Bank examiners and auditors constantly change their expectations. The result is you feel as if your information security practices are trying to hit a moving target while the boundaries shift constantly.
User Access
There are likely a high number of systems in place at your institution. Running a successful financial institution relies heavily on tools and technologies that will improve the efficiencies of you and your team.
It’s vital for you to fully understand the information security management systems you have in place
But it’s a nuisance to keep track of them all. First, you need to know the status of every component, especially for the systems you outsourced. Then, you must also understand the different kinds of information the systems store, how it’s stored, how data is transmitted, and what kinds of information is transmitted.
In a technology driven industry, it is easy to assume that most of the decisions made around your cybersecurity posture are related to tools and software. While that may be the case a majority of the time, FINOSEC President and CEO Zach Duke also raises some questions and awareness around the impact of staffing on your cybersecurity and information security environment. In the video below, Zach poses questions around ISO independence, support infrastructure, and how to navigate staffing limitations. Watch the video and come back after the break for further discussion.
It is understood and expected that auditors and examiners will ask financial institutions about the safeguards, controls, and tools in place that drive and strengthen their cybersecurity governance. But as FINOSEC President and CEO Zach Duke describes in today’s video, they will also be looking for additional components. The industry is seeing expectations to describe the nuances of what questions and processes were present in cyber related strategic decisions, a concept called “credible challenge.” Auditors and examiners are looking for validation that the Board and other executive leadership members are asking solid questions and demonstrate compelling processes in making decisions around cybersecurity. Watch the video from Zach below and come back after the break for further discussion.
