Cyber risk management.

CFR · 2024-01-01 · US · Title 12

(a) (b) (1) Approve a written cyber risk program. The program must be consistent with industry standards to ensure the institution's safety and soundness and compliance with law and regulations; (2) Oversee the development, implementation, and maintenance of the institution's cyber risk program; and (3) Determine necessary expertise for executing the cyber risk management plan and, where practical, delegate day-to-day responsibilities to management and employees. (c) (1) Include an annual risk assessment of the internal and external factors likely to affect the institution. The risk assessment, at a minimum, must: (i) Identify and assess internal and external factors that could result in unauthorized disclosure, misuse, alteration, or destruction of current, former, and potential customer and employee information or information systems; and (ii) Assess the sufficiency of policies, procedures, internal controls, and other practices in place to mitigate risks. (2) Identify systems and software vulnerabilities, prioritize the vulnerabilities and the affected systems based on risk, and perform timely remediation. The particular security measures an institution adopts will depend upon the size, risk profile, and complexity of the institution's operations and activities. (3) Maintain an incident response plan that contains procedures the institution must implement when it suspects or detects unauthorized access to current, former, or potential customer, employee, or other sensitive

official document · source cfr-2024 · id 12:§ 609.930