Federal Register / Vol. 87, No. 104 / Tuesday, May 31, 2022 / Notices 32497 

The information collection 

requirements in 12 CFR part 1016 are as 

follows: 

§ 1016.4(a) Initial privacy notice to 

consumers requirement—A national 

bank or Federal savings association 

must provide a clear and conspicuous 

notice to customers and consumers that 

accurately reflects its privacy policies 

and practices. 

§ 1016.5(a)(1) Annual privacy notice 

to customers requirement—A national 

bank or Federal savings association 

must provide a clear and conspicuous 

notice to customers that accurately 

reflects its privacy policies and 

practices not less than annually during 

the continuation of the customer 

relationship. 

§ 1016.8 Revised privacy notices—A 

national bank or Federal savings 

association must not disclose any 

nonpublic personal information to a 

nonaffiliated third party in a way that is 

inconsistent with the notices previously 

given to a consumer unless the 

institution has provided the consumer 

with a clear and conspicuous revised 

notice of the institution’s policies and 

practices, the institution has provided 

the consumer with a new opt out notice, 

the institution has given the consumer 

a reasonable opportunity to opt out of 

the disclosure, and the consumer has 

not opted out. 

§ 1016.7(a) Form of opt out notice to 

consumers; opt out methods—Form of 

opt out notice If a national bank or 

Federal savings association is required 

to provide an opt out notice under 

§ 1016.10(a), it must provide to each of 

its consumers a clear and conspicuous 

notice that accurately explains the right 

to opt out under that section. The notice 

must state: 

• That the national bank or Federal 

savings association discloses or reserves 

the right to disclose nonpublic personal 

information about its consumer to a 

nonaffiliated third party; 

• That the consumer has the right to 

opt out of that disclosure; and 

• A reasonable means by which the 

consumer may exercise the opt out 

right. 

A national bank or Federal savings 

association provides a reasonable means 

to exercise an opt out right if it: 

• Designates check-off boxes on the 

relevant forms with the opt out notice; 

• Includes a reply form with the opt 

out notice; 

• Provides an electronic means to opt 

out; or 

• Provides a toll-free number that 

consumers may call to opt out. 

§§ 1016.10(a)(1) and (2) and 

1016.10(c)—Limits on disclosure of 

nonpublic personal information to 

nonaffiliated parties—A national bank 

or Federal savings association may not 

disclose any nonpublic personal 

information about a consumer to a 

nonaffiliated third party unless the 

institution has provided the consumer 

with an initial notice under § 1016.4, 

the institution has provided the 

consumer with a opt out notice, the 

institution has given the consumer a 

reasonable opportunity to opt out of the 

disclosure, and the consumer has not 

opted out. A customer may direct one of 

the following forms of opt out: 

• Opt out—Consumers may direct 

that the national bank or Federal savings 

association not disclose nonpublic 

personal information about them to a 

nonaffiliated third party, other than 

permitted by §§ 1016.13–1016.15. 

• Partial opt out—Consumers may 

exercise partial opt out rights by 

selecting certain nonpublic personal 

information or certain nonaffiliated 

third parties with respect to which the 

consumer wishes to opt out. 

§§ 1016.7(h) and 1016.7(i) Continuing 

right to opt out and Duration of right to 

opt out—A consumer may exercise the 

right to opt out at any time. A 

consumer’s direction to opt out is 

effective until the consumer revokes it 

in writing or, if the consumer agrees, 

electronically. When a customer 

relationship terminates, the customer’s 

opt out direction continues to apply to 

the nonpublic personal information 

collected during or related to that 

relationship. If the consumer 

subsequently establishes a new 

customer relationship with the 

institution, the opt out direction that 

applied to the former relationship does 

not apply to the new relationship. 

Type of Review: Regular. 

Affected Public: Businesses or other 

for-profit; individuals. 

Frequency of Response: On occasion. 

Estimated Annual Number of 

Respondents: 2,451,659. 

Estimated Total Annual Burden 

Hours: 626,011.25 hours. 

Comments submitted in response to 

this notice will be summarized and 

included in the request for OMB 

approval. Comments are invited on: 

(a) Whether the collection of 

information is necessary for the proper 

performance of the functions of the 

OCC, including whether the information 

has practical utility; 

(b) The accuracy of the OCC’s 

estimate of the burden of the collection 

of information; 

(c) Ways to enhance the quality, 

utility, and clarity of the information to 

be collected; 

(d) Ways to minimize the burden of 

the collection on respondents, including 

through the use of automated collection 

techniques or other forms of information 

technology; and 

(e) Estimates of capital or start-up 

costs and costs of operation, 

maintenance, and purchase of services 

to provide information. 

Theodore J. Dowd, 

Deputy Chief Counsel, Office of the 

Comptroller of the Currency. 

[FR Doc. 2022–11566 Filed 5–27–22; 8:45 am] 

BILLING CODE 4810–33–P 

DEPARTMENT OF THE TREASURY 

Office of the Comptroller of the 

Currency 

Agency Information Collection 

Activities: Information Collection 

Renewal; Comment Request; FFIEC 

Cybersecurity Assessment Tool 

AGENCY: Office of the Comptroller of the 

Currency (OCC), Treasury. 

ACTION: Notice and request for comment. 

SUMMARY: The OCC, on behalf of itself, 

the Board of Governors of the Federal 

Reserve System (Board), the Federal 

Deposit Insurance Corporation (FDIC), 

and the National Credit Union 

Administration (NCUA) (collectively, 

the Agencies), as part of its continuing 

effort to reduce paperwork and 

respondent burden, invites the general 

public and other Federal agencies to 

comment on a continuing information 

collection as required by the Paperwork 

Reduction Act of 1995 (PRA). In 

accordance with the requirements of the 

PRA, the Agencies may not conduct or 

sponsor, and the respondent is not 

required to respond to, an information 

collection unless it displays a currently 

valid Office of Management and Budget 

(OMB) control number. The OCC is 

soliciting comment on behalf of the 

Agencies concerning renewal of the 

information collection titled, ‘‘FFIEC 

Cybersecurity Assessment Tool’’ 

(Assessment). 

DATES: Comments must be submitted on 

or before August 1, 2022. 

ADDRESSES: Commenters are encouraged 

to submit comments by email, if 

possible. You may submit comments by 

any of the following methods: 

• Email: prainfo@occ.treas.gov. 

• Mail: Chief Counsel’s Office, 

Attention: Comment Processing, Office 

of the Comptroller of the Currency, 

Attention: 1557–0328, 400 7th Street 

SW, Suite 3E–218, Washington, DC 

20219. 

• Hand Delivery/Courier: 400 7th 

Street SW, Suite 3E–218, Washington, 

DC 20219. 


khammond on DSKJM1Z7X2PROD with NOTICES
32498 Federal Register / Vol. 87, No. 104 / Tuesday, May 31, 2022 / Notices 

1For purposes of this information collection, the 

term ‘‘financial institution’’ includes banks, savings 

associations, credit unions, and bank holding 

companies. 

• Fax: (571) 465–4326. 

Instructions: You must include 

‘‘OCC’’ as the agency name and ‘‘1557– 

0328’’ in your comment. In general, the 

OCC will publish comments on 

www.reginfo.gov without change, 

including any business or personal 

information provided, such as name and 

address information, email addresses, or 

phone numbers. Comments received, 

including attachments and other 

supporting materials, are part of the 

public record and subject to public 

disclosure. Do not include any 

information in your comment or 

supporting materials that you consider 

confidential or inappropriate for public 

disclosure. 

Following the close of this notice’s 

60-day comment period, the OCC will 

publish a second notice with a 30-day 

comment period. You may review 

comments and other related materials 

that pertain to this information 

collection beginning on the date of 

publication of the second notice for this 

collection by the method set forth in the 

next bullet. 

• Viewing Comments Electronically: 

Go to www.reginfo.gov. Hover over the 

‘‘Information Collection Review’’ drop 

down menu. From the ‘‘Currently under 

Review’’ drop-down menu, select 

‘‘Department of Treasury’’ and then 

click ‘‘submit.’’ This information 

collection can be located by searching 

by OMB control number ‘‘1557–0328’’ 

or ‘‘FFIEC Cybersecurity Assessment 

Tool.’’ Upon finding the appropriate 

information collection, click on the 

related ‘‘ICR Reference Number.’’ On the 

next screen, select ‘‘View Supporting 

Statement and Other Documents’’ and 

then click on the link to any comment 

listed at the bottom of the screen. 

• For assistance in navigating 

www.reginfo.gov, please contact the 

Regulatory Information Service Center 

at (202) 482–7340. 

FOR FURTHER INFORMATION CONTACT: 

Shaquita Merritt, OCC Clearance 

Officer, Chief Counsel’s Office, Office of 

the Comptroller of the Currency, 400 7th 

Street SW, Suite 3E–218, Washington, 

DC 20219. If you are deaf, hard of 

hearing, or have a speech disability, 

please dial 7–1–1 to access 

telecommunications relay services. 

SUPPLEMENTARY INFORMATION: Under the 

PRA (44 U.S.C. 3501 et seq.), Federal 

agencies must obtain approval from 

OMB for each collection of information 

they conduct or sponsor. ‘‘Collection of 

information’’ is defined in 44 U.S.C. 

3502(3) and 5 CFR 1320.3(c) to include 

agency requests or requirements that 

members of the public submit reports, 

keep records, or provide information to 

a third party. The definition contained 

in 5 CFR 1320.3(c) also includes a 

voluntary collection. Section 

3506(c)(2)(A) of title 44 requires Federal 

agencies to provide a 60-day notice in 

the Federal Register concerning each 

proposed collection of information, 

including each proposed extension of an 

existing collection of information, 

before submitting the collection to OMB 

for approval. To comply with this 

requirement, the OCC is publishing, on 

behalf of the Agencies, a notice of the 

proposed extension of the collection of 

information set forth in this document. 

Title: FFIEC Cybersecurity 

Assessment Tool. OMB Number: 1557– 

0328. 

Description: Cyber threats continue to 

evolve and increase in frequency and 

sophistication. Financial institutions 1

are exposed to cyber risks because they 

are dependent on information 

technology to deliver services to 

consumers and businesses every day. 

Cyber attacks on financial institutions 

may result in unauthorized access to, 

and the compromise of, confidential 

information, as well as the destruction 

of critical data and systems. Disruption, 

degradation, or unauthorized alteration 

of information and systems can affect a 

financial institution’s operations and 

core processes and undermine 

confidence in the nation’s financial 

services sector. Absent immediate 

attention to these rapidly increasing 

threats, financial institutions and the 

financial sector as a whole are at risk. 

For this reason, the Agencies, under 

the auspices of the Federal Financial 

Institutions Examination Council 

(FFIEC), have worked diligently to 

assess and enhance the state of the 

financial industry’s cyber preparedness 

and to improve the Agencies’ 

examination procedures and training to 

strengthen the oversight of financial 

industry cybersecurity readiness. The 

Agencies also have focused on 

providing financial institutions with 

resources that can assist in protecting 

them and their customers from the 

growing risks posed by cyber attacks. 

As part of these efforts, the Agencies, 

with the other FFIEC members, 

developed the Assessment to assist 

financial institutions of all sizes in 

assessing their inherent cyber risks and 

their risk management capabilities. The 

Assessment allows a financial 

institution to identify its inherent cyber 

risk profile based on technologies and 

connection types, delivery channels, 

online/mobile products and technology 

services, organizational characteristics, 

and cyber threats it is likely to face. 

Once a financial institution identifies its 

inherent cyber risk profile, it can use the 

Assessment’s maturity matrix to 

evaluate its level of cybersecurity 

preparedness based on its cyber risk 

management and oversight, threat 

intelligence and collaboration, 

cybersecurity controls, external 

dependency management, and cyber 

incident management and resiliency 

planning. A financial institution may 

use the matrix’s maturity levels to 

identify opportunities for improving its 

cyber risk management based on its 

inherent risk profile. The Assessment 

also enables a financial institution to 

rapidly identify areas that could 

improve the financial institution’s cyber 

response programs, as appropriate. Use 

of the Assessment by financial 

institutions is voluntary. 

Type of Review: Regular. 

Affected Public: Businesses or other 

for-profit. 

Burden Estimates: 

Number of Respondents: 12,781. 

Total Burden: 1,154,150 hours. 

Comments submitted in response to 

this notice will be summarized and 

included in the request for OMB 

approval. All comments will become a 

matter of public record. Comments are 

invited on: (a) Whether the collection of 

information is necessary for the proper 

performance of the functions of the 

Agencies, including whether the 

information has practical utility; (b) The 

accuracy of the Agencies’ estimates of 

the burden of the collection of 

information; (c) Ways to enhance the 

quality, utility, and clarity of the 

information to be collected; (d) Ways to 

minimize the burden of the collection 

on respondents, including through the 

use of automated collection techniques 

or other forms of information 

technology; and (e) Estimates of capital 

or start-up costs and costs of operation, 

maintenance, and purchase of services 

to provide information. 

Theodore J. Dowd, 

Deputy Chief Counsel, Office of the 

Comptroller of the Currency. 

[FR Doc. 2022–11565 Filed 5–27–22; 8:45 am] 

BILLING CODE P 


khammond on DSKJM1Z7X2PROD with NOTICES