WASHINGTON — The Office of the Comptroller of the Currency has updated the structure and references of the cybersecurity program its examiners use to evaluate banks, while emphasizing that the changes impose no new regulatory expectations.
The OCC said its Cybersecurity Supervision Work Program has been reorganized to align with updated categories and subcategories in the National Institute of Standards and Technology’s Cybersecurity Framework.
No examination procedures were changed or added, according to the agency.
The program provides high-level objectives and procedures for assessing cybersecurity risk as part of the OCC’s risk-based supervision of national banks, federal savings associations and federal branches and agencies of foreign banks.
The agency said the update reflects the continuing evolution of cyberattacks and the growing use of standardized tools and frameworks by banks to evaluate their cybersecurity preparedness.
Banks are not expected to use the OCC’s work program to conduct their own cybersecurity assessments. The OCC said it encourages, but does not require, banks to use a standardized approach to evaluate and improve their preparedness. Institutions may select from several available cybersecurity tools and frameworks.
Program is Scalable
The program is scalable for institutions of different sizes and complexity. OCC examiners may use its procedures when evaluating the cybersecurity preparedness of community banks.
The work program also maps its procedures to existing regulatory guidance and commonly used cybersecurity frameworks, including the Federal Financial Institutions Examination Council’s Information Technology Examination Handbook, the Center for Internet Security Critical Security Controls and the Cyber Risk Institute Profile.
The program supplements bank information technology examination procedures contained in the OCC’s supervision handbooks for community banks, large banks and federal branches and agencies.
The OCC said it will post future changes to the program’s cross-references on its website.
The new bulletin rescinds OCC Bulletin 2023-22, which was issued June 26, 2023.
