FDIC Advisory Committee on 

Community Banking 

November 3, 2021 

Information Technology Supervision Update 
FDIC 

 

 

 

 

Cybersecurity – FinCEN Ransomware Report 

This report is issued pursuant to 

Section 6206 of the Anti-Money 

Laundering Act of 2020 which 

requires the Financial Crimes 

Enforcement Network to 

periodically publish threat pattern 

and trend information derived from 

financial institutions’ Suspicious 

Activity Reports. 

Published October 15, 2021 2 
F<'ii cr,1 1 Fin,m c i,1l lnst1l u tions Ex~1m in,1tion CoL1n d l 

Authentication and Access to Financial Institution Services and Systems 

Introduction 

The Federal Financial lnsritut:ions Examination Council (FFIEC) on behalf of its members I is 

issuing this guidance tided Awhemicatio11 and Access to Financial Institution Senrices and 

Systems (the Guidance) to provide financ ial inslitutions wi1h examples of cffec1ive risk 

managemenl principles and practices for access and aulhentication. These principles and 

practices address business and consumer cuslomers, employees, and third parties that access 

digital banking services2 and financial institution information systems. 

The Guidance replaces the FFIEC•issued Authentication in 011 Imernet Banki11g E1wiro11men1 

(2005) and the Supplement to Aml,emication in an lmernet Banking Environment (20 //), which 

provided risk management practices for financial institutions offering Internet.based products 

and services. This Guidance acknowledges significant risks associated with the cybcrsccu.rity 

threat landscape that reinforce the need for financ ial institutions to effectively authent:icate users 

and customers' to protect information systems, accounts, and data. The Guidance also 

recognizes that authentication considerations have extended beyond customers and include 

employees, third panies, and system•to-system communications. 

This Guidance highlights risk managemen1 practices that suppon oversight of identification, 

authentication, and access solutions as pan of an institution's information security program. 

Periodic risk asses:smenrs inform financial institution management 's decisions about 

authentication solutions and other controls that are deployed to mitigate identified risks. When a 

risk assessmenl indicates that single-.factor authen1ication with layered security is inadequa1e, 

multi.factor authentication (MF A) or controls of equivalent strength, combined with other 

layered security controls, can more effectively mitigate risks associated with authentication. 

Financial institutions are subject to various safety and soundness standards, such as the standard 

to have internal controls and infonna tion systems that are appropriate to the institution's size and 

complexity and the nature, scope, and risk of its activities.

4 Applying the principles and 

1 The Comcil has six voting membc-rs: a ~mbcr ofthc- Board ofGo\.~mon. ofthc- Feder.el Reserve System. thcChairman of the Federal Dr:posil lnsura.noc Corporatmn: lhc Chamnan of the National Credi I Union Adm:inim-atmn: 

the Comptroller of the ClfffflCy of the Office of the Comptroller of the- Currency: the- Director of the Consumer 

Financial Protcctmn Bureau; and the Chairman of the State Liaison Commltt~. 

1 D1gi1al banking refer.; to any banking service or platform that utilizes lntcmc1 or mobile cellular network 

communicanons for pro,'lding CU5tomcrs wilh bankmg scn'lccs or transacoons. 

1 For purposes o f this Gu1dar.:c only. the terms "users"' and '"customers"' src defined 10 s«tion I oflhis GWdancc. 

' Sec, for c.-.:amplc. lntcr:e_gcncy Guidelines Establishing Standards for Safety and Soundness: 12 CFR 30. Appcndu: 

A, ll(A) {OCC); 12 CFR 208. Appendix D-1. ll(A) (l-"RB): and 12 CFR 364. Appendix A. l l(A) (1-"DIC). Sc-c a.lso 

12 CFR ~ 74 1.3 (NCUA). 

FDIC 

 

 

 

 

 

Cybersecurity – FFIEC Authentication Guidance Update 

• Scope: 

• business & consumer customers 

• employees 

• 3rd parties – people & computers 

• “... malicious activity resulting in 

compromise of customer and user 

accounts and information system 

security has shown that single-factor 

authentication, either alone or in 

combination with layered security, is 

inadequate in many situations.” 

3 Published August 11, 2021 
FDIC = Home II News II Press Re leases II 2020 

Press Release 

Agencies Propose Requirement for Computer Security Incident Notification 

December 18, 2020 

FOR IMMEDIATE RELEASE 

Federal financial regulatory agencies today announced a proposal that would require supervised banking organizations to 

promptly notify their primary federal regulator in the event of a computer security incident. In particular, alerts would be required 

for incidents that could result in a banking organization's inability to deliver services to a material portion of its customer base, 

jeopardize the viability of key operations of a banking organization, or impact the stability of the financial sector. 

The proposed rule is intended to provide the agencies with an early warning of significant computer security incidents and would 

require notification as soon as possible and no later than 36 hours after a banking organization determines that an incident has 

occurred. 

In addition, the proposal would require service providers to notify affected banking organizations immediately when the service 

provider experiences computer security incidents that materially disrupt, degrade, or impair certain services they provide. 

Comments on the proposal must be received within 90 days of its publication in the Federal Register. 

FDIC: PR-141-2020 

Attachment: 

~ Notice of ProJlosed Rulema king 

FDIC 

 

 

Cybersecurity – Computer Security Incident Notification 

Major Themes From the Comments 

• Focus on critical computer-security 

problems – avoid insignificant 

matters 

• Simplify reporting to banks and to 

regulators 

• Banks and service providers may need 

more time to determine that 

notification is required 

• Existing contracts typically contain 

notification requirements 

• Statutes and regulations require 

notification to regulators (e.g., SARs, 

GLBA) Published December 18, 2020 

4