![](media/image1.png){width="0.7464566929133858in"
height="0.75in"}![](media/image2.png){width="0.7492125984251968in"
height="0.75in"}![](media/image3.png){width="0.75in"
height="0.75in"}![](media/image4.jpeg){width="1.1543307086614174in"
height="0.46181102362204723in"}

Division of Supervision

and Consumer Protection

Information

Technology

GENERAL

Work Program

*April 2004*

Table of Contents

[**WORK PROGRAM QUESTIONS 6**](#work-plan-questions)

[1 Audit 6](#__RefHeading___Toc4309385)

[2 Management 8](#__RefHeading___Toc4309386)

[2.1 Information Security Program 9](#__RefHeading___Toc4309387)

[2.2 Vendor Management 11](#__RefHeading___Toc4309388)

[3 Development and Acquisition 12](#__RefHeading___Toc4309389)

[4 Support and Delivery 13](#__RefHeading___Toc4309390)

[4.1 Data and Physical Security 15](#__RefHeading___Toc4309391)

[4.2 Disaster Recovery Planning/Business Continuity Planning
19](#__RefHeading___Toc4309392)

# WORK PLAN QUESTIONS:

+-----------------------------------------------------------------------+
| **Questions**                                                         |
+=======================================================================+
| ## [[]{#__RefHeading___Toc4309385 .anchor}**1. Audit**](#_1._Audit:)  |
+-----------------------------------------------------------------------+
| 1a. [When was the last audit of IT-related activities performed? How  |
| frequently does management perform audits of IT-related activities?   |
| Evaluate the institution's risk assessment methodology use to         |
| prioritize IT audit resources and to formulate the audit schedule and |
| scope.](#When_was_the_latest)                                         |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1b. [Does the auditor routinely submit written reports and audit      |
| schedules to the Board of Directors or the audit                      |
| committee?](#_Does_the_auditor)                                       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1c. [Review audit report(s) since the previous examination addressing |
| IT activities. Indicate whether the report(s)                         |
| adequately:](#_From_the_review)                                       |
|                                                                       |
| -   [Describes scope and objectives.](#_From_the_review)              |
|                                                                       |
| -   [Describes deficiencies.](#_From_the_review)                      |
|                                                                       |
| -   [Suggests corrective action and management's response (including  |
|     commitments for corrective action and timelines for               |
|     completion).](#_From_the_review)                                  |
|                                                                       |
| -   [Details follow-up/correction of prior audit or regulatory        |
|     examination exceptions.](#_From_the_review)                       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1d. [Does the internal and/or external auditor or designated officer  |
| or employee (someone not directly involved in the daily processing of |
| activities) periodically review the following:](#_Does_the_internal)  |
|                                                                       |
| -   [Back-office operations (including balancing, reconciling,        |
|     input/output procedures, and controls over exception              |
|     items)?](#_Does_the_internal)                                     |
|                                                                       |
| -   [Segregation of duties?](#_Does_the_internal)                     |
|                                                                       |
| -   [Disaster Recovery Planning and Business Continuity               |
|     Planning?](#_Does_the_internal)                                   |
|                                                                       |
| -   [Data and physical security for critical platforms (e.g.,         |
|     mainframe, network and Electronic Banking)?](#_Does_the_internal) |
|                                                                       |
| -   [Programming and change control activities?](#_Does_the_internal) |
|                                                                       |
| -   [Vendor-provided software updates and releases (including         |
|     installation of emergency changes)?](#_Does_the_internal)         |
|                                                                       |
| -   [Wire transfer activities (including ACH, ATM, POS, and Fedline,  |
|     if applicable)?](#_Does_the_internal)                             |
|                                                                       |
| -   [Internet banking activities?](#_Does_the_internal)               |
|                                                                       |
| -   [Telephone banking activities?](#_Does_the_internal)              |
|                                                                       |
| -   [Technology outsourcing arrangements?](#_Does_the_internal)       |
|                                                                       |
| -   [Employee accounts?](#_Does_the_internal)                         |
|                                                                       |
| -   [Compliance with Section 501(b) of the Gramm-Leach-Bliley         |
|     Act?](#_Does_the_internal)                                        |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 1e. [Does the auditor (or designee) have any conflicting duties? If   |
| so, list them.](#_Does_the_auditor_1) Skip this question if the IT    |
| audit is outsourced.                                                  |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1f. [Is audit expertise and training sufficient for the complexity of |
| the system and the risk to the institution?](#_Is_audit_expertise)    |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1g. [Is audit software used? (If so, identify the program, describe   |
| uses and controls, and indicate when it was last                      |
| used.)](#_Is_audit_software)                                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 1h. [Is the auditor involved in hardware/software purchases (IS       |
| Steering Committee decisions, etc.)?](#_Does_the_auditor_2) Skip if   |
| IT audit is outsourced.                                               |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| ## [[                                                                 |
| ]{#__RefHeading___Toc4309386 .anchor}**2. Management**](#Management_) |
+-----------------------------------------------------------------------+
| 2a. [Assess the adequacy of management's actions to correct           |
| deficiencies noted in the previous IT examination reports, as well as |
| internal and external audits, and address findings cited in the       |
| review of service providers where                                     |
| appropriate.](#_Assess_the_adequacy)                                  |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2b. [Determine the adequacy of the Board and senior management in     |
| implementing both short- and long-term strategic                      |
| planning.](#_Determine_the_adequacy) [Evaluate any significant plans  |
| for changes in IT management personnel, software, hardware, or        |
| operating procedures.](#_Determine_the_adequacy)                      |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2c. [Review Board and/or IT related committee minutes and document    |
| significant matters.](#_Review_board_and/or)                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2d. [For outsourced services, assess the adequacy of contracts and    |
| service-level agreements (SLAs) for applications processed by         |
| servicers.](#For_services_outsourced)                                 |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2e. [Is adequate management succession provided for IT operations?    |
| Have an adequate number of financial institution personnel been       |
| trained to supervise and operate the system to reduce dependence on   |
| key personnel?](#_Is_adequate_management)                             |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2f. [Has management performed and documented an annual review of      |
| insurance coverage?](#_Has_management_performed)                      |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2g[. Determine whether the bank has filed a notice of service         |
| provider relationship with the appropriate regulator as required by   |
| the Bank Service Company Act (BSCA) for services outsourced since the |
| previous examination.](#Determine_whether_the)                        |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| ## [[]{#__RefHeading___Toc430938                                      |
| 7 .anchor}**2.1. Information Security Program**](#_3._IS_Policies_1)  |
+-----------------------------------------------------------------------+
| 2.1a. [Has the Board or its designated committee approved a written   |
| Corporate Information Security Program that meets the requirements of |
| the Information Security Guidelines?](#_Are_access_privileges)        |
|                                                                       |
| -   [If more than one information security program exists for the     |
|     institution, are the programs coordinated across organizational   |
|     units?](#_Are_access_privileges)                                  |
|                                                                       |
| -   [Has an effective process been established to adjust the          |
|     information security program as needed?](#_Are_access_privileges) |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1b. [If the Board has assigned responsibility for security program  |
| implementation and review of management reports to an individual or a |
| committee, do they possess the necessary knowledge, expertise and     |
| authority to perform the task?](#_If_the_board)                       |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1c. [Consider the following when evaluating the Risk Assessment     |
| process:](#_Consider_the_following)                                   |
|                                                                       |
| -   [Does the institution identify all reasonably foreseeable         |
|     internal and external threats that could result in unauthorized   |
|     disclosure, misuse, alteration, or destruction of customer        |
|     information or customer information                               |
|     systems?](#_Consider_the_following)                               |
|                                                                       |
| -   [Does the institution identify and prioritize its risk exposure,  |
|     decide on the risks it must mitigate, and create a mitigation     |
|     strategy? Is the decision to accept risks documented and reported |
|     to the appropriate management levels?](#_Consider_the_following)  |
|                                                                       |
| -   [Does the institution consider the criticality of the information |
|     being protected in creating a risk mitigation                     |
|     strategy?](#_Consider_the_following)                              |
|                                                                       |
| -   [Does the institution support its estimate of the potential       |
|     damage posed by various threats?](#_Consider_the_following)       |
|                                                                       |
| -   [Review the institution's existing controls to mitigate risks.    |
|     Does the institution's analysis consider the current              |
|     administrative, physical, and technical safeguards that prevent   |
|     or mitigate potential damage?](#_Consider_the_following)          |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Does the risk assessment include vendor oversight                |
|     requirements?](#_Consider_the_following)                          |
|                                                                       |
| [**Comment:**](#_Consider_the_following)                              |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1d. [Review written policies and procedures and determine whether   |
| the following controls have been considered where                     |
| appropriate.](#_Review_internal_controls)                             |
|                                                                       |
| -   [Logical and physical access                                      |
|     controls.](#_Review_internal_controls)                            |
|                                                                       |
| -   [Programming and change control                                   |
|     procedures.](#_Review_internal_controls)                          |
|                                                                       |
| -   [Dual control, segregation of duties, and employee background     |
|     checks.](#_Review_internal_controls)                              |
|                                                                       |
| -   [Disaster recovery and business                                   |
|     continuity.](#_Review_internal_controls)                          |
|                                                                       |
| -   [Encryption.](#_Review_internal_controls)                         |
|                                                                       |
| [Determine whether all applicable policies address any new products,  |
| services, or delivery channels impacted by electronic                 |
| capabilities.](#_Review_internal_controls) [Do senior management and  |
| the Board annually review IT-related policies and procedures and is   |
| the review documented?](#_Does_senior_management)                     |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1e. [Is staff adequately trained to implement the security          |
| program?](#_Is_staff_adequately)                                      |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1f. [Determine whether key controls, systems, and procedures of the |
| information security program are regularly tested by independent      |
| third-parties or qualified independent staff in accordance with the   |
| risk assessment. Consider the following:](#_Determine_whether_key)    |
|                                                                       |
| -   [Nature and frequency of testing consistent with risk assessment  |
|     priorities.](#_Determine_whether_key)                             |
|                                                                       |
| -   [Adequacy of testing.](#_Determine_whether_key)                   |
|                                                                       |
| -   [Management review and response to testing                        |
|     results.](#_Determine_whether_key)                                |
|                                                                       |
| [**Comment:**](#_Determine_whether_key)                               |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1g. [Does the institution have a process for identifying and        |
| classifying information (data and system components) according to     |
| sensitivity and confidentiality? How does it use this process in its  |
| risk assessment?](#_Does_the_institution)                             |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1h. [Determine the usefulness of risk assessment reports from       |
| management to the Board (or its designated committee). Do the reports |
| adequately describe the overall status of the program, material risk  |
| issues, risk assessment, risk management and control decisions,       |
| service provider oversight, results of testing, security breaches and |
| management\'s response, and recommendations for program               |
| changes?](#_Determine_the_usefulness)                                 |
|                                                                       |
| -   [How often does the Board (or its designated committee) review    |
|     reports and determine the usefulness of these                     |
|     reports?](#_Determine_the_usefulness)                             |
|                                                                       |
| [**Comment:**](#_Determine_the_usefulness)                            |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| 2.1i. [Summarize your responses to questions 2.1a -- 2.1h to assess   |
| if the institution has complied with the requirements of Appendix B,  |
| Part 364, Standards for Safeguarding Customer                         |
| Information.](#_Has_management_evaluated)                             |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| **\[364-B\]**                                                         |
+-----------------------------------------------------------------------+
| ## 2.2[[]{#__RefHeading___To                                          |
| c4309388 .anchor}**. Vendor Management**](#_4._Outsourced_Technology) |
+-----------------------------------------------------------------------+
| 2.2a. [Does the bank have a vendor oversight program that includes    |
| analyzing SAS70 reports, financial statements and other reports on    |
| its significant vendor(s) and/or servicer(s)?](#_Are_users_allowed)   |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 2.2b. [Determine whether the Board, or an appropriate committee,      |
| approves new or significant changes to the service provider           |
| relationships based on a written business plan and risk analysis      |
| commensurate with the proposed/planned activity. The analysis should  |
| address the following:](#_Determine_whether_the)                      |
|                                                                       |
| -   [Purpose and goals of the banking product offerings within the    |
|     strategic and operating plans.](#_Determine_whether_the)          |
|                                                                       |
| -   [Review of projected financial impact of third-party              |
|     arrangements.](#_Determine_whether_the)                           |
|                                                                       |
| -   [Risks (definitions and acceptable levels) associated with each   |
|     outsourcing arrangement.](#_Determine_whether_the)                |
|                                                                       |
| -   [Role of audit, compliance, and legal                             |
|     staff.](#_Determine_whether_the)                                  |
|                                                                       |
| -   [Extent of outsourcing and responsibility for managing the        |
|     service provider relationship.](#_Determine_whether_the)          |
|                                                                       |
| -   [Whether management has implemented procedures to verify the      |
|     accuracy and content of any information provided by a             |
|     third-party.](#_Determine_whether_the)                            |
|                                                                       |
| [**Comment:**](#_Determine_whether_the)                               |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| ## [**3. Development and Acquisition**](#Development_and)             |
+-----------------------------------------------------------------------+
| 3a. [Evaluate procedures for acquiring significant new software.      |
| Consider the adequacy of:](#_Evaluate_procedures_for)                 |
|                                                                       |
| -   [The definition of user needs.](#_Evaluate_procedures_for)        |
|                                                                       |
| -   [Vendor evaluation -- financial condition, talking with other     |
|     clients, etc.](#_Evaluate_procedures_for)                         |
|                                                                       |
| -   [Service provider access controls or internal segregation of      |
|     duties surrounding change controls.](#_Evaluate_procedures_for)   |
|                                                                       |
| -   [Testing before implementing to                                   |
|     production.](#_Evaluate_procedures_for)                           |
|                                                                       |
| -   [Reporting to senior management on                                |
|     status.](#_Evaluate_procedures_for)                               |
|                                                                       |
| [**Comment:**](#_Evaluate_procedures_for)                             |
+-----------------------------------------------------------------------+
| 3b. [Is a software contract or license agreement in effect for all    |
| software? If so, does it grant the institution:](#_Is_a_software)     |
|                                                                       |
| -   [Possession of current source code and program documentation for  |
|     each application?](#_Is_a_software)                               |
|                                                                       |
| -   [The ability to obtain, use and modify the software in the event  |
|     the software vendor is unable or unwilling to properly maintain   |
|     the program(s)?](#_Is_a_software)                                 |
|                                                                       |
| -   [Independent assurances that the documentation and source code    |
|     are current if contractually held under escrow                    |
|     agreement?](#_Is_a_software)                                      |
|                                                                       |
| [**Comment:**](#_Is_a_software)                                       |
+-----------------------------------------------------------------------+
| [3c. Are vendor updates, releases, and emergency program changes      |
| reported to senior management before implementation or as soon as     |
| possible thereafter? Have all vendor updates and releases been        |
| installed? If not, what is the affect on vendor support? Is senior    |
| management informed of:](#Are_vendor_updates)                         |
|                                                                       |
| -   [Delays in installing program updates and                         |
|     releases?](#Are_vendor_updates)                                   |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Pre-change notification by vendor or development                 |
|     staff?](#Are_vendor_updates)                                      |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Vendor access controls or internal segregation of duties         |
|     surrounding change controls?](#Are_vendor_updates)                |
|                                                                       |
| -   [Testing before implementing into                                 |
|     production?](#Are_vendor_updates)                                 |
|                                                                       |
| -   [Status reports to senior management?](#Are_vendor_updates)       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 3d. [For remote vendor access to the computer, is there adequate      |
| control such as:](#_For_remote_user)                                  |
|                                                                       |
| -   [Senior management approval?](#_For_remote_user)                  |
|                                                                       |
| -   [Limiting and monitoring of activities                            |
|     performed?](#_For_remote_user)                                    |
|                                                                       |
| -   [One-time dial-in password access controlled by the               |
|     institution?](#_For_remote_user)                                  |
|                                                                       |
| -   [No dial-in access without institutional action (turn on modem,   |
|     open port, etc.)?](#_For_remote_user)                             |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Call-back or automated dial-back procedures before vendor access |
|     is allowed?](#_For_remote_user)                                   |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Detailed activity log of software and data file                  |
|     access?](#_For_remote_user)                                       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| ##                                                                    |
|  [**4. Support and Delivery**](#_Security_Administration/Management:) |
+-----------------------------------------------------------------------+
| 4a. [Is separation of duties and responsibilities adequate in the     |
| following areas:](#_Is_separation_of)                                 |
|                                                                       |
| -   [Input preparation and balancing?](#_Is_separation_of)            |
|                                                                       |
| -   [Data entry?](#_Is_separation_of)                                 |
|                                                                       |
| -   [Operation of the computer system?](#_Is_separation_of)           |
|                                                                       |
| -   [Handling of rejects for reentry?](#_Is_separation_of)            |
|                                                                       |
| -   [Review and handling of unposted                                  |
|     transactions?](#_Is_separation_of)                                |
|                                                                       |
| -   [Balancing of final output?](#_Is_separation_of)                  |
|                                                                       |
| -   [Statement preparation?](#_Is_separation_of)                      |
|                                                                       |
| [**Comment:**](#_Is_separation_of)                                    |
+-----------------------------------------------------------------------+
| [4b. Do supervisory personnel review reconcilements, exception items  |
| and activity reports regularly? Do they include                       |
| the:](#_Do_supervisory_personnel)                                     |
|                                                                       |
| -   [Receipt of all scheduled output reports even when the reports    |
|     contain no activity?](#_Do_supervisory_personnel)                 |
|                                                                       |
| -   [Effective review of all output and exception                     |
|     reports?](#_Do_supervisory_personnel)                             |
|                                                                       |
| -   [Determination of whether rejected, unposted, and listings of     |
|     captured items are independently                                  |
|     balanced?](#_Do_supervisory_personnel)                            |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4c. [Are master file change requests (such as address changes and due |
| dates):](#_Is_it_a)                                                   |
|                                                                       |
| -   [In writing?](#_Is_it_a)                                          |
|                                                                       |
| -   [Kept in a log book?](#_Is_it_a)                                  |
|                                                                       |
| -   [Formalized with procedures?](#_Is_it_a)                          |
|                                                                       |
| -   [Reconciled to the change report by an independent                |
|     individual?](#_Is_it_a)                                           |
|                                                                       |
| [**Comment:**](#_Is_it_a)                                             |
+-----------------------------------------------------------------------+
| 4d. [Is all computer output (printouts, microfiche, optical disks,    |
| etc.) adequately controlled and disposed of?](#_Is_all_computer)      |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| [4e. Are negotiable items that are computer processed (e.g., CD       |
| interest checks) adequately controlled?                               |
| Comment:](#_Are_negotiable_items)                                     |
|                                                                       |
| **Comments:**                                                         |
+-----------------------------------------------------------------------+
| 4f. [Determine procedures for setting/changing in-house parameters    |
| (interest rates, service charges, etc.).](#_Determine_procedures_for) |
|                                                                       |
| -   [Authorization/direction to change (i.e., approval for rate/fee   |
|     changes in a source document).](#_Determine_procedures_for)       |
|                                                                       |
| -   [Verification by independent person after input. Are parameter    |
|     change results verified the next                                  |
|     day?](#_Determine_procedures_for)                                 |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Authorization check by independent person that change was        |
|     approved/authentic.](#_Determine_procedures_for)                  |
|                                                                       |
| [**Comment:**](#_Determine_procedures_for)                            |
+-----------------------------------------------------------------------+
| 4g. [Are activity, problem, and transaction files (or logs)           |
| maintained and reviewed in a timely manner? Are the logs adequate to  |
| monitor and evaluate IT activities?](#_Is_a_problem)                  |
|                                                                       |
| -   [Are reports that record unsuccessful attempts to gain access     |
|     (during and after business hours) to the telecommunications       |
|     system, applications, or operating systems routinely reviewed? If |
|     so, how is the review documented?](#_Is_a_problem)                |
|                                                                       |
| -   [Is a transaction file maintained for all messages received from  |
|     all terminals?](#_Is_a_problem)                                   |
|                                                                       |
| [**Comment:**](#_Is_a_problem)                                        |
+-----------------------------------------------------------------------+
| 4h. [Evaluate the system's capacity and performance monitoring        |
| processes/programs. Determine whether:](#_Evaluate_the_system)        |
|                                                                       |
| -   [Services provided meet the needs of the                          |
|     institution.](#_Evaluate_the_system)                              |
|                                                                       |
| -   [Adequate resources are available to ensure daily processing and  |
|     backup routines are completed before start of next day            |
|     demands.](#_Evaluate_the_system)                                  |
|                                                                       |
| -   [Processes are adequate to troubleshoot problems (network and     |
|     application processing), monitor utilization of disk space,       |
|     etc.](#_Evaluate_the_system)                                      |
|                                                                       |
| -   [Management is alerted to any outages in service or significant   |
|     response time delays.](#_Evaluate_the_system)                     |
|                                                                       |
| [**Comment:**](#_Evaluate_the_system)                                 |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| 4i. [Are data processing personnel denied access to source programs   |
| and other documentation that are unnecessary to perform their         |
| duties?](#_Are_data_processing)                                       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4j. [Are sufficient controls in place to ensure that Automated        |
| Clearing House (ACH) transactions are processed in a secure           |
| manner?](#ACH)                                                        |
|                                                                       |
| -   Are policies and procedures in place for ACH activities?          |
|                                                                       |
| -   Handling of rejects for reentry?                                  |
|                                                                       |
| -   Review and handling of holdover transactions?                     |
|                                                                       |
| -   Daily balancing of system transactions?                           |
|                                                                       |
| -   Separation of duties for transaction processing?                  |
|                                                                       |
| -   Written agreements for all ACH customers?                         |
|                                                                       |
| -   Have ACH activities been considered in the institution's          |
|     insurance program?                                                |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4k. [If imaging systems are used (i.e. check truncation or document   |
| storage), are controls adequate?](#_Hlk69533032)                      |
|                                                                       |
| -   [If required for legal documents, does the chain of custody for   |
|     converting original documents to electronic images (scanning      |
|     process) ensure that images can not be altered?](#_Hlk69533032)   |
|                                                                       |
| -   [Are controls over the indexing process adequate?](#_Hlk69533032) |
|                                                                       |
| **Comment:**                                                          |
|                                                                       |
| ####                                                                  |
+-----------------------------------------------------------------------+
| 4l. [Are adequate controls for wireless networking technology (e.g.   |
| 802.11) in place?](#_Hlk69534953)                                     |
|                                                                       |
| -   [Does the bank have a wireless policy even if the bank does not   |
|     utilize wireless?](#_Hlk69534953)                                 |
|                                                                       |
| -   [Do controls include monitoring for rogue                         |
|     devices?](#_Hlk69534953)                                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| ## [[]{#__RefHeading                                                  |
| ___Toc4309391 .anchor}**4.1. Data and Physical Security**](#Data_and) |
+-----------------------------------------------------------------------+
| 4.1a. [Review access rights and permissions for the                   |
| following:](#_Review_access_rights)                                   |
|                                                                       |
| -   [Mainframe operating system](#_Review_access_rights)              |
|                                                                       |
| -   [Network operating system](#_Review_access_rights)                |
|                                                                       |
| -   [Application software (i.e. core banking                          |
|     applications)](#_Review_access_rights)                            |
|                                                                       |
| [Determine whether user access profiles are consistent with their job |
| function.](#_Review_access_rights)                                    |
|                                                                       |
| [Compare a sample of users\' access authority with their assigned     |
| duties and responsibilities.](#_Review_access_rights)                 |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1b. [Is access to the system restricted by:](#_Is_access_to)        |
|                                                                       |
| -   [Power-on passwords when the computer is turned on, a password    |
|     must be entered before access to the network is                   |
|     granted?](#_Is_access_to)                                         |
|                                                                       |
| -   [Passwords?](#_Is_access_to)                                      |
|                                                                       |
| -   [Unique operator identification (user logon ID)?](#_Is_access_to) |
|                                                                       |
| -   [Functions available to specific terminals?](#_Is_access_to)      |
|                                                                       |
| -   [Automatic timeout if left unattended? If so, how                 |
|     long?](#_Is_access_to)                                            |
|                                                                       |
| -   [Automatic log-off after repeated failed access attempts? If so,  |
|     how many? There should be no more than three.](#_Is_access_to)    |
|                                                                       |
| -   [Time of day and day of week?](#_Is_access_to)                    |
|                                                                       |
| -   [Firewalls, routers, etc?](#_Is_access_to)                        |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1c. [Determine password parameters (length, numeric/alphanumeric,   |
| composition, etc.).](#_Determine_password_parameters)                 |
|                                                                       |
| -   [Are passwords changed at an appropriate time frame? If so, how   |
|     often?](#_Determine_password_parameters)                          |
|                                                                       |
| -   [Are passwords suppressed from all                                |
|     output?](#_Determine_password_parameters)                         |
|                                                                       |
| -   [Are password files encrypted and                                 |
|     restricted?](#_Determine_password_parameters)                     |
|                                                                       |
| [**Comment:**](#_Determine_password_parameters)                       |
+-----------------------------------------------------------------------+
| 4.1d. [Are user IDs and passwords revoked when                        |
| users:](#_Are_User_IDs)                                               |
|                                                                       |
| -   [Leave the employment of the institution?](#_Are_User_IDs)        |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Are absent for an extended period of time?](#_Are_User_IDs)      |
|                                                                       |
| [**Comment:**](#_Are_User_IDs)                                        |
+-----------------------------------------------------------------------+
| 4.1e. [Determine whether sufficient controls are in place to prevent  |
| the corruption of data or software and to correct problems caused by  |
| computer viruses or operating system vulnerabilities.                 |
| Assess:](#_Determine_if_sufficient)                                   |
|                                                                       |
| -   [Virus detection practices for servers and                        |
|     workstations.](#_Determine_if_sufficient)                         |
|                                                                       |
| -   [Signature updates for virus detection applications (server- and  |
|     workstation-based).](#_Determine_if_sufficient)                   |
|                                                                       |
| -   [Procedures for timely installation of vendor-supplied software   |
|     patches.](#_Determine_if_sufficient)                              |
|                                                                       |
| -   [Periodic data file back up.](#_Determine_if_sufficient)          |
|                                                                       |
| -   [Policies to establish the use of virus detection software and    |
|     the products used.](#_Determine_if_sufficient)                    |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Whether virus detection software distribution is made through    |
|     downloads from the bank\'s server.](#_Determine_if_sufficient)    |
|                                                                       |
| -   [Whether the bank\'s software distribution process provides for   |
|     virus detection/prevention.](#_Determine_if_sufficient)           |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| [4.1f. Evaluate the adequacy of network architectures and the         |
| security of connections with public networks (including dial-in       |
| access through modems, e.g., credit bureau requests). Review the      |
| network topology (schematic diagram) to understand the relative       |
| connections between public networks, internal systems, and core       |
| banking applications. Consider the                                    |
| following:](#_Evaluate_the_adequacy)                                  |
|                                                                       |
| -   [The presence of firewalls between public networks and internal   |
|     systems.](#_Evaluate_the_adequacy)                                |
|                                                                       |
| -   [The adequacy and findings of the most recent network security    |
|     assessment that was performed.](#_Evaluate_the_adequacy)          |
|                                                                       |
| -   [Whether management's process for ensuring firewall(s) and other  |
|     network devices receives updates/patches/fixes to mitigate newly  |
|     discovered vulnerabilities.](#_Evaluate_the_adequacy)             |
|                                                                       |
| -   [The methods used to authenticate, monitor, and control remote    |
|     user access, either through dial-in, virtual private network      |
|     (VPN), or other technologies.](#_Evaluate_the_adequacy)           |
|                                                                       |
| -   [The presence of controls and approvals for modems on individual  |
|     PCs.](#_Evaluate_the_adequacy)                                    |
|                                                                       |
| -   [The use of intrusion detection systems (IDSs) and their          |
|     effectiveness.](#_Evaluate_the_adequacy)                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1g. [Evaluate the effectiveness of incident response practices.     |
| Consider the following:](#_Evaluate_the_effectiveness)                |
|                                                                       |
| -   [Establishment of appropriate escalation procedures to address    |
|     varying alerts or incidents.](#_Evaluate_the_effectiveness)       |
|                                                                       |
| -   [Establishment of an incident response team to address            |
|     incidents.](#_Evaluate_the_effectiveness)                         |
|                                                                       |
| -   [Procedures governing actions to be taken based on incident       |
|     reports received from outsource providers (Internet service       |
|     providers \[ISP\], application processors,                        |
|     etc.).](#_Evaluate_the_effectiveness)                             |
|                                                                       |
| -   [Procedures for reporting suspected crimes and computer           |
|     intrusions on Suspicious Activity Reports                         |
|     (SARs).](#_Evaluate_the_effectiveness)                            |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1h. [Determine whether security administration practices provide    |
| adequate separation of duties and appropriate supervisory review of   |
| security system maintenance activities. Consider the                  |
| following:](#_Determine_whether_security)                             |
|                                                                       |
| -   [Designation of an overall security                               |
|     administrator.](#_Determine_whether_security)                     |
|                                                                       |
| -   [Conflicting duties between data security and                     |
|     operations.](#_Determine_whether_security)                        |
|                                                                       |
| -   [Whether exception and other security-related reporting systems   |
|     are enabled and the reports are reviewed by an independent party  |
|     in a timely manner.](#_Determine_whether_security)                |
|                                                                       |
| [**Comment:**](#_Determine_whether_security)                          |
+-----------------------------------------------------------------------+
| 4.1i. [Are adequate safeguards in effect to ensure that only          |
| authorized personnel are permitted in the computer                    |
| area?](#_Are_adequate_safeguards)                                     |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1j. [Are compilers and utility programs with data or program        |
| altering capabilities adequately controlled by:](#_Are_compilers_and) |
|                                                                       |
| -   [Dual control procedures after removal from the                   |
|     system?](#_Are_compilers_and)                                     |
|                                                                       |
| -   [A password system?](#_Are_compilers_and)                         |
|                                                                       |
| -   [Other acceptable methods? (Explain.)](#_Are_compilers_and)       |
|                                                                       |
| [**Comment:**](#_Are_compilers_and)                                   |
+-----------------------------------------------------------------------+
| 4.1k. [Determine the controls and policies related to remote user's   |
| dial-in access capabilities.](#_Determine_the_controls)               |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1l. [Is the computer area adequately protected                      |
| by:](#_Is_the_computer)                                               |
|                                                                       |
| -   [Heat and smoke detectors?](#_Is_the_computer)                    |
|                                                                       |
| -   [A fire suppression system?](#_Is_the_computer)                   |
|                                                                       |
| -   [Remotely monitored alarm systems?](#_Is_the_computer)            |
|                                                                       |
| -   [Other methods? (Explain.)](#_Is_the_computer)                    |
|                                                                       |
| [**Comment:**](#_Is_the_computer)                                     |
+-----------------------------------------------------------------------+
| 4.1m. [Is the computer area uncluttered and hazard                    |
| free?](#_Is_the_computer_1)                                           |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1n. [Is the computer(s) equipped with an appropriate uninterrupted  |
| power supply (UPS) or alternate power source?](#_Is_the_data)         |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1o. [Does the bank use encryption during the storage and            |
| transmission of information? If so, how did management choose the     |
| encryption method? How did management determine that the encryption   |
| was strong enough for the sensitivity of the                          |
| information?](#_Determine_whether_encryption)                         |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.1p[. Does each employee sign a policy statement stating that he or  |
| she must:](#_Does_each_employee)                                      |
|                                                                       |
| -   [Use computer systems solely for corporate business               |
|     purposes?](#_Does_each_employee)                                  |
|                                                                       |
| -   [Maintain the privacy and confidentiality of all confidential and |
|     institutional data?](#_Does_each_employee)                        |
|                                                                       |
| -   [Use unique user-IDs and personal non-trivial secret passwords to |
|     access computer systems?](#_Does_each_employee)                   |
|                                                                       |
| -   [Be responsible for all activities occurring with his or her      |
|     user-Ids?](#_Does_each_employee)                                  |
|                                                                       |
| -   [Log out of all systems when leaving a computer system            |
|     unattended?](#_Does_each_employee)                                |
|                                                                       |
| -   [Report information security violations                           |
|     immediately?](#_Does_each_employee)                               |
|                                                                       |
| -   [Adhere to virus control procedures?](#_Does_each_employee)       |
|                                                                       |
| -   [Refrain from connecting networked workstation to modems without  |
|     approval?](#_Does_each_employee)                                  |
|                                                                       |
| -   [Never download unauthorized shareware programs or files for use  |
|     without proper authorization?](#_Does_each_employee)              |
|                                                                       |
| -   [Never transmit any proprietary, confidential, or otherwise       |
|     sensitive information without proper                              |
|     authorization?](#_Does_each_employee)                             |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| ## [[]{#__RefHeading___Toc4309392 .anchor}**4.2. Disaster Recovery Pl |
| anning/Business Continuity Planning**](#_Integrity_and_Availability:) |
+-----------------------------------------------------------------------+
| 4.2a. [Is electronic media stored in a fire resistant, limited access |
| area both in the financial institution and at the backup site? Is     |
| access to on-site and off-site data files (tapes and/or disks)        |
| limited to authorized personnel?](#_Is_electronic_media)              |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2b. [Is a copy of all master files taken off-site promptly after    |
| updating and not left in the data center overnight or over a weekend? |
| Consider the following:](#_Is_a_copy)                                 |
|                                                                       |
| -   [Length of time before data files are taken off-site and whether  |
|     they remain off-site or are returned.](#_Is_a_copy)               |
|                                                                       |
| -   [The number of copies of back-up tapes maintained at the back-up  |
|     site to ensure that there is a back-up in case of a bad tape or   |
|     disk.](#_Is_a_copy)                                               |
|                                                                       |
| -   [The method and security of transport to the off-site storage     |
|     site.](#_Is_a_copy)                                               |
|                                                                       |
| -   [The distance to the off-site storage location.](#_Is_a_copy)     |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2c. [Is there adequate and current off-premises storage             |
| of:](#_Is_there_adequate)                                             |
|                                                                       |
| -   [Data files?](#_Is_there_adequate)                                |
|                                                                       |
| -   [Source and object programs?](#_Is_there_adequate)                |
|                                                                       |
| -   [System and program documentation?](#_Is_there_adequate)          |
|                                                                       |
| -   [Operating systems and utility programs?](#_Is_there_adequate)    |
|                                                                       |
| -   [Reserve supplies?](#_Is_there_adequate)                          |
|                                                                       |
| -   [User and operator instructions?](#_Is_there_adequate)            |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [A copy of the contingency plan and backup                        |
|     agreement?](#_Is_there_adequate)                                  |
|                                                                       |
| [Is there a current inventory list of the                             |
| items?](#_Is_there_adequate)                                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2d. [Are employees familiar with their responsibilities under the   |
| emergency plan?](#_Is_access_to_1)                                    |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2e. [Does the contingency plan adequately                           |
| address:](#_Does_the_contingency)                                     |
|                                                                       |
| -   [Under what conditions the backup site would be                   |
|     used?](#_Does_the_contingency)                                    |
|                                                                       |
| -   [Decision-making responsibility for use of the backup             |
|     site?](#_Does_the_contingency)                                    |
|                                                                       |
| -   [Procedures for notification of the backup                        |
|     site?](#_Does_the_contingency)                                    |
|                                                                       |
| -   [A checklist of data files, programs, and other items to be       |
|     transported to the backup site?](#_Does_the_contingency)          |
|                                                                       |
| -   [Provisions for special forms and backup                          |
|     supplies?](#_Does_the_contingency)                                |
|                                                                       |
| -   [Remote terminal activities?](#_Does_the_contingency)             |
|                                                                       |
| -   [Processing instructions and priorities?](#_Does_the_contingency) |
|                                                                       |
| [**Comment:**](#_Does_the_contingency)                                |
+-----------------------------------------------------------------------+
| 4.2f. [Is a comprehensive written agreement in effect with the backup |
| site?](#_Is_a_comprehensive)                                          |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2g. [Has the contingency plan, including the backup site, been      |
| tested within the past 12 months?](#_Has_the_contingency)             |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2h. [Evaluate the testing of the business continuity plan. Consider |
| the following:](#_Evaluate_the_testing)                               |
|                                                                       |
| -   [The adequacy of the test for all mission-critical applications   |
|     and the level of the bank's involvement.](#_Evaluate_the_testing) |
|                                                                       |
| -   [The adequacy of hardware and availability of processing time to  |
|     capture or submit all critical daily                              |
|     transactions.](#_Evaluate_the_testing)                            |
|                                                                       |
| -   [The adequacy of processing time needed to complete daily         |
|     processing of critical work, including daily backup               |
|     routines.](#_Evaluate_the_testing)                                |
|                                                                       |
| -   [Usage of off-site materials to conduct the recovery              |
|     test.](#_Evaluate_the_testing)                                    |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [The scope of the bank's contingency plan test                    |
|     program.](#_Evaluate_the_testing)                                 |
|                                                                       |
| [**Comment:**](#_Evaluate_the_testing)                                |
+-----------------------------------------------------------------------+
| 4.2i. [Has a report detailing the scope and results of the backup     |
| test been presented to senior management and the Board of             |
| Directors?](#_Has_a_report)                                           |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2j. [If the institution is serviced, does it subscribe to disaster  |
| recovery services offered by the servicer? If not, does the           |
| institution have contracts with any other third-party regarding a hot |
| site, cold site, reciprocal agreements, etc.?                         |
| Explain.](#_If_the_institution)                                       |
|                                                                       |
| **Comment:**                                                          |
+-----------------------------------------------------------------------+
| 4.2k. [Does the emergency plan adequately provide                     |
| for:](#_Does_the_emergency)                                           |
|                                                                       |
| -   [Personnel evacuation?](#_Does_the_emergency)                     |
|                                                                       |
| -   [Assignment of action to be taken in specific emergencies         |
|     including the safe storage of data files and                      |
|     documents?](#_Does_the_emergency)                                 |
|                                                                       |
| -   [Power-off procedures?](#_Does_the_emergency)                     |
|                                                                       |
| ```{=html}                                                            |
| <!-- -->                                                              |
| ```                                                                   |
| -   [Restart and recovery procedures?](#_Does_the_emergency)          |
|                                                                       |
| [**Comment:**](#_Does_the_emergency)                                  |
+-----------------------------------------------------------------------+