On September 9, 2016, the Federal Financial Institutions Examination Council (FFIEC) released a revision of its IT Booklet on Information Security. In line with previous updates made by the FFIEC, the goal of the revision is to better standardized measures for determining, assessing, and manage risks to information technology solutions. The updates reduced redundancies, incorporated relevant cybersecurity language, and re-emphasized risk management as a program and process to be developed, implemented, and maintained. Also included is revised examination procedures, to again increase standardization, of risk management program evaluation amongst auditors and Federal examiners. The FFIEC continues to leverage the NIST Cybersecurity Framework as it did when developing and adopting the Cybersecurity Assessment Tool (CAT).
Questions or concerns about how these latest updates will impact your Compliance and Information Security programs? Contact GraVoc’s Information Security Department below.
Related articles
Change Healthcare Attack: Ransomware Protection Measures for Healthcare Organizations
In light of the Change Healthcare attack, we explore why hackers target healthcare and how healthcare can defend against ransomware.
GraVoc Recognized on CRN MSP 500 List for Second Year in a Row
For the second year in a row, GraVoc has been recognized on the CRN® MSP 500 list in the Pioneer 250 category!
PCI SAQ Types: Which SAQ is Right for Your Business?
In this blog post, we provide an overview of the SAQ types for PCI DSS v4.0 and how to select a PCI SAQ that’s right for your business.