skip to main navigation skip to secondary navigation skip to content
Board of Governors of the Federal Reserve System
skip to content
Board of Governors of the Federal Reserve System

Supervision and Regulation Letters

SR 15-9

FFIEC Cybersecurity Assessment Tool for Chief Executive Officers and Boards of Directors

July 2, 2015
Attachment(s):

Seal of the Board of Governors of the Federal Reserve System
BOARD OF GOVERNORS
OF THE
FEDERAL RESERVE SYSTEM
WASHINGTON, D. C.  20551
DIVISION OF BANKING
SUPERVISION AND REGULATION
SR 15-9
July 2, 2015
TO THE OFFICER IN CHARGE OF SUPERVISION AT EACH FEDERAL RESERVE BANK
SUBJECT:   FFIEC Cybersecurity Assessment Tool for Chief Executive Officers and Boards of Directors
Applicability:  This assessment tool is being made available to all financial institutions supervised by the Federal Reserve, regardless of asset size.

Background

The purpose of this letter is to announce that the Federal Financial Institutions Examination Council (FFIEC)1 has developed a Cybersecurity Assessment Tool (assessment tool), the output of which can assist a financial institution’s senior management and board of directors in assessing the institution’s cybersecurity risk and preparedness.  The assessment tool is designed to assist institutions in managing their cybersecurity risk.  The first part of the assessment tool is the inherent risk profile, which aims to help management determine an institution’s level of cybersecurity risk.  The second part of the assessment tool is cybersecurity maturity, which is designed to help management assess whether their controls provide the desired level of preparedness.  Upon completion of both parts, management and the board of directors can evaluate whether the financial institution’s inherent risk and preparedness are aligned.  Overall, the assessment tool provides a repeatable and measurable process for a financial institution to measure its cybersecurity preparedness over time.  Institutions can access the assessment tool at http://www.ffiec.gov/cybersecurity.htm.

The assessment tool incorporates cybersecurity-related principles from the FFIEC Information Technology (IT) Examination Handbook, regulatory guidance, and concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.2  Going forward, the FFIEC will update the assessment tool and the IT Examination Handbook based on the changing cybersecurity threat landscape.  The FFIEC’s website3 contains supporting resources to assist institutions in completing the assessment tool and enhancing their cybersecurity risk management.

Implementation

A forthcoming Paperwork Reduction Act notice in the Federal Register will provide financial institutions and the industry the opportunity to comment on the assessment tool.4  Based on industry feedback, the Federal Reserve will work with the other FFIEC agencies to determine whether changes to the assessment tool are warranted.  In particular, the Federal Reserve will work to tailor expectations to minimize burden for financial institutions with low cybersecurity risk profiles and, potentially, supplement expectations for financial institutions with significant cybersecurity risk profiles.  Beginning in late 2015 or early 2016, the Federal Reserve plans to utilize the assessment tool as part of our examination process when evaluating financial institutions’ cybersecurity preparedness in information technology and safety and soundness examinations and inspections.

Questions

Federal Reserve Banks should distribute this letter to supervised financial institutions as well as to appropriate supervisory staff.  Questions regarding this guidance may be directed to the following staff in the Board’s Systems and Operational Resiliency Policy Section:  Christopher Olson, Senior Supervisory Financial Analyst at (202) 912-4609; or Matthew Hayduk, Manager, at (202) 973-6190.  In addition, questions may be sent via the Board’s public website.5

signed by
Maryann F. Hunter
Acting Director
Division of Banking
Supervision and Regulation


 
Notes:
  1. The FFIEC members include:  the Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the Currency, Consumer Financial Protection Bureau, and State Liaison Committee.  Return to text
  2. See:  http://nist.gov/cyberframework/index.cfm.  Return to text
  3. Resources to assist in completing the assessment tool are available on the FFIEC’s website at http://www.ffiec.gov/cyberassessmenttool.htm.  Return to text
  4. Comments can be made at: http://www.reginfo.gov/public/do/PRAViewICR?ref_nbr=201506-1557-001.  Return to text
  5. See:  http://www.federalreserve.gov/apps/contactus/feedback.aspx.  Return to text
Last update: July 7, 2015