On September 9, 2016, the Federal Financial Institutions Examination Council (FFIEC) released a revision of its IT Booklet on Information Security. In line with previous updates made by the FFIEC, the goal of the revision is to better standardized measures for determining, assessing, and manage risks to information technology solutions. The updates reduced redundancies, incorporated relevant cybersecurity language, and re-emphasized risk management as a program and process to be developed, implemented, and maintained. Also included is revised examination procedures, to again increase standardization, of risk management program evaluation amongst auditors and Federal examiners. The FFIEC continues to leverage the NIST Cybersecurity Framework as it did when developing and adopting the Cybersecurity Assessment Tool (CAT).
Questions or concerns about how these latest updates will impact your Compliance and Information Security programs? Contact GraVoc’s Information Security Department below.
Related articles
Cyber Risks in Higher Education: Why Universities Need Regular Penetration Testing
We explore cyber risks in higher education and how penetration testing can help universities protect their people, data, and reputation.
Cybersecurity Q&A Series: How to Check if my Business Email Has Been Compromised?
Learn how to check if your business email address has been compromised and what steps to take next to protect your business.
Cybersecurity Q&A Series: How to Detect AI-Generated Phishing Emails?
In this blog post, we break down the behavioral signs that can help you recognize an AI-generated phishing email.