Independent Banker - July 2023 - 29

Next: Staying compliant when banking CRBs 
bank-designated point of contact at
each affected banking organization
customer as soon as possible
when the bank service provider
determines that it has experienced a
computer-security incident.
Q: Why was the new rule needed?
A: The creation of this rule is
important especially in light of the
existing Interagency Guidance on
Response Programs.
" The rationale of regulators was to
attain earlier awareness of the threats
that banks are facing to allow the
government to better react and help
prevent cyber events or computer
security events from becoming
systemic across the entire sector, "
says Steven Estep, ICBA assistant vice
president, operational risk. " They
deemed that the current interagency
guidance and BSA requirements did
not provide as much coverage as
desired and wanted earlier awareness
to get ahead of the bad guys. "
The original Interagency Guidelines
Establishing Information Security
Standards came from the GrammLeach-Bliley
Act (GLBA) of 1999.
While it established some structure
for identifying and reporting security
incidents such as data breaches,
the new rule is more specific as to
timeliness ( " as soon as possible "
compared to the " 36-hour " time
limit), expands beyond the traditional
scope of a data breach and brings
attention to any type of computersecurity
incident that results in
actual harm.
Q: What are the requirements of
the rule for a compliance program,
content of the notification and
recordkeeping?
A: " The regulators have tried to
make the rule as simple as possible
and manage regulatory burden, "
Estep says. " There are no specific
" It is up to the bank to determine
when events have reached the
definition requiring notification
and choosing ... to notify their
primary federal regulator in the
desired manner. "
-STEVEN ESTEP, ICBA
requirements for the content of the
notification or requirements for
a specific form of assessment or
analysis of the event(s). It is up to
the bank to determine when events
have reached the definition requiring
notification and choosing a vehicle,
email or otherwise, to notify their
primary federal regulator in the
desired manner. The incident could
still be under evaluation when the
notification is sent. "
Estep notes that community
banks should ensure their written
policies, procedures and any other
related materials have been updated
to reflect the new rule and persons
or departments responsible for
reporting, including bank-designated
points of contact for the bank's service
providers. Programs that may be
affected are information security
policies, incident response plans and
the vendor management program,
among others. The rule does not
specify the consequences of noncompliance;
however, it could be
evaluated by regulators in the normal
course of supervision.
" The rule doesn't include
recordkeeping requirements;
however, it may be beneficial
to document a record of the
notification, " he advises. " It could
serve as documentation of the bank's
compliance with the rule should
issues arise in the future and as data
to track or accumulate incidents for
evaluation of patterns or practices.
At this time, the Cybersecurity and
Infrastructure Security Agency (CISA)
is writing rules for cyber incident
reporting for critical infrastructure.
Community banks should watch for a
proposed rule later this year or early
in 2024.
Because of the frequency and
severity of cyberattacks on the
financial services industry, the
agencies believe that it is important
that a banking organization's primary
federal regulator be notified as soon
as possible of a significant computersecurity
incident that disrupts or
degrades, or is reasonably likely to
disrupt or degrade, the viability of the
banking organization's operations,
result in customers being unable
to access their deposit and other
accounts, or affect the stability of the
financial sector.
While community banks have
likely begun following the new rule,
it is important to ensure related
information in the bank and used
for third-party service providers is
consistent with it.
Mary Thorson Wright is a writer
in Virginia.
independentbanker.org // 29
http://www.independentbanker.org
Independent Banker - July 2023

Table of Contents for the Digital Edition of Independent Banker - July 2023
