own or their customers' material
pending transactions by the end of the business day could present
systemic risk. While there are different ways to gauge the significance
of such firms in critical markets, as a guideline, the agencies
consider a firm significant in a particular critical market if it
consistently clears or settles at least five percent of the value of
transactions in that critical market.''
While the scope of the Sound Practices Paper was limited to the
resumption of clearance and settlement activities in wholesale
financial markets, the definitions presented in the Sound Practices
Paper provide a starting point for identifying systems (that is,
sector-critical systems) that should be subject to the more stringent,
sector-critical standards. Thus, consistent with the Sound Practices
Paper, the agencies are considering whether systems that support the
clearing or settlement of at least five percent of the value of
transactions (on a consistent basis) in one or more of the markets for
federal funds, foreign exchange, commercial paper, U.S. Government and
agency securities, and corporate debt and equity securities, should be
considered sector-critical systems for the purpose of the sector-
critical standards. The agencies also are considering whether systems
that support the clearing or settlement of at least five percent of the
value of transactions (on a consistent basis) in other markets (for
example, exchange-traded and over-the-counter derivatives), or that
support the maintenance of a significant share (for example, five
percent) of the total U.S. deposits or balances due from other
depository institutions in the United States, should be considered
sector-critical systems.
Because a cyber event may impact the safety and soundness of
multiple financial participants and create systemic risk beyond these
specific markets, the agencies are considering additional factors to
identify sector-critical systems, such as substitutability and
interconnectedness. Systems that provide key functionality to the
financial sector for which alternatives are limited or nonexistent, or
would take excessive time to implement (for example, due to
incompatibility) also could have a material impact on financial
stability if significantly disrupted. Systems that act as key nodes to
the financial sector due to their extensive interconnectedness to other
financial entities could have a material impact on financial stability
if significantly disrupted.
Consistent with the approach to other services, any services
provided by third parties that support a covered entity's sector-
critical systems would be subject to the same sector-critical
standards.
Questions on Sector-Critical Systems
7. Do covered entities currently have access to sufficient
information to determine whether any of their systems would be
considered sector-critical systems for the purpose of the standards? If
not, what additional information would be necessary for an entity to
identify whether it has one or more sector-critical systems for the
purposes of the standards?
8. What are the advantages and disadvantages of requiring covered
entities to identify and report to the agencies their systems that
support operations and meet the applicable thresholds to be considered
sector-critical systems? Alternatively, what are the advantages and
disadvantages of having the agencies develop a process to identify the
systems of covered entities that support operations and meet the
applicable thresholds to be considered sector-critical systems and to
notify covered entities which of their systems would be subject to the
sector-critical standards?
9. What thresholds for transaction value in one or more critical
financial markets should the agencies consider for identifying sector-
critical systems? Similarly, what, if any, additional thresholds should
the agencies consider for identifying sector-critical systems that
could have a material impact on financial stability if disrupted? For
example, how should the agencies identify systems that provide
functionality to the financial sector and for which alternatives are
limited, nonexistent, or would take excessive time to implement? How
should such factors be weighted? Commenters are encouraged to provide
quantitative as well as qualitative support and analysis for proposed
alternative methodologies, thresholds and/or factors.
[[Page 74320]]
10. What are the advantages and disadvantages of determining that a
covered entity which holds a substantial amount of U.S. deposits and/or
balances due from other depository institutions in the United States
plays a significant role in a critical financial market? At what level
of activity should a covered entity's systems related to holding U.S.
deposits and/or balances due from other depository institutions in the
United States be determined to be critical to the sector?
11. What factors should the agencies consider in a measure of
interconnectedness resulting in a system being determined as critical
to the financial sector, and how should such factors be weighted?
Commenters are asked to provide quantitative as well as qualitative
support and analysis for proposed alternative methodologies, thresholds
and/or factors.
12. In some cases, entities, such as smaller banking organizations,
may provide services considered sector-critical services either
directly to the financial sector or through covered entities. What
criteria should the agencies use to evaluate whether a financial entity
that would not otherwise be subject to the enhanced standards should be
subject to the sector-critical standards? How should the agencies weigh
the costs of imposing the sector-critical standards to such smaller
banking organizations against the potential benefits to the financial
system?
V. Enhanced Cyber Risk Management Standards
As noted, the agencies are considering enhanced cyber risk
management standards for covered entities to increase the entities'
operational resilience and reduce the potential impact on the financial
system as a result of, for example, a cyber-attack at a firm or the
failure to implement appropriate cyber risk management.
The enhanced standards would emphasize the need for covered
entities to demonstrate effective cyber risk governance; continuously
monitor and manage their cyber risk within the risk appetite and
tolerance levels approved by their boards of directors; \14\ establish
and implement strategies for cyber resilience and business continuity
in the event of a disruption; establish protocols for secure,
immutable, transferable storage of critical records; and maintain
continuing situational awareness of their operational status and
cybersecurity posture on an enterprise-wide basis. The agencies are
considering establishing a two-tiered approach, with the proposed
enhanced standards applying to all systems of covered entities and an
additional, higher set of expectations, or ``sector-critical
standards,'' applying to those systems of covered entities that are
critical to the financial sector. The ``sector-critical standards''
would require covered entities to substantially mitigate the risk of a
disruption due to a cyber event to their sector-critical systems.
---------------------------------------------------------------------------
\14\ With regard to providers of services, depending on the size
and structure of the organization and the relative size of the unit
providing services to a depository institution, its subsidiaries or
affiliates, it may be appropriate for some functions to be performed
by business line executive management instead of the board of
directors or a board committee of the organization. For these firms,
``enterprise-wide,'' for purposes of the ANPR, encompasses the
governance processes, policies, procedures, and controls related to
or impacting the performance of services by a third party for a
depository institution, its subsidiaries, or affiliates.
---------------------------------------------------------------------------
As noted, the standards would be organized into five categories:
Category 1: Cyber risk governance;
Category 2: Cyber risk management;
Category 3: Internal dependency management;
Category 4: External dependency management; and
Category 5: Incident response, cyber resilience, and situational
awareness.
The term ``internal dependency'' in this ANPR refers to the
business assets (i.e., workforce, data, technology, and facilities) of
a covered entity upon which such entity depends to deliver services, as
well as the information flows and interconnections among those assets.
The term ``external dependency'' refers to an entity's relationships
with outside vendors, suppliers, customers, utilities (such as power
and telecommunications), and other external organizations and service
providers that the covered entity depends on to deliver services, as
well as the information flows and interconnections between the entity
and those external parties.
The categories are organized in this order to emphasize the core
cyber risk governance and cyber risk management standards the agencies
would expect a covered entity to develop to establish a foundation for
making informed risk-based decisions in support of its business
objectives. Standards in the internal dependency management, external
dependency management, and incident response, cyber resilience, and
situational awareness categories are designed to work together and to
be mutually reinforcing.
In the discussion of the individual enhanced standards that
follows, a reference to application of the enhanced standards to
covered entities is intended to include application of the enhanced
standards to services provided to the covered entities, unless
otherwise specified. The proposed standards for covered entities are
described first; additional proposed standards for sector-critical
systems then are listed separately.
Category 1--Cyber Risk Governance
A key aspect of cyber risk governance is developing and maintaining
a formal cyber risk management strategy, as well as a supporting
framework of policies and procedures to implement the strategy, that is
integrated into the overall strategic plans and risk governance
structures of covered entities. Therefore, the agencies are considering
standards under the cyber risk governance category that would be
similar to the governance standards generally expected for large,
complex financial organizations.\15\ For example, the standards would
provide that the board of directors, or an appropriate board
committee,\16\ of a covered entity must be responsible for approving
the
[[Page 74321]]
entity's cyber risk management strategy and holding senior management
accountable for establishing and implementing appropriate policies
consistent with the strategy.
---------------------------------------------------------------------------
\15\ For OCC-regulated covered entities, see 12 CFR part 30
Appendix D. An OCC-regulated covered entity would be expected to
incorporate its cyber risk management strategy and framework into
its overall risk management framework required pursuant to the ``OCC
Guidelines Establishing Heightened Standards for Certain Large
Insured National Banks, Insured Federal Savings Associations, and
Insured Federal Branches'' set forth at 12 CFR part 30 Appendix D.
These OCC guidelines establish minimum standards for the design and
implementation of a risk governance framework for large insured
national banks, insured federal savings associations, and insured
federal branches of foreign banks. Among other items, the OCC
guidelines state that the board of directors of a covered bank
should require management to establish and implement an effective
framework that complies with the guidelines and approve any
significant changes to the framework; the board should actively
oversee a covered bank's risk-taking activities and hold management
accountable for adhering to the framework; and each covered bank
should have a comprehensive written statement that articulates the
bank's risk appetite and serves as a basis for the framework (i.e.,
a risk appetite statement). The OCC guidelines set forth roles and
responsibilities for front line units, independent risk management,
and internal audit. A Board-regulated covered entity would be
expected to incorporate its cyber risk management strategy and
framework into its overall corporate strategy and the institutional
risk appetite maintained by the entity's board of directors. See SR
letter 12-17, ``Consolidated Supervision Framework for Large
Financial Institutions,'' which outlines the general supervisory
expectation that large bank holding companies and nonbank financial
companies maintain a clearly articulated corporate strategy and
institutional risk appetite; see also 12 CFR part 252, subparts D
and O, which establishes risk management requirements for certain
large bank holding companies and nonbank financial companies.
\16\ In the discussion of the enhanced standards that follows, a
reference to the board of directors is intended to include the board
of directors or an appropriate board committee.
---------------------------------------------------------------------------
Specifically, the agencies are considering, as an enhanced standard
in this category, a requirement that covered entities develop a
written, board-approved, enterprise-wide cyber risk management strategy
that is incorporated into the overall business strategy and risk
management of the firm.\17\ The strategy would articulate how the
entity intends to address its inherent cyber risk (that is, its cyber
risk before mitigating controls or other factors are taken into
consideration) and how the entity would maintain an acceptable level of
residual cyber risk (that is, its remaining cyber risk after mitigating
controls and other factors have been taken into consideration) and
maintain resilience on an ongoing basis.
---------------------------------------------------------------------------
\17\ For Board-regulated covered entities, this would be part of
the larger global risk management framework that is required by 12
CFR 252.33.
---------------------------------------------------------------------------
A covered entity also would be required to establish cyber risk
tolerances consistent with the firm's risk appetite and strategy, and
manage cyber risk appropriate to the nature of the operations of the
firm. Thus, as part of the enhanced standard in this category, the
agencies are considering requiring the entity's board of directors to
review and approve the enterprise-wide cyber risk appetite and
tolerances of the covered entity. The enhanced standard also would
provide that a covered entity must reduce its residual cyber risk to
the appropriate level approved by the board of directors.
Covered entities would need to be able to identify and assess those
activities and exposures that present cyber risk, then determine ways
to aggregate them to assess the entity's residual cyber risk. This is
important because cyber risk has the potential to produce losses large
enough to threaten an entity's financial health, its reputation, or its
ability to maintain core operations if faced with a material cyber
event.
The board of directors of a covered entity would oversee and hold
senior management accountable for implementing the entity's cyber risk
management framework. In this regard, the agencies are considering
requiring the board of directors to have adequate expertise in
cybersecurity or to maintain access to resources or staff with such
expertise. Consistent with existing agency expectations, the enhanced
standards would require the board of directors to have and maintain the
ability to provide credible challenge to management in matters related
to cybersecurity and the evaluation of cyber risks and resilience.
The agencies also are considering requiring senior leaders with
responsibility for cyber risk oversight to be independent of business
line management. In this regard, these senior leaders would need to
have direct, independent access to the board of directors and would
independently inform the board of directors on an ongoing basis of the
firm's cyber risk exposure and risk management practices, including
known and emerging issues and trends.
A covered entity would be required to establish an enterprise-wide
cyber risk management framework that would include policies and
reporting structures to support and implement the entity's cyber risk
management strategy. The entity would be required to include in its
framework delineated cyber risk management and oversight
responsibilities for the organization, including reporting structures
and expectations for independent risk management, internal control, and
internal audit personnel; established mechanisms for evaluating whether
the organization has sufficient resources to address the cyber risks
facing the organization; and established policies for addressing any
resource shortfalls or knowledge gaps. The entity also would be
required to include in its cyber risk management framework mechanisms
for identifying and responding to cyber incidents and threats, as well
as procedures for testing the effectiveness of the entity's
cybersecurity protocols and updating them as the threat landscape
evolves.
Questions on Cyber Risk Governance
13. How would a covered entity determine that it is managing cyber
risk consistent with its stated risk appetite and tolerances? What
other implementation challenges does managing cyber risk consistent
with a covered entity's risk appetite and tolerances present?
14. What are the incremental costs and benefits of establishing the
contemplated standards for the roles, responsibilities, and adequate
cybersecurity expertise (or access to adequate cybersecurity expertise)
of the board of directors? To what extent do covered entities already
have governance structures in place that are broadly consistent with
the proposed cyber risk governance standards?
Category 2--Cyber Risk Management
In general, the enhanced standards would require covered entities,
to the greatest extent possible and consistent with their
organizational structure, to integrate cyber risk management into the
responsibilities of at least three independent functions (such as the
three lines of defense risk-management model) with appropriate checks
and balances. This would allow covered entities to more accurately and
effectively identify, monitor, measure, manage, and report on cyber
risk.
Business Units
The agencies are considering requiring units responsible for the
day-to-day business functions of a covered entity to assess, on an
ongoing basis, the cyber risks associated with the activities of the
business unit. Business units also would need to ensure that
information regarding those risks is shared with senior management,
including the chief executive officer (CEO), as appropriate, in a
timely manner so that senior management can address and respond to
emerging cyber risks and cyber incidents as they develop.
As part of this proposed enhanced standard, business units would be
required to adhere to procedures and processes necessary to comply with
the covered entity's cyber risk management framework. Such procedures
and processes would be designed to ensure that the applicable business
unit's cyber risk is effectively identified, measured, monitored, and
controlled, consistent with the covered entity's risk appetite and
tolerances. Business units would assess the cyber risks and potential
vulnerabilities associated with every business asset (that is, their
workforce, data, technology, and facilities), service, and IT
connection point for the respective unit, and update these assessments
as threats, technology, and processes evolve. To this end, the covered
entity would be expected to ensure that business units maintain, or
have access to, resources and staff with the skill sets needed to
comply with the unit's cybersecurity responsibilities.
Independent Risk Management
The agencies are considering a requirement that covered entities
incorporate enterprise-wide cyber risk management into the
responsibilities of an independent risk management function. This
function would report to the covered entity's chief risk officer and
board of directors, as appropriate, regarding implementation of the
firm's cyber risk management framework throughout the organization.
[[Page 74322]]
Independent risk management would be required to analyze cyber risk at
the enterprise level to identify and ensure effective response to
events with the potential to impact one or multiple operating units.
Additionally, independent risk management would be continually required
to assess the firm's overall exposure to cyber risk and promptly notify
the CEO and board of directors, as appropriate, when its assessment of
a particular cyber risk differs from that of a business unit, as well
as of any instances when a unit of the covered entity has exceeded the
entity's established cyber risk tolerances.
On a continuous basis, independent risk management would be
required to identify, measure, and monitor cyber risk across the
enterprise, and to determine whether cyber risk controls are
appropriately in place across the enterprise consistent with the
entity's established risk appetite and tolerances. On an ongoing basis,
the independent risk management function would be required to identify
and assess the covered entity's material aggregate risks and determine
whether actions need to be taken to strengthen risk management or
reduce risk given changes in the covered entity's risk profile or other
conditions, placing particular emphasis on sector-critical systems.
Additionally, the agencies are considering requiring covered
entities to assess the completeness, effectiveness, and timeliness with
which they reduce the aggregate residual cyber risk of their systems to
the appropriate, board-of-directors approved level. The Board is
considering requiring covered entities, at the holding company level,
to measure (quantitatively) the completeness, effectiveness, and
timeliness with which they reduce the aggregate residual cyber risk of
their systems to the appropriate, board-of-directors approved level. As
noted, this is important because cyber risk has the potential to
produce losses large enough to threaten an entity's financial health,
its reputation, or its ability to maintain core operations if faced
with a material cyber event.
Therefore, the independent risk management function would be
required to establish and maintain an up-to-date understanding of the
structure of a covered entity's cybersecurity programs and supporting
processes and systems, as well as their relationships to the evolving
cyber threat landscape.
To satisfy these requirements, it is essential that a covered
entity's independent risk management function have and maintain
sufficient independence, stature, authority, resources, and access to
the board of directors to ensure that the operations of the entity are
consistent with the cyber risk management framework. The reporting
lines must be clear and separate from those for other operations and
business units.
Audit Function
Audit evaluates the effectiveness of risk management, internal
controls, and governance processes, among other things, and advises
management and the board of directors on whether a covered entity's
policies and procedures are adequate to keep up with emerging risks and
industry regulations. As such, audit plays an important role in risk
management, internal control, and corporate governance.
Consistent with a strong overall governance process, the agencies
consider cyber risk and cyber risk management as important to the
internal audit function at covered entities. Therefore, the agencies
are considering explicitly requiring the audit function to assess
whether the cyber risk management framework of a covered entity
complies with applicable laws and regulations and is appropriate for
its size, complexity, interconnectedness, and risk profile.
Further, as part of this enhanced standard, audit would be required
to incorporate an assessment of cyber risk management into the overall
audit plan of the covered entity. The plan would be required to provide
for an evaluation of the adequacy of compliance with the board-approved
cyber risk management framework and cyber risk policies, procedures,
and processes established by the firm's business units or independent
risk management. Such an evaluation would be required to include the
entire security lifecycle, including penetration testing and other
vulnerability assessment activities as appropriate based on the size,
complexity, scope of operations, and interconnectedness of the covered
entity. The audit plan would be required to provide for an assessment
of the business unit and independent risk management functions'
capabilities to adapt as appropriate and remain in compliance with the
covered entity's cyber risk management framework and within its stated
risk appetite and tolerances.
Questions on Cyber Risk Management
15. The agencies seek comment on the appropriateness of requiring
covered entities to regularly report data on identified cyber risks and
vulnerabilities directly to the CEO and board of directors and, if
warranted, the frequency with which such reports should be made to
various levels of management. What policies do covered entities
currently follow in reporting material cyber risks and vulnerabilities
to the CEO and board of directors?
16. The agencies seek comment on requiring covered entities to
organize themselves in a manner that is consistent with the
contemplated enhanced standards for cyber risk management. Besides the
approach outlined in the ANPR, what other approaches could ensure that
entities are effectively identifying, monitoring, measuring, managing,
and reporting on cyber risk?
Category 3--Internal Dependency Management
Standards within the internal dependency management category are
intended to ensure that covered entities have effective capabilities in
place to identify and manage cyber risks associated with their business
assets (that is, their workforce, data, technology, and facilities)
throughout their lifespans. These risks may arise from a wide range of
sources, including insider threats, data transmission errors, or the
use of legacy systems acquired through a merger.
A key aspect of the internal dependency management category is
ensuring that covered entities continually assess and improve, as
necessary, their effectiveness in reducing the cyber risks associated
with internal dependencies on an enterprise-wide basis. As part of the
overall cyber risk management strategy, as discussed in the cyber risk
governance section of this ANPR, the agencies are considering a
requirement that a covered entity integrate an internal dependency
management strategy into the entity's overall strategic risk management
plan. The strategy would guide and inform measures taken to reduce
cyber risks associated with a covered entity's internal dependencies.
The internal dependency management strategy would be designed to ensure
that: Roles and responsibilities for internal dependency management are
well defined; policies, standards, and procedures to identify and
manage cyber risks associated with internal assets, including those
connected to or supporting sector-critical systems, are established and
regularly updated throughout those assets' lifespans; appropriate
oversight is in place to monitor effectiveness in reducing cyber risks
associated with internal dependencies; and appropriate compliance
mechanisms are in place.
[[Page 74323]]
Another key aspect of the internal dependency management category
is having current and complete awareness of all internal assets and
business functions that support a firm's cyber risk management
strategy. The agencies are considering a requirement that covered
entities maintain an inventory of all business assets on an enterprise-
wide basis prioritized according to the assets' criticality to the
business functions they support, the firm's mission and the financial
sector. Thus, covered entities would be required to maintain a current
and complete listing of all internal assets and business functions,
including mappings to other assets and other business functions,
information flows, and interconnections. Covered entities would track
connections among assets and cyber risk levels throughout the life
cycles of the assets and support relevant data collection and analysis
across the organization. This would contribute to establishing and
implementing mechanisms to prioritize monitoring, incident response,
and recovery of systems critical to the entity and to the financial
sector. A covered entity's tracking capability would need to enable
timely notification of internal cyber risk management issues to
designated internal stakeholders. In addition, covered entities would
support the reduction of the cyber risk exposure of business assets to
the enterprise and the sector until the board-approved risk appetite
and tolerances are achieved; and support timely responses to cyber
threats to, and vulnerabilities of, the enterprise and the financial
sector.
Another key aspect within the internal dependency management
category is establishing and applying appropriate controls to address
the inherent cyber risk of a covered entity's assets. The agencies are
considering a requirement that covered entities establish and apply
appropriate controls to address the inherent cyber risk of their assets
(taking into account the prioritization of the entity's business assets
and the cyber risks they pose to the entity) by:
Assessing the cyber risk of assets and their operating
environments prior to deployment;
continually applying controls and monitoring assets and
their operating environments (including deviations from baseline
cybersecurity configurations) over the lifecycle of the assets; and
assessing relevant cyber risks to the assets (including
insider threats to systems and data) and mitigating identified
deviations, granted exceptions and known violations to internal
dependency cyber risk management policies, standards, and procedures.
As part of this enhanced standard, the agencies are considering
requiring covered entities to continually apply appropriate controls to
reduce the cyber risk of business assets to the enterprise and the
financial sector to the board-approved level. The agencies are also
considering a requirement that covered entities periodically conduct
tests of back-ups to business assets to achieve resilience.
Category 4--External Dependency Management
As noted, the term ``external dependencies'' refers to an entity's
relationships with outside vendors, suppliers, customers, utilities,
and other external organizations and service providers that the entity
depends on to deliver services, as well as the information flows and
interconnections between the entity and those external parties. In
addition, the external dependency management category includes the
management of interconnection risks associated with non-critical
external parties that maintain trusted connections to important
systems. Standards within the external dependency management category
are intended to ensure that covered entities have effective
capabilities in place to identify and manage cyber risks associated
with their external dependencies and interconnection risks throughout
these relationships.
A key aspect of the external dependency management category is
ensuring that covered entities continually assess and improve, as
necessary, their effectiveness in reducing the cyber risks associated
with external dependencies and interconnection risks enterprise-wide.
As part of the overall cyber risk management strategy, as discussed in
the cyber risk governance section of this ANPR, the agencies are
considering a requirement that a covered entity integrate an external
dependency management strategy into the entity's overall strategic risk
management plan to address and reduce cyber risks associated with
external dependencies and interconnection risks. This external
dependency management strategy would ensure that roles and
responsibilities for external dependency management are well defined;
policies, standards, and procedures for external dependency management
throughout the lifespan of the relationship (for example, due
diligence, contracting and sub-contracting, onboarding, ongoing
monitoring, change management, off boarding) are established and
regularly updated; appropriate metrics are in place to measure
effectiveness in reducing cyber risks associated with external
dependencies; and appropriate compliance mechanisms are in place.
As part of an external dependency management strategy, the agencies
are considering a requirement that covered entities establish effective
policies, plans, and procedures to identify and manage real-time cyber
risks associated with external dependencies, particularly those
connected to or supporting sector-critical systems and operations,
throughout their lifespans.
Another key aspect of the external dependency management category
is having the ability to monitor in real time all external dependencies
and trusted connections that support a covered entity's cyber risk
management strategy. The agencies are considering a requirement that
covered entities have a current, accurate, and complete awareness of,
and prioritize, all external dependencies and trusted connections
enterprise-wide based on their criticality to the business functions
they support, the firm's mission, and the financial sector. Thus,
covered entities would be able to generate and maintain a current,
accurate, and complete listing of all external dependencies and
business functions, including mappings to supported assets and business
functions. Covered entities would be required to prioritize monitoring,
incident response, and recovery of systems critical to the enterprise
and the financial sector; support the continued reduction of the cyber
risk exposure of external dependencies to the enterprise and the sector
until the board-approved cyber risk appetite and tolerances are
achieved; support timely responses to cyber risks to the enterprise and
the sector; monitor the universe of external dependencies that connect
to assets supporting systems critical to the enterprise and the sector;
support relevant data collection and analysis across the organization;
and track connections among external dependencies, organizational
assets, and cyber risk levels throughout their lifespans. A covered
entity's tracking capability would enable timely notification of cyber
risk management issues to designated stakeholders.
Another key aspect within the external dependency management
category is establishing and applying appropriate controls to address
the cyber risk presented by each external partner throughout the
lifespan of the relationship. The agencies are
[[Page 74324]]
considering a requirement that covered entities analyze and address the
cyber risks that emerge from reviews of their external relationships,
and identify and periodically test alternative solutions in case an
external partner fails to perform as expected. As part of this
requirement and in order to address the rapidly changing and complex
threat landscape, the agencies are considering a requirement that
covered entities continually apply and evaluate appropriate controls to
reduce the cyber risk of external dependencies to the enterprise and
the sector.
Questions on Internal and External Dependency Management
17. The agencies request comment on the comprehensiveness and
effectiveness of the proposed standards for internal and external
dependency management in achieving the agencies' objective of
increasing the resilience of covered entities, third-party service
providers to covered entities, and the financial sector.
18. What challenges and burdens would covered entities encounter in
maintaining an internal and external dependency management strategy
consistent with that described by the agencies?
19. How do the proposed internal and external dependency management
standards compare with processes already in place at banking
organizations?
20. What other approaches could the agencies use to evaluate a
covered entity's internal and external dependency management
strategies? Please be specific as to each approach.
21. How would the proposed standards for internal and external
dependency management impact a covered entity's use of a third-party
service provider?
22. What additional issues should the agencies consider related to
internal and external dependency management and the covered entities'
use of third-party service providers? How should those issues be
evaluated by the agencies? Please be specific.
Category 5--Incident Response, Cyber Resilience, and Situational
Awareness
Standards within the incident response, cyber resilience, and
situational awareness category would be designed to ensure that covered
entities plan for, respond to, contain, and rapidly recover from
disruptions caused by cyber incidents, thereby strengthening their
cyber resilience as well as that of the financial sector. Covered
entities would be required to be capable of operating critical business
functions in the face of cyber-attacks and continuously enhance their
cyber resilience. In addition, covered entities would be required to
establish processes designed to maintain effective situational
awareness capabilities to reliably predict, analyze, and respond to
changes in the operating environment.
The agencies are considering a requirement that covered entities
establish and maintain effective incident response and cyber resilience
governance, strategies, and capacities that enable the organizations to
anticipate, withstand, contain, and rapidly recover from a disruption
caused by a significant cyber event. The agencies are considering a
requirement that covered entities establish and implement plans to
identify and mitigate the cyber risks they pose through
interconnectedness to sector partners and external stakeholders to
prevent cyber contagion. In addition, the agencies are considering a
requirement that covered entities establish and maintain enterprise-
wide cyber resilience and incident response programs, based on their
enterprise-wide cyber risk management strategies and supported by
appropriate policies, procedures, governance, staffing, and independent
review. These cyber resilience and incident response programs would be
required to include effective escalation protocols linked to
organizational decision levels, cyber contagion containment procedures,
communication strategies, and processes to incorporate lessons learned
back into the program. Cyber resilience strategies and exercises would
be required to consider wide-scale recovery scenarios and be designed
to achieve institutional resilience, support the achievement of
financial sector-wide resilience, and minimize risks to or from
interconnected parties.
The IT Handbook calls for examiners to determine whether covered
entities have established plans to address recovery and resilience
strategies for cyber-attacks that may disrupt access, corrupt data, or
destroy data or systems.\18\ In addition to establishing recovery time
objectives (RTOs), recovery and resilience strategies should address
the potential for malware or corrupted data to replicate or propagate
through connected systems or high availability solutions. For cyber-
attacks that may potentially corrupt or destroy critical data, recovery
strategies should be designed to achieve recovery point objectives
based on the criticality of the data necessary to keep the institution
operational.
---------------------------------------------------------------------------
\18\ FFIEC IT Examination Handbook, Business Continuity
Planning, Appendix J.
---------------------------------------------------------------------------
In this category, the agencies also are considering a requirement
that covered entities establish and implement strategies to meet the
entity's obligations for performing core business functions in the
event of a disruption, including the potential for multiple concurrent
or widespread interruptions and cyber-attacks on multiple elements of
interconnected critical infrastructure, such as energy and
telecommunications.
The preservation of critical records in the event of a large-scale
or significant cyber event is essential to maintaining confidence in
the banking system and to facilitating resolution or recovery processes
after a catastrophic event. The agencies are therefore considering
requiring covered entities to establish protocols for secure,
immutable, off-line storage of critical records, including financial
records of the institution, loan data, asset management account
information, and daily deposit account records, including balances and
ownership details, formatted using certain defined data standards to
allow for restoration of these records by another financial
institution, service provider, or the FDIC in the event of resolution.
Transition plans are essential in the event a service is terminated
or an entity cannot meet its obligations. Thus, the agencies are
considering a requirement that covered entities establish plans and
mechanisms to transfer business, where feasible, to another entity or
service provider with minimal disruption and within prescribed time
frames if the original covered entity or service provider is unable to
perform. As a result, if performance is not feasible and contractual
termination/remediation provisions have been exercised, client data
would be returned to the original covered entity or service provider in
a method that is transferable to an alternate entity or service
provider with minimal disruption to the operations of the covered
entity.
Testing the cyber resilience of operations and services helps to
identify potential threats to the ongoing performance of the operation
or service. A prolonged disruption of a significant operation could
generate systemic risk. The agencies are considering a requirement that
covered entities conduct specific testing that addresses disruptive,
destructive, corruptive, or any other cyber event that could affect
their ability to service clients; and significant downtime that would
threaten the business resilience of clients. In addition, the agencies
are considering a requirement that the
[[Page 74325]]
testing address external interdependencies, such as connectivity to
markets, payment systems, clearing entities, messaging services, and
other critical service providers or partners; that the testing of cyber
resilience be undertaken jointly where critical dependencies exist; and
that the testing validate the effectiveness of internal and external
communication protocols with stakeholders.
A key element of situational awareness is the timely
identification, analysis, and tracking of data about the state of, and
potential cyber risks to, the organization. The agencies are
considering a requirement that covered entities maintain an ongoing
situational awareness of their operational status and cybersecurity
posture to pre-empt cyber events and respond rapidly to them. Covered
entities also would be required to establish and maintain threat
profiles \19\ for identified threats to the firm; establish and
maintain threat modeling \20\ capabilities; gather actionable cyber
threat intelligence and perform security analytics on an ongoing basis;
and establish and maintain capabilities for ongoing vulnerability
management.
---------------------------------------------------------------------------
\19\ Threat profiles include information about critical assets,
threat actors, and details about how threat actors might attempt to
compromise those critical assets.
\20\ Threat modeling refers to using a structured process to
identify how critical assets might be compromised by a threat actor
and why, what level of protection is needed for those critical
assets, and what the impact would be if that protection failed.
---------------------------------------------------------------------------
Questions on Incident Response, Cyber Resilience, and Situational
Awareness
23. How well do the proposed standards for incident response, cyber
resilience, and situational awareness address the safety and soundness
of individual financial institutions and potential systemic cyber risk
to the financial sector, including with respect to the testing
strategies and approaches? How could they be improved?
24. What is the extent to which it would be operationally and/or
commercially feasible to comply with requirements to use certain
defined data standards in order to increase the substitutability of
third-party relationships to reduce recovery times for systems impacted
by a significant cyber event?
25. How do covered entities currently evaluate their incident
response and cyber resilience capabilities? What factors should the
agencies consider essential in considering a covered entity's incident
response and cyber response capabilities?
26. How do covered entities currently evaluate their situational
awareness capabilities? What factors should the agencies consider
essential in considering a covered entity's situational awareness
capabilities?
27. What other factors should be included within the incident
response, cyber resilience, and situational awareness category?
28. What additional requirements should the agencies consider to
improve the resilience or situational awareness of a covered entity or
the ability of a covered entity to respond to a cyber-attack?
VI. Standards for Sector-Critical Systems of Covered Entities
As noted, the agencies are considering two tiers of standards, with
more stringent standards to apply to systems of covered entities that
are critical to the functioning of the financial sector.
In particular, the agencies are considering a requirement that
covered entities minimize the residual cyber risk of sector-critical
systems by implementing the most effective, commercially available
controls. Minimizing residual cyber risk means substantially mitigating
the risk of a disruption or failure due to a cyber event.
As a second sector-critical standard, the agencies are considering
requiring covered entities to establish an RTO of two hours for their
sector-critical systems, validated by testing, to recover from a
disruptive, corruptive, or destructive cyber event. Testing programs
would include a range of scenarios, including severe but plausible
scenarios, and would challenge matters such as communications
protocols, governance arrangements, and resumption and recovery
practices. As stated in the Sound Practices Paper, an RTO is the
``amount of time in which a firm aims to recover clearing and
settlement activities after a wide-scale disruption with the overall
goal of completing material pending transactions on the scheduled
settlement date.'' The scope of application of this proposed sector-
critical standard could go beyond the core clearing and settlement
organizations discussed in the Sound Practices Paper to include other
large, interconnected financial systems where a cyber-attack or
disruption also could have a significant impact on the U.S. financial
sector. With advances in technology and consistent with the two-hour
RTO for core clearing and settlement activities in the Sound Practices
Paper, the agencies are considering establishing a two-hour RTO for the
sector-critical systems of covered entities.
Additionally, the Board is considering requiring Board-supervised
covered entities, at the holding company level, to measure
(quantitatively) their ability to reduce the aggregate residual cyber
risk of their sector-critical systems and their ability to reduce such
risk to a minimal level. Such measurement would take into account the
risks associated with internal dependencies, external dependencies, and
trusted connections with access to sector-critical systems.
Questions on Standards for Sector-Critical Systems of Covered Entities
29. The agencies request comment on the appropriateness and
feasibility of establishing a two-hour RTO for all sector-critical
systems. What would be the incremental costs to covered entities of
moving toward a two-hour RTO objective for these systems?
30. What impact would a two-hour RTO have on covered entities' use
of third-party service providers? What challenges or burdens would be
presented by the requirement of a two-hour RTO for covered entities who
rely on third-party service providers for their critical systems? How
should the agencies weigh such costs against other costs associated
with implementing the enhanced standards outlined in this ANPR?
31. How should the agencies implement the two-hour RTO objective?
For example, would an extended implementation timeline help to mitigate
costs, and if so, what timeline would be reasonable?
32. Should different RTOs be set for different types of operations
and, if so, how? Should RTOs be expected to become more stringent over
time as technology advances?
33. The Board requests comment on the benefits of requiring Board-
supervised covered entities, at the holding company level, to measure
the residual cyber risk of their sector-critical systems on a
quantitative basis. How would this approach to measuring cyber risk
compare with efforts already underway at holding companies to manage
and measure their cyber risk? For example, what processes do holding
companies already have in place to measure their residual cyber risk?
What challenges and costs would holding companies face in measuring
their residual cyber risk quantitatively? What are the benefits of
requiring holding companies to reduce the residual risk of their
sector-critical systems to a minimal level, taking into account the
risks associated with internal and external dependencies connected to
or supporting their sector-critical systems?
[[Page 74326]]
VII. Approach to Quantifying Cyber Risk
The agencies are seeking to develop a consistent, repeatable
methodology to support the ongoing measurement of cyber risk within
covered entities. Such a methodology could be a valuable tool for
covered entities and their regulators to assess how well an entity is
managing its aggregate cyber risk and mitigating the residual cyber
risk of its sector-critical systems. At this time the agencies are not
aware of any consistent methodologies to measure cyber risk across the
financial sector using specific cyber risk management objectives. The
agencies are interested in receiving comments on potential
methodologies to quantify inherent and residual cyber risk and compare
entities across the financial sector.
The agencies are familiar with different methodologies to measure
cyber risk for the financial sector. Among others, these include
existing methodologies like the FAIR Institute's Factor Analysis of
Information Risk standard and Carnegie Mellon's Goal-Question-
Indicator-Metric process. Building upon these and other methodologies,
the agencies are considering how best to measure cyber risk in a
consistent, repeatable manner.
Questions on Approach to Quantifying Cyber Risk Section
34. What current tools and practices, if any, do covered entities
use to assess the cyber risks that their activities, systems and
operations pose to other entities within the financial sector, and to
assess the cyber risks that other entities' activities, systems and
operations pose to them? How is such risk currently identified,
measured, and monitored?
35. What other models, frameworks, or reference materials should
the agencies review in considering how best to measure and monitor
cyber risk?
36. What methodologies should the agencies consider for the purpose
of measuring inherent and residual cyber risk quantitatively and
qualitatively? What risk factors should agencies consider incorporating
into the measurement of inherent risk? How should the risk factors be
consistently measured and weighted?
VIII. Considerations for Implementation of the Enhanced Standards
The agencies are considering various regulatory approaches to
establishing enhanced standards for covered entities. The approaches
range from establishing the standards through a policy statement or
guidance to imposing the standards through a detailed regulation. Under
one approach, the agencies could propose the standards as a combination
of a regulatory requirement to maintain a risk management framework for
cyber risks along with a policy statement or guidance that describes
minimum expectations for the framework, such as policies, procedures,
and practices commensurate with the inherent cyber risk level of the
covered entity. This approach would be similar to the approach that the
agencies have taken in other areas of prudential supervision, such as
the Interagency Guidelines Establishing Standards for Safety and
Soundness and the Interagency Guidelines Establishing Information
Security Standards.\21\
---------------------------------------------------------------------------
\21\ See 12 CFR part 208, App. D-1, D-2; 12 CFR part 225, App. F
(Board); 12 CFR part 364, App. A, B (FDIC); 12 CFR part 30, App. A,
B, and D (OCC).
---------------------------------------------------------------------------
Under a second approach, the agencies could propose regulations
that impose specific cyber risk management standards. For example, the
standards could require covered entities to establish a cybersecurity
framework commensurate with the covered entity's structure, risk
profile, complexity, activities, and size. Such standards would address
the five categories of cyber risk management, discussed above, that the
agencies consider key to a comprehensive cyber risk management program:
(1) Cyber risk governance; (2) cyber risk management; (3) internal
dependency management; (4) external dependency management; and (5)
incident response, cyber resilience, and situational awareness. Within
each category, a covered entity would be expected to establish and
maintain policies, procedures, practices, controls, personnel and
systems that address the applicable category, and to establish and
maintain a corporate governance structure that implements the cyber
risk management program on an enterprise-wide basis and along business
line levels, monitors compliance with the program, and adjusts
corporate practices to address the changes in risk presented by the
firm's operations.
Under a third approach, the agencies could propose a regulatory
framework that is more detailed than the second approach. As with the
second approach, the regulation could contain standards for the five
categories of cyber risk management. However, in contrast to the second
approach, the regulation would include details on the specific
objectives and practices a firm would be required to achieve in each
area of concern in order to demonstrate that its cyber risk management
program can adapt to changes in a firm's operations and to the evolving
cyber environment.
In considering which option, or combination of options, to pursue
to implement the standards, the agencies will consider whether the
approach adopted ensures that the enhanced standards are clear, the
additional effort required to implement the standards, whether the
standards are sufficiently adaptable to address the changing cyber
environment, and the potential costs and other burdens associated with
implementing the standards.
Questions on Considerations for Implementation of the Enhanced
Standards
37. What are the potential benefits or drawbacks associated with
each of the options for implementing the standards discussed above?
38. What are the trade-offs, in terms of the potential costs and
other burdens, among the three options discussed above? The agencies
invite commenters to submit data about the trade-offs among the three
options discussed above.
39. Which approach has the potential to most effectively implement
the agencies' expectations for enhanced cyber risk management?
Dated: October 19, 2016.
Thomas J. Curry,
Comptroller of the Currency.
By order of the Board of Governors of the Federal Reserve
System, October 19, 2016.
Robert deV. Frierson,
Secretary of the Board.
Dated at Washington, DC, this 19th day of October, 2016.
By order of the Board of Directors.
Federal Deposit Insurance Corporation.
Federal Deposit Insurance Corporation by
Robert E. Feldman,
Executive Secretary.
[FR Doc. 2016-25871 Filed 10-25-16; 8:45 am]
BILLING CODE 4810-33-P; 6210-01-P; 6714-01-P