The Treasury Department’s Cybersecurity Checklist

Boiling down what really matters concerning cybersecurity is a tough but worthy exercise. During recent remarks, Deputy Treasury Secretary Sarah Bloom Raskin offered a checklist of what the Treasury Department thinks are the essential elements of cybersecurity. Here we examine how your bank can answer her challenge.

MAKE CYBER RISK PART OF YOUR BANK’S CURRENT RISK MANAGEMENT FRAMEWORK

Tailor your framework to the size and business operations of your bank
Identify the cyber threats presented by your particular activities and operations and match those threats to the appropriate technology solutions.
Adopt policies, procedures and other controls to address identified cyber threats that their technology solutions cannot control and to reasonably anticipate possible breakdowns and overrides of that technology.
Employ highly qualified people to monitor and continually reassess the effectiveness of the deployed technology and controls, including those technologies or controls that are not directly operated by the institution.

USE THE NIST CYBERSECURITY FRAMEWORK

Identify your bank’s cyber posture and determine its risk profile and tolerance.
Develop organizational communication plans for responding to attacks.
Establish a common language and set of practices, standards and guidelines.
Apply your established risk-management approaches when the risks and associated controls are cyber-related.
Evaluate vendors and other third parties with access to your networks, systems and data.

UNDERSTAND THE SECURITY SAFEGUARDS THAT YOUR THIRD PARTIES HAVE IN PLACE

Know all vendors and third parties with access to your systems and data.
Ensure that those third parties have appropriate protections to safeguard your systems and data.
Conduct ongoing monitoring to ensure adherence to protections.
Document protections and related obligations in your contracts.

EVALUATE YOUR NEED FOR CYBER RISK INSURANCE

Know what it covers and excludes.
Know if it is adequate based on your risk exposure.
Leverage the qualification process to help assess your bank’s risk level.

ENGAGE IN BASIC CYBER HYGIENE

Know all the devices connected to your networks.
Reduce that number to only those who need those privileges.
Know who has administrative permissions to change, bypass and override system configurations.
Patch software on a timely basis.
Conduct continuous, automated vulnerability assessments.

SHARE INCIDENT DATA WITH INDUSTRY GROUPS

Join the Financial Services Information Sharing and Analysis Center.

HAVE AN INCIDENT PLAYBOOK AND A POINT PERSON FOR RESPONSE AND RECOVERY

Have a detailed, documented plan that designates who is responsible for leading the response-and-recovery efforts.
Chose a lead with exceptional organizational and communication skills because he or she will quarterback internal and external interactions.

DESIGNATE SENIOR LEADER AND THE BOARD ROLES DURING A CYBER INCIDENT RESPONSE

Designate when and which matters get escalated to the CEO.
Designate whether the full board or a committee—like risk or audit—is initially tasked to oversee the response from a governance perspective.
Participate in cyber exercises that simulate
a cyber intrusion. Include the CEO, directors and other key players.