Blair Rugh: Security Is The New Compliance - Threat Advice
After spending more than 40 years dealing with regulators and advising bankers on compliance and regulatory issues, Blair Rugh has a pretty good understanding of how examiners think.
As regulators began to realize the impact that technology had on the overall safety and soundness of a financial institution, they started requiring banks to move IT from the back room to the boardroom. And that was before information security and cyber risks were an issue. As cybersecurity threats became prevalent, your bank’s regulatory risk grew with it and examiners started to take notice.
Examiners are taking a more comprehensive approach when assessing a bank’s IT program. Regulators are not reviewing the bank’s IT rating in isolation. The IT rating is receiving more consideration in assessing how effectively management and the board are protecting the organization from overall risk. Furthermore, regulators continue to consider ways to factor a bank’s IT rating into the CAMELS management rating given the detrimental impact cyber events have on an organization.
What if you suffer a cyber breach or other information security event? In addition to a hit to your reputation you can be assured you will receive prompt regulatory attention.
Cybersecurity breaches and technology risk management weaknesses can and probably will result in more frequent regulatory supervision, and your bank may be placed under an enforcement action as well.
Increased regulatory visits and examinations require significant internal resources and take management’s focus from its primary objective of meeting the needs of customers and enhancing shareholder value due to attention required to manage regulatory risks. In addition, if an enforcement action is placed on your organization, it will likely impact your ability to execute strategic decisions such as mergers, acquisitions or other key initiatives.
A well-developed strategic plan for managing technology risk that is successfully executed throughout the organization will not only keep your bank and customers safe, but it will also ensure you are maintaining strong regulatory relationships that will support your ability to execute your strategic initiatives.
NXTsoft can help - our ThreatAdvice vCISO program consists of a team of cybersecurity specialists ready to assist or lead your information security program. Learn more about ThreatAdvice vCISO or give us a call at 1-800-915-3381. One of our vCISO specialists will be glad to provide details on the services and benefits that ThreatAdvice vCISO can offer your institution.