A Crisis Response, Information Sharing View of FFIEC Appendix J?
|
|
- Kevin Fletcher
- 8 years ago
- Views:
Transcription
1 A Crisis Response, Information Sharing View of FFIEC Appendix J? Susan Rogers (MBCP, MBCI) Financial Services Information Sharing and Analysis Center FS-ISAC, Business Resiliency Director
2 A Crisis Response, Information Sharing View of FFIEC Appendix J BC Manager Action Items 1. Correlate Appendix J Objectives to Crisis Response 2. Connect to your Industry s ISAC 3. Engage in Sector and Cross-Sector Exercises 2
3 Action Items for BC Managers 1. Correlate Appendix J Objectives to Crisis Response Testing Prioritize Critical Third Party Risk Testing Due Diligence and Contract Review Testing Capacity and Cyber Resilience 2. Connect to your Industry s ISAC 3. Engage in Sector and Cross-Sector Exercises 3
4 Background on FFIEC BC Handbook, Appendix J On February 6, 2015, the Federal Financial Institutions Examination Council (FFIEC) issued updated guidance for examiners, financial institutions, and technology service providers (TSPs) to explain the components of an effective third-party management program that can identify, measure, monitor, and control the risks associated with outsourcing. The guidance, which is included in the FFIEC Information Technology Examination Handbook, is an update to the "Business Continuity Planning Booklet," issued in March A financial institution should be able to demonstrate the ability to recover critical IT systems and resume normal business operations regardless of whether the process is supported in-house or at a TSP for all types of adverse events. 4
5 Appendix J - Testing Key Element The testing program should be based on a financial institution s established risk prioritization and evaluation of the criticality of the functions involved. Testing with third parties should disclose the adequacy of both organizations ability to recover, restore, resume, and maintain operations after disruptions, consistent with business and contractual requirements. Any test results that impact the financial institution are to be provided to the board. A financial institution should ensure that it understands its TSP's testing process to ensure that the testing is adequate to meet its continuity expectations. Testing 3 rd Party Mgmt 3 rd Party Capacity Prioritize Critical Third Party Risk Cyber Resilience 5 Regional Business Continuity Conference
6 6 Appendix J - Testing Key Element Testing frequency should be driven by the financial institution s risk assessment, risk rating, and any significant changes to the operating environment. To the extent that a test is unsuccessful, any issues identified should be tracked and resolved in a timely manner, according to the severity of the issues. The scope of BCP testing with third parties should be commensurate with the level and criticality of services provided and, in some cases, requires an end-to-end exercise. Finally, the right to perform or participate in BCP testing with third parties should be described within the contract governing the third-party relationship. Regional Business Continuity Conference Testing 3 rd Party Mgmt 3 rd Party Capacity Prioritize Critical Third Party Risk Cyber Resilience
7 Appendix J 3 rd Party Management Due Diligence An institution should review the TSP s BCP program and its alignment with the financial institution s own program, including an evaluation of the TSP s BCP testing strategy and results to ensure they meet the financial institution s requirements and promote resilience. Contracts Right to audit BCP Testing Data Governance Security Issues Testing 3 rd Party Mgmt 3 rd Party Capacity Testing Due Diligence and Contract Review Cyber Resilience 7
8 Appendix J 3 rd Party Capacity Testing Complexity & Strategic Considerations 8 Third Party Capacity & Alternatives The significant size & client concentration of larger TSPs increases the potential impact of service disruptions across major segments of the financial industry. TSP s should assess the impact on their customers and take the necessary steps to minimize the impact of the event. Cyber Resilience Malware Insider Threats Data or System Destruction/Corruption Communication Infrastructure Disruption Regional Business Continuity Conference Testing 3 rd Party Mgmt 3 rd Party Capacity Cyber Resilience
9 Action Items for BC Managers 1. Correlate Appendix J Objectives to Crisis Response Testing 2. Connect to your Industry s ISAC Connect to Your Industry ISAC (Point of Contact) Register on Threat & Alert Systems Join Working Groups 3. Engage in Sector and Cross-Sector Exercises 9
10 Connect to Your Industry ISAC (Point of Contact) FS-ISAC Mission The FS-ISAC: Financial Services Like a Information Neighborhood Sharing and Watch Analysis Center (FS-ISAC) is a non-profit corporation that was established in 1999 and is funded by its member firms. The FS-ISAC is a member-driven organization whose mission is to help assure the resilience and continuity of the global financial services infrastructure. FS-ISAC helps members defend against acts that could significantly impact the sector s ability to provide services critical to the orderly function of the global economy. The FS-ISAC is not a service provider, it s a community Like neighborhood watch for cyber and physical hazards. A Longtime Member 10
11 Sharing Across Critical Infrastructure Sectors Connect to Your Industry ISAC (Point of Contact) Members Worldwide And growing weekly International Members 50% Are top tier international FIs Countries Represented 38 On the ground staff in 7 11
12 PRIVATE SOURCES CROSS SECTOR SOURCES GOVERNMENT SOURCES FS-ISAC Intelligence Flow Register on Threat & Alert Systems Information Sources CERTs FS Regulators FS-ISAC 24x7 Security Operations Center Member Communications Information Security Law Enforcement Other Intel Agencies isight Partners Info Sec Physical Security Business Continuity/ Disaster Response 12 Secunia Vulnerabilities Wapack Labs Malware Forensics NC4 Phy Sec Incidents MSA Phy Sec Analysis Cross Sector (other ISACS) Open Sources (Hundreds) Alerts Member Submissions Fraud Investigation s Payments/ Risk
13 Understanding FS-ISAC s and Alerts Register on Threat & Alert Systems Alert Types Step 1: Understand the Alert Type ANC: Announcements CYT: Cyber Threat CYI: Cyber Incidents COI: Collective Intelligence CYV: Cyber Vulnerability PHT: Physical Threats PHI: Physical Incidents Depending on your role, you don t have to follow every update, but FS-ISAC recommends following these key reports. Doing so will limit s to about 10/day Step 2: Understand the Criticality and Priority ANC = Priority 1-10, 8-10 is high priority CYV = Risk 1-10, 8-9 is Urgent, 10 is Crisis CYT = Risk 1-10, 8-9 is Urgent, 10 is Crisis COI No Criticality Metric PHT = Risk is Urgent, 10 is Crisis Step 3: Make Choices Based on Role Analysts and those involved in risk assessment or vulnerability/patch management should receive CYV alerts. Intelligence analysts may also want to participate on the Cyber Intel listserv. POCs are automatically added, but a portal account is not necessary if you wish to add additional analysts to the distribution Provide portal accounts to your staff based on each individual s role. This will allow them to employ portal filtering for their unique assignments We provide summary reports for mangers and technical reports for analysts. Making informed choices based on your role eliminates unneeded s 13
14 Types of Information Shared Register on Threat & Alert Systems Cyber Threats, Incidents, Vulnerabilities Physical Threats, Incidents Malicious Sites Threat Actors, Objectives Threat Indicators Tactics, Techniques, Procedures Courses of Action Exploit Targets Denial of Service Attacks Malicious s: Phishing/Spearphishing Software Vulnerabilities Malicious Software Analysis and risk mitigation Incident response Terrorism Active Shooter Hurricanes Earthquakes Other meteorological events Geopolitical impacts Pandemic Type, location, severity Impact analysis and risk mitigation Business resilience preparation and incident response 14
15 Circles of Trust Join Working Groups IRC Asset Mgr. CHEF PRC CYBER INTEL FS- ISAC PPISC TIC BRC CIC Broker Dealer CAC Clearing House and Exchange Forum (CHEF) Payments Risk Council (PRC) Payments Processor Information Sharing Council (PPISC) Business Resilience Committee (BRC) Threat Intelligence Committee (TIC) Community Institution Council (CIC) Insurance Risk Council (IRC) Compliance and Audit Council (CAC) Cyber Intelligence Listserv Asset Manager Council Broker-Dealer Council Member Reports Incident to Cyber Intel list, or via anonymous submission through portal Members respond in real time with initial analysis and recommendations SOC completes analysis, anonymizes the source, and generates alert to general membership 15
16 FS Crisis Information Sharing Notional Model Join Working Groups Central resource for trusted crisis information sharing Facilitate private & government crisis support for financial sector SIFMA Market Response Committee Financial Services Firms Domestic & International FS-ISAC member and non-member organizations have direct lines of communication with trade groups government organizations and their regulators FSSCC SIFMA ABA The Clearing House FS Roundtable BITS FS-ISAC Coordinate Financial Sector Information Sharing & Crisis Communication International Partners CERTS, Finance Ministries, Law Enforcement... Independent Regulatory Agencies: OCC, FDIC, SEC... Federal Executive Branch Agencies White House U.S.Treasury Law Enforcement (FBI, USSS...) DHS Exercise to develop trusted peer relationships for crisis preparedness ChicagoFIRST North Carolina Financial Recovery Coalition RPCfirst New York/NJFIRST Southern California (SoCalFIRST) Bay Area (BARCfirst) Montgomery CountyFIRST (PA) 22 Regional Coalitions Develop Relationships with State, Local EMS on behalf of Coalition Members State OEM City/Local OEM Emergency Services National Council of ISACS Multi-State ISACs International ISACS Emerging Info Sharing Entities FBIIC Partnership for Critical Infrastructure Security (PCIS) State, Local, Tribal & Territorial Government Coordinating Council (SLTTGCC) NICC NCCIC Cyber UCG Infrastructure Protection Federal Senior Leadership Council 16
17 Action Items for BC Managers 1. Correlate Appendix J Objectives to Crisis Response Testing 2. Connect to your Industry s ISAC 3. Engage in Sector and Cross-Sector Exercises Identify Sector and Multi-Sector Exercises Include critical 3 rd party SME s and critical Business Leaders Identify critical decisions and gaps in decision leadership 17
18 Engage in Sector and Cross-Sector Exercises Identify Sector and Multi-Sector Exercises Include critical 3 rd party SME s and critical Business Leaders Identify critical decisions and gaps in decision leadership Examples: SIFMA Quantum Dawn I, II, III FSSCC Hamilton Series FS-ISAC CAPP Annual Exercise ACTION: Identify other exercises? 18
19 Engage in Sector and Cross-Sector Exercises Identify Sector and Multi-Sector Exercises Include critical 3 rd party SME s and critical Business Leaders Identify critical decisions and gaps in decision leadership Exercise Planning Include BIA results Demonstrate expanded planning Build into 3 rd Party contracts Engage business decision makers ACTION: Identify challenges? 19
20 Engage in Sector and Cross-Sector Exercises Identify Sector and Multi-Sector Exercises Include critical 3 rd party SME s and critical Business Leaders Identify critical decisions and gaps in decision leadership 20
21 Conclusions: Action Items for BC Managers 1. Connect to your Industry s ISAC Connect to Your Industry ISAC (Point of Contact) Register on Threat & Alert Systems Join Working Groups 2. Correlate Appendix J Objectives to Crisis Response Testing Prioritize Critical Third Party Risk Testing Due Diligence and Contract Review Testing Capacity and Cyber Resilience 3. Engage in Sector and Cross-Sector Exercises 21 Identify Sector and Multi-Sector Exercises Include critical 3 rd party SME s and critical Business Leaders Identify critical decisions and gaps in decision leadership
22 Questions / Discussion Resources 1. FFIEC BC Booklet 2. Federal Reserve SR 15-3, February 6, 2015, 3. FDIC Publication 4. DHS National Infrastructure Protection Plan (NIPP) 5. DHS Critical Infrastructure Sector Partnerships 22 Regional Business Continuity Conference
23 Contact Information Susan Rogers (MBCP, MBCI) Financial Services Information Sharing and Analysis Center FS-ISAC, Business Resiliency Director Regional Business Continuity Conference
Cybersecurity Awareness. Part 2
Part 2 Objectives Discuss the Evolution of Data Security Define and Discuss Cybersecurity Review Threat Environment Part 1 Discuss Information Security Programs s Enhancements for Cybersecurity Risks Threat
More informationFS-ISAC CHARLES BRETZ
FS-ISAC CHARLES BRETZ Information Sharing To be forewarned is to be fore-armed MISSION: Sharing Timely, Relevant, Actionable Cyber and Physical Security Information & Analysis A nonprofit private sector
More informationCybersecurity Awareness
Awareness Objectives Discuss the Evolution of Data Security Define Review Threat Environment Discuss Information Security Program Enhancements for Cyber Risk Threat Intelligence Third-Party Management
More informationCybersecurity Awareness
Awareness Objectives Discuss the Evolution of Data Security Define Review Threat Environment Discuss Information Security Program Enhancements for Cyber Risk Threat Intelligence Third-Party Management
More informationFIA Webinar Cybersecurity Threats: Preparation & Response June 29, 2015
FIA Webinar Cybersecurity Threats: Preparation & Response June 29, 2015 Moderator: Gregory Gist, Director, CBCP, Industry Relations, Office of Emergency Management, Citi Speakers: William Nelson, President
More informationCybersecurity Panel. ABA Mutual Community Bank Conference Marriott Marquis Hotel, Washington, D.C.
Cybersecurity Panel ABA Mutual Community Bank Conference Marriott Marquis Hotel, Washington, D.C. aba.com 1-800-BANKERS Your Panel Speakers: Bill Nelson, President and CEO, Financial Services Information
More informationAppendix J: Strengthening the Resilience of Outsourced Technology Services
Appendix J: Strengthening the Resilience of Outsourced Technology Services Background and Purpose Many financial institutions depend on third-party service providers to perform or support critical operations.
More informationTestimony of. Mr. Anish Bhimani. On behalf of the. Financial Services Information Sharing and Analysis Center (FS-ISAC) before the
Testimony of Mr. Anish Bhimani On behalf of the Financial Services Information Sharing and Analysis Center (FS-ISAC) before the Committee on Homeland Security United States House of Representatives DHS
More informationBy: Tracy Hall. Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level. June 9, 2015
Community Bank Auditors Group Taking Your Business Continuity Plan To The Next Level June 9, 2015 By: Tracy Hall MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company,
More information2015 CEO & Board University Taking Your Business Continuity Plan To The Next Level. Tracy L. Hall, MBCP
2015 CEO & Board University Taking Your Business Continuity Plan To The Next Level Tracy L. Hall, MBCP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C.
More informationFINANCIAL SERVICES INFORMATION SHARING & ANALYSIS CENTER (FS-ISAC) OPERATING RULES
FINANCIAL SERVICES INFORMATION SHARING & ANALYSIS CENTER (FS-ISAC) OPERATING RULES Copyright FS-ISAC, Inc. All Rights Reserved FS-ISAC White December, 2012 Contents 1.0 FS-ISAC History and Background...
More informationFinancial Services. Information Sharing & Analysis Center FS ISAC
Financial Services Information Sharing & Analysis Center FS ISAC Operating Rules August, 2015 Contents Financial Services... 1 Information Sharing & Analysis Center... 1 FS ISAC... 1 Operating Rules...
More informationWhat is Management Responsible For?
What is Management Responsible For? Matthew J. Putvinski, CPA, CISA, CISSP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2011 Wolf & Company, P.C. About Wolf & Company, P.C Regional
More informationStanding together for financial industry cyber resilience Quantum Dawn 3 after-action report. November 23, 2015
Standing together for financial industry cyber resilience Quantum Dawn 3 after-action report November 23, 2015 Table of contents Background Exercise objectives Quantum Dawn 3 (QD3) cyberattack scenario
More informationBy: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
More informationTestimony of. Michele B. Cantley. Chief Information Security Officer. Regions Bank. On Behalf of the
Testimony of Michele B. Cantley Chief Information Security Officer Regions Bank On Behalf of the The Financial Services Information Sharing & Analysis Center Before the United States House of Representatives
More informationTestimony of. Doug Johnson. New York Bankers Association. New York State Senate Joint Public Hearing:
Testimony of Doug Johnson On behalf of the New York Bankers Association before the New York State Senate Joint Public Hearing: Cybersecurity: Defending New York from Cyber Attacks November 18, 2013 Testimony
More informationNIST Cybersecurity Framework & A Tale of Two Criticalities
NIST Cybersecurity Framework & A Tale of Two Criticalities Vendor Management & Incident Response Presented by: John H Rogers, CISSP Advisory Services Practice Manager john.rogers@sagedatasecurity.com Presented
More informationOutsourced Third Party Relationship Management/ Vendor Management. TTS Webinar July 15, 2015 Susan Orr CISA, CISM, CRISC, CRP
Outsourced Third Party Relationship Management/ Vendor Management TTS Webinar July 15, 2015 Susan Orr CISA, CISM, CRISC, CRP 1 Risk Management Guidance 2 3 Appendix J: 4 - Key Elements Third Party Management
More informationIntegrating Cybersecurity with Emergency Operations Plans (EOPs) for Institutions of Higher Education (IHEs)
Integrating Cybersecurity with Emergency Operations Plans (EOPs) for Institutions of Higher Education (IHEs) Amy Banks, U.S. Department of Education, Center for School Preparedness, Office of Safe and
More informationCybersecurity. Regional and Community Banks. Inherent Risks and Preparedness. www.bostonfed.org
Cybersecurity Inherent Risks and Preparedness Regional and Community Banks www.bostonfed.org Disclaimer The opinions expressed in this presentation are intended for informational purposes, and are not
More informationIntegrating Cybersecurity with Emergency Operations Plans (EOPs) for K-12 Education
Integrating Cybersecurity with Emergency Operations Plans (EOPs) for K-12 Education Amy Banks, U.S. Department of Education, Center for School Preparedness, Office of Safe and Healthy Students Hamed Negron-Perez,
More informationTestimony of John W. Carlson on behalf of the. The Financial Services Information Sharing & Analysis Center (FS-ISAC)
Testimony of John W. Carlson on behalf of the The Financial Services Information Sharing & Analysis Center (FS-ISAC) Before the U.S. House of Representatives Committee on Financial Services June 24, 2015
More informationFFIEC Cybersecurity Assessment Tool
Overview In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed the Cybersecurity Tool (), on behalf of its members,
More informationBanking and Finance Critical Infrastructure and Key Resources Sector-Specific Plan as input to the National Infrastructure Protection Plan
Banking and Finance Critical Infrastructure and Key Resources Sector-Specific Plan as input to the National Infrastructure Protection Plan May 2007 Banking and Finance Government Coordinating Council
More informationTHE EVOLUTION OF CYBERSECURITY
THE EVOLUTION OF CYBERSECURITY Identifying Best Practices June 2, 2015 Cerone F. Cy Sturdivant Managing Consultant Nashville, TN 1 TO RECEIVE CPE CREDIT Participate in entire webinar Answer polls when
More informationApril 10, 2009. Ms. Melissa Hathaway Acting Senior Director for Cyberspace National Security and Homeland Security Councils. Dear Ms.
William B. Nelson President & CEO FS-ISAC 20496 Partridge Place Leesburg, VA 20175 703-777-2803 (Direct) 509-278-2412 (Fax) bnelson@fsisac.us www.fsisac.com April 10, 2009 Ms. Melissa Hathaway Acting Senior
More informationQuantum Dawn 2 A simulation to exercise cyber resilience and crisis management capabilities. October 21, 2013
Quantum Dawn 2 A simulation to exercise cyber resilience and crisis management capabilities October 21, 2013 Table of contents Background 2 Exercise objectives 3 QD2 cyber-attack scenario 4 QD2 yielded
More informationThe PNC Financial Services Group, Inc. Business Continuity Program
The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page
More information2015 CEO & Board University Cybersecurity on the Rise. Matthew J. Putvinski, CPA, CISA, CISSP
2015 CEO & Board University Cybersecurity on the Rise Matthew J. Putvinski, CPA, CISA, CISSP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2011 Wolf & Company, P.C. About Wolf
More informationBusiness Continuity for Cyber Threat
Business Continuity for Cyber Threat April 1, 2014 Workshop Session #3 3:00 5:30 PM Susan Rogers, MBCP, MBCI Cyberwise CP S2 What happens when a computer program can activate physical machinery? Between
More informationReport on CAP Cybersecurity November 5, 2015
Agenda Number 7. Report on CAP Cybersecurity November 5, 2015 Phil Cook CISSP, CISM Manager, Information Technologies Risk #1 External Attacks PR 81 Protect and secure CAP's Information Technology assets
More informationEd McMurray, CISA, CISSP, CTGA CoNetrix
Ed McMurray, CISA, CISSP, CTGA CoNetrix AGENDA Introduction Cybersecurity Recent News Regulatory Statements NIST Cybersecurity Framework FFIEC Cybersecurity Assessment Questions Information Security Stats
More informationNational Cybersecurity & Communications Integration Center (NCCIC)
National Cybersecurity & Communications Integration Center (NCCIC) FOR OFFICIAL USE ONLY NCCIC Overview NCCIC Overview The National Cybersecurity and Communications Integration Center (NCCIC), a division
More informationFederal Financial Institutions Examination Council FFIEC. Business Continuity Planning BCP MARCH 2003 MARCH 2008 IT EXAMINATION
Federal Financial Institutions Examination Council FFIEC Business Continuity Planning MARCH 2003 MARCH 2008 BCP IT EXAMINATION H ANDBOOK TABLE OF CONTENTS INTRODUCTION... 1 BOARD AND SENIOR MANAGEMENT
More informationFederal Financial Institutions Examination Council FFIEC BCP. Business Continuity Planning FEBRUARY 2015 IT EXAMINATION H ANDBOOK
Federal Financial Institutions Examination Council FFIEC Business Continuity Planning BCP FEBRUARY 2015 IT EXAMINATION H ANDBOOK Table of Contents Introduction 1 Board and Senior Management Responsibilities
More informationICBA Summary of FFIEC Cybersecurity Assessment Tool
ICBA Summary of FFIEC Cybersecurity Assessment Tool July 2015 Contact: Jeremy Dalpiaz Assistant Vice President Cyber Security and Data Security Policy Jeremy.Dalpiaz@icba.org www.icba.org ICBA Summary
More informationCybercrime and Regulatory Priorities for Cybersecurity
NRS Technology and Communication Compliance Forum Cybercrime and Regulatory Priorities for Cybersecurity Copyright 2014 by K&L Gates LLP. All rights reserved. Sean P. Mahoney sean.mahoney@klgates.com K&L
More informationWater Security in New Jersey: Partnership and Services
GOV. CHRIS CHRISTIE LT. GOV. KIM GUADAGNO DIR. CHRIS RODRIGUEZ NJOHSP OFFICE OF HOMELAND SECURITY AND PREPAREDNESS Preparedness Act Water Security in New Jersey: Partnership and Services Created by the
More informationVendor Management. Outsourcing Technology Services
Vendor Management Outsourcing Technology Services Objectives Board and Senior Management Responsibilities Risk Management Program Risk Assessment Service Provider Selection Contracts Ongoing Monitoring
More informationWho s Regulating Whom & What are the Requirements: Banks As Payment Services Providers
Who s Regulating Whom & What are the Requirements: Banks As Payment Services Providers Tony DaSilva, AAP, CISA S&R Senior Technical Expert Federal Reserve Bank of Atlanta Disclaimer The opinions expressed
More informationOverview. Emergency Response. Crisis Management
Prudential Financial s Preparedness Strategy Overview Emergency Response, Crisis Management, Business Continuation, Technology Disaster Recovery & Health Crisis Preparedness Prudential is committed to
More informationLessons from Defending Cyberspace
Lessons from Defending Cyberspace The Challenge of Addressing National Cyber Risk Andy Purdy Workshop on Cyber Security Center for American Studies, Christopher Newport College 10 28-2009 Cyber Threat
More informationFFIEC Cybersecurity Assessment Tool Overview for Chief Executive Officers and Boards of Directors
Overview for Chief Executive Officers and Boards of Directors In light of the increasing volume and sophistication of cyber threats, the Federal Financial Institutions Examination Council 1 (FFIEC) developed
More informationThe Aviation Information Sharing and Analysis Center (A-ISAC)
The Aviation Information Sharing and Analysis Center (A-ISAC) Faye Francy Aviation ISAC March 2015 The Threat A National Security Issue Rapidly escalating cyber threats Executive action Executive Order
More informationWater Critical Infrastructure and Key Resources Sector-Specific Plan as input to the National Infrastructure Protection Plan Executive Summary
Water Critical Infrastructure and Key Resources Sector-Specific Plan as input to the National Infrastructure Protection Plan Executive Summary May 2007 Environmental Protection Agency Executive Summary
More informationJOB ANNOUNCEMENT. Chief Security Officer, Cheniere Energy, Inc.
JOB ANNOUNCEMENT Chief Security Officer, Cheniere Energy, Inc. Position Overview The Vice President and Chief Security Risk Officer (CSRO) reports to the Chairman, Chief Executive Officer and President
More informationBusiness Continuity at CME Group
1 Business Continuity at CME Group CME Group is proud of its solid Business Continuity Management program, which is central to helping mitigate potential impacts to our markets and customers. It defines
More informationCYBERSECURITY: PROTECTING YOUR ORGANIZATION AGAINST CYBER ATTACKS. Viviana Campanaro CISSP Director, Security and Compliance July 14, 2015
CYBERSECURITY: PROTECTING YOUR ORGANIZATION AGAINST CYBER ATTACKS Viviana Campanaro CISSP Director, Security and Compliance July 14, 2015 TODAY S PRESENTER Viviana Campanaro, CISSP Director, Security and
More informationInformation Technology
Information Technology Information Technology Session Structure Board of director actions Significant and emerging IT risks Practical questions Resources Compensating Controls at the Directorate Level
More informationCYBERSECURITY EXAMINATION SWEEP SUMMARY
This Risk Alert provides summary observations from OCIE s examinations of registered broker-dealers and investment advisers, conducted under the Cybersecurity Examination Initiative, announced April 15,
More informationManaging Cyber Attacks
Managing Cyber Attacks Regulators and Industry Participants Discuss Ways to Strengthen Defenses By Joanne Morrison June 25, 2015 Cybersecurity risks and testing are a major concern of regulators and market
More informationCYBER SECURITY GUIDANCE
CYBER SECURITY GUIDANCE With the pervasiveness of information technology (IT) and cyber networks systems in nearly every aspect of society, effectively securing the Nation s critical infrastructure requires
More informationPROPOSED INTERPRETIVE NOTICE
August 28, 2015 Via Federal Express Mr. Christopher J. Kirkpatrick Secretary Office of the Secretariat Commodity Futures Trading Commission Three Lafayette Centre 1155 21st Street, N.W. Washington, DC
More informationClick to edit Master title style
EVOLUTION OF CYBERSECURITY Click to edit Master title style IDENTIFYING BEST PRACTICES PHILIP DIEKHOFF, IT RISK SERVICES TECHNOLOGY THE DARK SIDE AGENDA Defining cybersecurity Assessing your cybersecurity
More informationAssessing Your Disaster. Andrews Hooper Pavlik PLC. Andrews Hooper Pavlik PLC
Assessing Your Disaster Recovery Plans Gregory H. Soule, CPA, CISA, CISSP, CFE Andrews Hooper Pavlik PLC Andrews Hooper Pavlik PLC Agenda Business Continuity Concepts Impact Analysis Risk Assessment Risk
More information1. Sector Profile and Goals
1. Sector Profile and Goals The Banking and Finance sector infrastructure is a vital component of our critical national infrastructure. Descriptions of the sector s profile and goals necessarily include
More informationEl Camino College Homeland Security Spring 2016 Courses
El Camino College Homeland Security Spring 2016 Courses With over 250,000 federal positions in Homeland Security and associated divisions, students may find good career opportunities in this field. Explore
More informationWASHINGTON MILITARY DEPARTMENT. Washington State. Significant Cyber Incident Annex
WASHINGTON MILITARY DEPARTMENT Washington State Significant Cyber Incident Annex To the Washington State Comprehensive Emergency Management Plan Annex D March 2015 Table of Contents INTRODUCTION... 4 PURPOSE...
More informationCybersecurity: What CFO s Need to Know
Cybersecurity: What CFO s Need to Know William J. Nowik, CISA, CISSP, QSA PCIP MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2014 Wolf & Company, P.C. Today s Agenda Introduction
More informationBusiness Continuity Plan
Business Continuity Plan October 2007 Agenda Business continuity plan definition Evolution of the business continuity plan Business continuity plan life cycle FFIEC & Business continuity plan Questions
More informationREGULATORY EXPECTATIONS. Linda B. Charity Director Division of Financial Institutions Office of Financial Regulation
Linda B. Charity Director Division of Financial Institutions Office of Financial Regulation Y2K, September 11, 2001, and Hurricane Katrina were significant wake-up calls for developing and implementing
More informationClient Update NFA Adopts Interpretive Notice Regarding Information Systems Security Programs
1 Client Update NFA Adopts Interpretive Notice Regarding Information Systems Security Programs NEW YORK Byungkwon Lim blim@debevoise.com Gary E. Murphy gemurphy@debevoise.com Michael J. Decker mdecker@debevoise.com
More informationThe PNC Financial Services Group, Inc. Business Continuity Program
The PNC Financial Services Group, Inc. Business Continuity Program subsidiaries) 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis
More informationIdentifying and Managing Third Party Data Security Risk
Identifying and Managing Third Party Data Security Risk Legal Counsel to the Financial Services Industry Digital Commerce & Payments Series Webinar April 29, 2015 1 Introduction & Overview Today s discussion:
More informationWhite Paper. Lifecycle Disaster Recovery Costs
White Paper Lifecycle Disaster Recovery Costs Lifecycle Disaster Recovery Costs Do you really understand the costs to a financial institution for IT Disaster Recovery? Most professionals working in a
More informationThe Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant
THE MARKET LEADER IN IT, SECURITY AND COMPLIANCE SERVICES FOR COMMUNITY FINANCIAL INSTITUTIONS The Emergence of the ISO in Community Banking Patrick H. Whelan CISA IT Security & Compliance Consultant Agenda
More informationU.S. Cyber Security Readiness
U.S. Cyber Security Readiness Anthony V. Teelucksingh Senior Counsel United States Department of Justice John Chris Dowd Special Agent Federal Bureau of Investigation Overview U.S. National Plan National
More informationThe FDIC s Supervisory Approach to Cyberattack Risks
Why We Did The Evaluation Executive Summary Information is one of a financial institution s (FI) most important assets. Protection of information is critical to establishing and maintaining trust between
More informationWhite Paper on Financial Industry Regulatory Climate
White Paper on Financial Industry Regulatory Climate According to a 2014 report on threats to the financial services sector, 45% of financial services organizations polled had suffered economic crime during
More informationwww.pwc.com Business Resiliency Business Continuity Management - January 14, 2014
www.pwc.com Business Resiliency Business Continuity Management - January 14, 2014 Agenda Key Definitions Risks Business Continuity Management Program BCM Capability Assessment Process BCM Value Proposition
More informationGet the most out of Public Sector Cyber Security Associations & Collaboration
Get the most out of Public Sector Cyber Security Associations & Collaboration Gary Coverdale Chief Information Security Officer County of Napa, CA Stacey A. Wright Intel Manager MS-ISAC Get the most out
More informationTESTIMONY OF GREG GARCIA. PARTNERSHIP EXECUTIVE for CYBERSECURITY AND IDENTITY MANAGEMENT BANK OF AMERICA. Before the HOUSE FINANCIAL SERVICES
TESTIMONY OF GREG GARCIA PARTNERSHIP EXECUTIVE for CYBERSECURITY AND IDENTITY MANAGEMENT BANK OF AMERICA Before the HOUSE FINANCIAL SERVICES FINANCIAL INSTITUTIONS AND CONSUMER CREDIT SUBCOMMITTEE WASHINGTON,
More informationINFRAGARD.ORG. Portland FBI. Unclassified 1
INFRAGARD.ORG Portland FBI 1 INFRAGARD Thousands of Members One Mission Securing Infrastructure The subject matter experts include: 2 INFRAGARD Provides a trusted environment for the exchange of Intelligence
More informationWhy Should Companies Take a Closer Look at Business Continuity Planning?
whitepaper Why Should Companies Take a Closer Look at Business Continuity Planning? How Datalink s business continuity and disaster recovery solutions can help organizations lessen the impact of disasters
More informationTESTIMONY OF VALERIE ABEND SENIOR CRITICAL INFRASTRUCTURE OFFICER OFFICE OF THE COMPTROLLER OF THE CURRENCY. Before the
For Release Upon Delivery 10:00 a.m., December 10, 2014 TESTIMONY OF VALERIE ABEND SENIOR CRITICAL INFRASTRUCTURE OFFICER OFFICE OF THE COMPTROLLER OF THE CURRENCY Before the COMMITTEE ON BANKING, HOUSING,
More information7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008
U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October
More informationPreventing and Defending Against Cyber Attacks November 2010
Preventing and Defending Against Cyber Attacks November 2010 The Nation s first ever Quadrennial Homeland Security Review (QHSR), delivered to Congress in February 2010, identified safeguarding and securing
More informationCybersecurity and Technology Update. Paul Rainbow, Information Security Supervisor, Umpqua Bank Francis Tam, Partner, Moss Adams LLP
Cybersecurity and Technology Update Paul Rainbow, Information Security Supervisor, Umpqua Bank Francis Tam, Partner, Moss Adams LLP Agenda Cybersecurity Governance Threat Intelligence/Monitoring Vendor
More informationSHARED ASSESSMENTS PROGRAM STANDARD INFORMATION GATHERING (SIG) QUESTIONNAIRE 2014 MAPPING TO OCC GUIDANCE (2013-29) ON THIRD PARTY RELATIONSHIPS
SHARED ASSESSMENTS PROGRAM STANDARD INFORMATION GATHERING (SIG) QUESTIONNAIRE 2014 MAPPING TO OCC GUIDANCE (2013-29) ON THIRD PARTY RELATIONSHIPS An overview of how the Shared Assessments Program SIG 2014
More informationStatement for the Record. Dr. Andy Ozment Assistant Secretary, Cybersecurity and Communications U.S. Department of Homeland Security
Statement for the Record Dr. Andy Ozment Assistant Secretary, Cybersecurity and Communications U.S. Department of Homeland Security Before the United States House of Representatives Committee on Homeland
More informationTestimony of. Edward L. Yingling. On Behalf of the AMERICAN BANKERS ASSOCIATION. Before the. Subcommittee on Oversight and Investigations.
Testimony of Edward L. Yingling On Behalf of the AMERICAN BANKERS ASSOCIATION Before the Subcommittee on Oversight and Investigations Of the Committee on Financial Services United States House of Representatives
More informationPAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA
1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand
More informationEnterprise Security Tactical Plan
Enterprise Security Tactical Plan Fiscal Years 2011 2012 (July 1, 2010 to June 30, 2012) Prepared By: State Chief Information Security Officer The Information Security Council State of Minnesota Enterprise
More informationCYBER SECURITY INFORMATION SHARING & COLLABORATION
Corporate Information Security CYBER SECURITY INFORMATION SHARING & COLLABORATION David N. Saul Senior Vice President & Chief Scientist 28 June 2013 Discussion Flow The Evolving Threat Environment Drivers
More informationBusiness Continuity Planning Preparing Your Organization
Business Continuity Planning Preparing Your Organization Nicholas De Laurentis, CRM, IGP nick.delaurentis.gmkj@statefarm.com 1 Objectives Understand the importance of Business Continuity Planning Know
More informationWhite Paper on Financial Institution Vendor Management
White Paper on Financial Institution Vendor Management Virtually every organization in the modern economy relies to some extent on third-party vendors that facilitate business operations in a wide variety
More informationOCIE CYBERSECURITY INITIATIVE
Topic: Cybersecurity Examinations Key Takeaways: OCIE will be conducting examinations of more than 50 registered brokerdealers and registered investment advisers, focusing on areas related to cybersecurity.
More informationState Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4
State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes
More informationPandemic Planning. Presented by: Ron Wagner, IT Examiner with FDIC & Dana Lavey, Supervision Analyst with NCUA
Pandemic Planning Presented by: Ron Wagner, IT Examiner with FDIC & Dana Lavey, Supervision Analyst with NCUA Regulator Expectations FDIC and NCUA have similar expectations for pandemic planning Pandemic
More informationCYBERSECURITY BEST PRACTICES FOR SMALL AND MEDIUM PENNSYLVANIA UTILITIES. second edition
CYBERSECURITY BEST PRACTICES FOR SMALL AND MEDIUM PENNSYLVANIA UTILITIES second edition The information provided in this document is presented as a courtesy to be used for informational purposes only.
More informationInto the cybersecurity breach
Into the cybersecurity breach Tim Sanouvong State Sector Cyber Risk Services Deloitte & Touche LLP April 3, 2015 Agenda Setting the stage Cyber risks in state governments Cyber attack vectors Preparing
More informationAbove My Pay Grade: Incident Response at the National Level
Above My Pay Grade: Incident Response at the National Level Jason Healey Atlantic Council Traditional Incident Response But at the national level, incident response is a different game Implications for
More informationInteragency Statement on Pandemic Planning
Interagency Statement on Pandemic Planning PURPOSE The FFIEC agencies 1 are jointly issuing guidance to remind financial institutions that business continuity plans should address the threat of a pandemic
More informationBanking and Finance Sector-Specific Plan An Annex to the National Infrastructure Protection Plan
Banking and Finance Sector-Specific Plan An Annex to the National Infrastructure Protection Plan 2010 U.S. Department of the Treasury Preface November 5, 2012 We are writing to transmit the Banking and
More informationData Breach Response Planning: Laying the Right Foundation
Data Breach Response Planning: Laying the Right Foundation September 16, 2015 Presented by Paige M. Boshell and Amy S. Leopard babc.com ALABAMA I DISTRICT OF COLUMBIA I FLORIDA I MISSISSIPPI I NORTH CAROLINA
More informationSupplemental Tool: Executing A Critical Infrastructure Risk Management Approach
Supplemental Tool: Executing A Critical Infrastructure Risk Management Approach Executing a Critical Infrastructure Risk Management Approach Risk is defined as the potential for an unwanted outcome resulting
More information