Category: Hot Topics

The all new IT Examination Handbook is more than an update, it’s a complete re-write, and represents a significant change in how the business continuity process is managed. It also has several new expectations regulators will be looking for from financial institutions¹. In fact, that is one of the most interesting changes; the term “institution” has been changed to “entity”, and this may prove to be more than simply semantic because entities are defined as

It looks like your critical third-party providers will be expected to meet the same standard you are, and that makes sense, as these providers may be key interdependencies of your internal systems and business processes.

By the Numbers

Before we get into some of the other changes, let’s look at some select differences between the current and previous Handbooks.

Material Changes

One of the most significant changes is also more than simply semantic. The end result of the planning process is no longer referred to as a Business Continuity Plan (BCP), but more broadly, Business Continuity Management (BCM). Your recovery plan (the traditional BCP) is now simply a sub-section in your overall BCM document.

This leads to perhaps the most significant change; a focus on “resilience” in addition to (and in advance of) your response and recovery efforts. Resilience is defined as

Since most traditional BCPs probably already have detailed recovery procedures documented, the missing piece is the pre-recovery part, the pro-active measures you either already have in place, or can implement, to withstand and/or minimize the impact of a disruptive event. As the guidance states:

One way to measure (and document) resilience is to factor any existing threat-specific measures such as fire suppression, data backups, redundant data circuits, succession plans, alternate vendors, etc. into your net risk/threat impact formula. Simply put, resilience is the difference between the inherent impact of a threat, and the residual impact.

Perhaps the best way to characterize the new approach to business continuity is to look at the recommended development process.

The previous Handbook encouraged institutions to adopt a four-step approach:

1. Business Impact Analysis
2. Risk Assessment
3. Risk Management (essentially, recovery procedures), and
4. Risk Monitoring and Testing

The new guidance recommends a slightly different approach:

1. Risk Management (Business Impact Analysis, Risk/Threat Assessment)
2. Continuity Strategies (Interdependency Resilience, Continuity and Recovery)
3. Training & Testing (aka Exercises)
4. Maintenance & Improvement
5. Board Reporting

Next Steps

What do all these changes mean for your continuity plan? Is it time to start fresh, or can a few simple adjustments bring your current program into alignment with the new guidance? For example, it may be tempting to do a simple word search/replace and change all occurrences of “Business Continuity Plan” to “Business Continuity Management”. But even if your current program is compliant with the 2015 Handbook, simple fixes may miss the spirit of the new guidance unless more substantive changes are made.

Here is a high-level checklist using the structure of the new guidance to help you decide whether a few minor tweaks, or a major re-write is in order.

Answer each question as “Yes, completely,” “Yes, somewhat,” or “No”:

1. Have you conducted a formal business process-based Business Impact Analysis (BIA) that identifies all critical interdependencies?
2. Does the BIA produce sufficient information to establish the following?
• Recovery point objectives (RPO)
• Recovery time objectives (RTO) for each business
  process (prioritized)
• Maximum tolerable (or allowable) downtime (MTD/MAD)
3. Does your risk/threat assessment measure both the impact and the probability (likelihood) of potential disruptive threats, including worst case (low probability, high impact) scenarios?
4. Have you identified all existing resilience (including cyber) measures for all critical interdependencies in your program? Interdependencies include all assets and all vendors for each business process.
5. Do you use the business processes identified in your BIA, including the interdependencies and recovery priorities, to guide your BCP testing? (Must be documented)
6. Do you use testing as employee training exercises to verify that personnel are knowledgeable of recovery priorities and procedures?
7. Do you track and resolve all issues identified during testing exercises, and use lesson-learned to enhance your program? (Must be documented)
8. Does your Board report include a written presentation providing the BIA, risk assessment, BCP, exercise and test results, and identified issues?
9. BONUS QUESTION: Do you assess Pandemic impact and probability alongside other risks/threats instead of separately?

If you answered more than 5 out of the 9 questions with “No” or “Yes, somewhat” it might be a good time to reevaluate the entire plan. On the other hand, if you are able to respond “Yes, completely” or “Yes, somewhat” to 6 or more, you should be in pretty good shape with only minor adjustments necessary.

Summary

All plans, even largely compliant plans, will need some level of adjustment. The good news is that historically it takes time for auditors and examiners to adjust to new regulations, so there should be enough time to make even major adjustments. Use your regularly scheduled 2020 BCP/BCM update sessions as an opportunity to re-visit your program, and be ready to provide all stakeholders (including auditors, examiners, and the Board) with a definitive plan, including timeline, for achieving compliance.

A Standardized Approach

On August 28th, the FFIEC issued a press release entitled “FFIEC Encourages Standardized Approach to Assessing Cybersecurity Preparedness”. The release “…emphasized the benefits of using a standardized approach to assess and improve cybersecurity preparedness.” On the surface the this seems very logical and straightforward, but in fact this may have provided more confusion and complication than clarification on regulator expectations.

Here is some background. Back in the summer of 2014, the FFIEC piloted a cybersecurity examination work program (Cybersecurity Assessment) at over 500 community financial institutions to evaluate their preparedness to mitigate cyber risks. As a result of the Cybersecurity Assessment, FFIEC members found that many financial institutions (and most community institutions) would benefit from a standardized approach to cybersecurity assessment. As a result, in 2015 (and subsequently updated in 2017) the FFIEC:

This Tool has since become the defacto standard for all primary federal regulatory agencies since. This isn’t surprising, since FFIEC members consist of all federal regulatory agencies, plus the CFPB and state agencies.

Here is what the Federal Reserve said back in 2015:

Similarly, the OCC stated in 2015:

The NCUA advised back in 2018 that:

(The NCUA also subsequently developed their own tool called the ACET, modeled word-for-word on the FFIEC Tool.)

Finally, while the FDIC did state that use of the Tool was voluntary, they indicated that:

One more thing… Since the Tool is “officially” voluntary, when asked in a regulator panel discussion earlier this year what other standards or tools examiners were seeing instead of the FFIEC, all the examiners (including the FDIC) admitted that the only assessment methodology they’ve seen is the FFIEC.

A Variety of Options

Clearly the Tool is now, and has always been, the defacto standard, and here is where the press release complicates things. First, I’ve always been a proponent of the Tool in the sense that any attempt to standardize examiner expectations is a good thing, because shared standards will usually result in less misinterpretation, and fewer deviations from those expectations, i.e. fewer exam findings! But now the agencies seem to be backing away from a single standard, stating instead that “Institutions may choose from a variety of standardized tools aligned with industry standards and best practices to assess their cybersecurity preparedness.” They list the following as possible standardized tools:

• FFIEC Cybersecurity Assessment Tool
• National Institute of Standards and Technology Cybersecurity Framework
• Financial Services Sector Coordinating Council Cybersecurity Profile
• Center for Internet Security Critical Security Controls

Most confusing of all, the FFIEC even seems to be backing away from their own tool, stating that “…the FFIEC does not endorse any particular tool…”

What You Should Do

In summary, what should institutions do to adapt to this free-for-all of cyber preparedness standards? In short, nothing. If you’re already using the FFIEC Tool (or a service based on the FFIEC tool, like this), keep using it. Of the 4 competing standards, only the FFIEC Tool is specific to depository financial institutions. Additionally, using a different standard, while permitted, may invite additional scrutiny if the regulator is not well versed on that standard. And anything that invites additional scrutiny is not something most institutions prefer.

One final thought… Regardless of what tool you utilize, don’t forget that completing the assessment is only the first step in the cybersecurity preparedness process. As we have discussed before, determining where the gaps are in your program, and making a plan to close those gaps, are the next steps!

It may be a good time to review your Incident Response Plan and determine if additional clarification regarding the term “misuse” should be added to incorporate denial of access to information. The FFIEC Information Technology Examination Handbook for Information Security was published in September 2016 and refers to misuse as “attacks from within the organizations”. This definition comes from internal employees accessing unauthorized information through improperly configured (or lack thereof) security controls. Due to the availability of ransomware and DDoS attack services, denial of access to critical information is becoming a more common risk financial institutions are facing.

The IT Examination Handbook defines distributed denial of service (DDoS) as “A type of attack that makes a computer resource or resources unavailable to its intended users”. Financial institutions that experience DDoS attacks may face operational and reputation risks depending on which resources were targeted in the attack. The FFIEC expects financial institutions to address DDoS readiness as part of their Information Security Program and Incident Response Plan.

DDos Readiness

The FFIEC Information Technology Handbook on Business Continuity Planning and Information Security booklets provide the following steps that should be taken to improve DDoS readiness:

1. Maintain an ongoing program to assess information security risk that identifies, prioritizes, and assesses the risk to critical systems, including threats to external websites and online accounts.
2. Monitor Internet traffic to the institution’s website to detect attacks.
3. Activate Incident Response Plans and notify service providers, including Internet service providers (ISPs), as appropriate, if the institution suspects that a DDoS attack is occurring. Response plans should include appropriate communication strategies with customers concerning the safety of their accounts.
4. Ensure sufficient staffing for the duration of the DDoS attack and consider hiring precontracted third-party servicers, as appropriate, that can assist in managing the Internet-based traffic flow. Identify how the institution’s ISP can assist in responding to and mitigating an attack.
5. Consider sharing information with organizations, such as the Financial Services Information Sharing and Analysis Center and law enforcement because attacks can change rapidly and sharing the information can help institutions to identify and mitigate new threats and tactics.
6. Evaluate any gaps in the institution’s response following attacks and in its ongoing risk assessments, and adjust risk management controls accordingly

The growing threat landscape and increased accessibility to ransomware and DDoS services encourage Information Security Programs and Incident Response Plans to constantly evolve to ensure financial institutions can effectively respond to these types of attacks. It’s important for your procedures to cover specific containment and remediation steps to quickly respond when your financial institution becomes the target of one of these attacks. We’re commonly seeing additional clarification in Incident Response Plans that moves the focus of misuse from internal threats, to a broader definition that includes the idea of denied access: “Misuse includes all unauthorized access to data, with or without data disclosure. It also includes unauthorized denial of access to data”.