For banks
Evidence that your board is overseeing what the OCC and FDIC ask of it.
The OCC and FDIC make the board responsible for the information security program, and the BSA rules make it responsible for the BSA/AML program. We show your board, your audit committee and your examiner what the record supports, and where it falls short.
Arrange a conversationWhat your regulator expects of your board
Read against the version of each rule for your primary regulator (FDIC, OCC or Federal Reserve), and tested against your board packets, minutes and policies, with the finding cited to its page.
Citations summarised for orientation; dated and re-verified before launch.
OCC and FDIC Guidelines (12 CFR 30 and 364)
The information security program
The board approves the written program, oversees it, and receives a report on its status and material matters at least once a year.
12 CFR 326.8, 21.21 and 208.63
The BSA/AML program
Written, approved by the board and noted in the minutes, with independent testing and a designated BSA officer.
Computer-Security Incident Notification Rule
Cyber incident notification
Notification incidents go to the primary regulator within 36 hours. We check that the board heard about them promptly too.
OCC and FDIC third-party guidance and model risk guidance
AI, models and third parties
Risk management of service providers and models across their life, with the board overseeing the approach and the critical relationships.
In your words
A readout written for a bank board
Customers, not members. The audit committee, not a supervisory committee. Peers are banks of a similar size, from FDIC call report data.
- 1What the board should receive, and how much arrived complete
- 2Reports that never reached the board
Free download
The Board Cyber Scorecard and Schedule
The cyber reporting a bank board should receive, and how often. Use it to check your own board packets before your next meeting.