cyber - risk management strategies. we encourage bank management teams to engage with regulatory points of contact whenever questions arise on cyber security matters just as with any other regulatory matter. closing remarks in closing, the pace of technological change continues to accelerate. we recognize that banks need to adopt new technologies to meet customer demands, to take advantage of efficiencies and cost savings, and to remain competitive in the marketplace. although third - party relationships are one avenue for community banks to bring new technologies online, they must do so with a thorough understanding of the associated risks. the federal reserve is committed to working together with the other regulators to continue providing guidance and resources, like this workshop, to ensure that banks are appropriately managing cyber risk. thank you again for the invitation be with you today. i hope this workshop demonstrates the value of open communication between bankers, regulators, industry, and law enforcement so that we may continue to work together in building resilience in the financial system to ever - evolving cyber risks. 1 the views expressed in these remarks are my own and do not necessarily reflect those of my colleagues on the board of governors of the federal reserve system. 2 see board of governors of the federal reserve system, cybersecurity and financial system resilience report ( pdf ) ( washington : board of governors, july 2022 ). 3 see " phishing, " ( pdf ) cybersecurity and infrastructure security agency. 4 see federal deposit insurance corporation, risk review ( pdf ) ( washington : federal deposit insurance corporation, june 2022 ). 5 see proposed interagency guidance on third - party relationships : risk management, 86 fed. reg. 38182 ( july 19, 2021 ). 6 see " sr 21 - 15 / ca 21 - 11 : guide for community banking organizations conducting due diligence on financial technology companies, " board of governors of the federal reserve system, last modified september 15, 2021. 5 / 6 bis - central bankers'speeches 7 see computer - security incident notification requirements for banking organizations and their bank service providers, 86 fed. reg. 66424 ( effective april 1, 2022 ). 8 see board of governors of the federal reserve system, cybersecurity and financial system. 6 / 6 bis - central bankers'speeches

the metrics used to evaluate these two questions would rely on loan counts rather than dollar value in order to avoid inadvertent biases in favor of fewer, higher - dollar value loans. 9 the in order for the retail lending metrics to provide a meaningful evaluation, a bank would also need to meet a minimum percentage of retail loans in its local community relative to its deposits. the bank ’ s ratio would be compared to a minimum activity threshold based on the performance of all reporting banks in that same assessment area, with the goal of screening out the lowest performers who would need to undergo a full review from an metrics would be evaluated separately for each major product line in a bank ’ s assessment area, which is important to tailor the use of metrics to a bank ’ s business model. the proposed approach measures a bank ’ s performance in serving the needs of both lowand moderate - income borrowers ( and small businesses and small farms ) and lmi places in the community. for mortgage loans, an lmi borrower distribution metric would calculate the percentage of a bank ’ s number of loans made to lmi borrowers relative to its overall mortgage originations, and assess this percentage against an assessment area threshold determined by local demographics and the aggregate lending of other in - market competitors. a separate lmi neighborhood distribution metric would evaluate the percentage of a bank ’ s number of loans in lmi tracts to its overall loan count and assess this against a threshold determined by local demographics and the aggregate lending of other in - market competitors. a bank that meets or exceeds both the lmi borrower and lmi neighborhood thresholds for each of its major product lines would be presumed to have a satisfactory - or - better level of retail lending performance in that assessment area. using a customized dashboard, each bank could track its own activity against the threshold on an ongoing basis reflecting recent data, eliminating the lengthy uncertainty associated with the current evaluation methodology, which many banks have highlighted as the most important area for reform ( figure 2 ). importantly, the cra database we have constructed confirms that the proposed retail lending metrics correlate well with past ratings of bank performance ( figure 3 ). the specific thresholds that would establish a presumption of satisfactory performance could be informed by examiner. the minimum activity threshold would be calibrated for geographies and different market conditions over time. current evaluation procedures but need not be set at the same level, and public input will be important. the retail lending