Interagency guidance on identifying information security risks. (Announcements).The Federal Financial Institutions Examination Council The Federal Financial Institutions Examination Council, or FFIEC, is a formal interagency body of the United States government empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions by the Board of (FFIEC) on January 29, 2003, issued revised guidance for examiners and financial institutions to use in identifying information security risks and evaluating the adequacy of controls and applicable risk-management practices of financial institutions. The safety and soundness of the federal financial industry and the privacy of customer information depend on the security practices of banks, thrift institutions, and credit unions. The Information Security booklet describes how an institution should protect and secure the systems and facilities that process and maintain information. The booklet calls for financial institutions and technology service providers (TSPs) to maintain effective security programs, tailored to the complexity of their operations. This guidance is the first in a series of updates to the 1996 FFIEC Information Systems (IS) Examination Handbook. These updates will address significant changes in technology since 1996 and incorporate a risk-based examination approach. The FFIEC currently plans to issue the updates in separate booklets that will ultimately replace all chapters of the 1996 handbook and make up the new FFIEC Information Technology (IT) Examination Handbook. In addition to the booklet on information security, future booklets will address business continuity planning Business Continuity Planning (BCP) is an interdisciplinary peer mentoring methodology used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical function(s) within a predetermined , supervision of technology service providers, electronic banking, IT audit, payment systems, outsourcing, IT management, computer operations, and systems development and acquisition. The FFIEC agencies plan to distribute these booklets electronically to financial institutions and TSPs. The documents will be available on the Internet through the FFIEC's InfoBase application. InfoBase will include each booklet in Adobe Acrobat PDF file format, as well as an on-line version with links to various resource materials, and an orientation to the handbook update process. The electronic version of the Information Security booklet is available at www.ffiec.gov/guides.htm. The FFIEC is composed of the five federal financial regulators: the Board of Governors of the Federal Reserve System Board of Governors of the Federal Reserve System The managing body of the Federal Reserve System, which sets policies on bank practices and the money supply. , the Federal Deposit Insurance Corporation Federal Deposit Insurance Corporation (FDIC), an independent U.S. federal executive agency designed to promote public confidence in banks and to provide insurance coverage for bank deposits up to $100,000. , the National Credit Union Administration The National Credit Union Administration (NCUA) is responsible for chartering, insuring, supervising, and examining federal credit unions (FCUs) and for administering the National Credit Union Share Insurance Fund. , the Office of the Comptroller of the Currency The Office of the Comptroller of the Currency (or OCC) was established by the National Currency Act of 1863 and serves to charter, regulate, and supervise all national banks and the federal branches and agencies of foreign banks in the United States. , and the Office of Thrift Supervision The Office of Thrift Supervision (OTS) was established as a bureau of the Treasury Department in August 1989 as part of a major Reorganization Plan of the thrift regulatory structure mandated by the Financial Institutions Reform, Recovery, and Enforcement Act of 1989 (FIRREA) (12 U.S.C.A. . |
|
||||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion