FFIEC IT Examination Handbook Information Security

Appendix A: Examination Procedures

Examination Objective
Determine the quality and effectiveness of the institution’s information security. Examiners
should use these procedures to measure the adequacy of the institution's culture, governance,
information security program, security operations, and assurance processes. In addition, controls
should be evaluated as additional evidence of program quality and effectiveness. Controls also
should be evaluated for conformance with contracts, indicators of legal liability, and
conformance with regulatory policy and guidance. Failure of management to implement
appropriate controls may expose the institution to potential loss from fines, penalties, and
customer litigation.

These examination procedures (commonly referred to as the work program) are intended to help
examiners determine the effectiveness of the institution’s information security process.
Examiners may choose, however, to use only particular components of the work program based
on the size, complexity, and nature of the institution’s business. Examiners should also use these
procedures to measure the adequacy of the institution’s cybersecurity risk management
processes.
Work
Examiner Comments
Paper Ref

Objective 1: Determine the appropriate scope and objectives for the examination.

1. Review past reports for outstanding issues or previous

problems. Consider the following:
a. Regulatory reports of examination.
b. Internal and external audit reports.
c. Independent security tests.
d. Regulatory and audit reports on service providers.

2. Review management’s response to issues raised at, or

since, the last examination. Consider the following:
a. Adequacy and timing of corrective action.
b. Resolution of root causes rather than just specific
issues.
c. Existence of any outstanding issues.

3. Interview management and review responses to pre-

examination information requests to identify changes to
the technology infrastructure or new products and
services that might increase the institution’s risk.
Consider the following:
a. Products or services delivered to either internal or
external users.
b. Network topology or diagram including changes to
configuration or components and all internal and
external connections.
c. Hardware and software inventories.
d. Loss, addition, or change in duties of key personnel.

September 2016 1
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
e. Technology service providers and software vendor
listings.
f. Communication lines with other business units (e.g.,
loan review, credit risk management, line of business
quality assurance, and internal audit).
g. Credit or operating losses primarily attributable (or
thought to be attributable) to IT (e.g., system
problems, fraud occurring due to poor controls, and
improperly implemented changes to systems).
h. Changes to internal business processes.
i. Internal reorganizations.

4. Determine the complexity of the institution’s information

security environment.
a. Determine the degree of reliance on service
providers for information processing and technology
support, including security operation management.
b. Identify unique products and services and any
required third-party access requirements.
c. Determine the extent of network connectivity
internally and externally and the boundaries and
functions of security domains.
d. Identify the systems that have recently undergone
significant change, such as new hardware, software,
configuration, and connectivity. Correlate the
changed systems with the business processes they
support, the extent of customer data available to
those processes, and the effect of those changes on
institution operations.

Objective 2: Determine whether management promotes effective governance of the information

security program through a strong information security culture, defined information security
responsibilities and accountability, and adequate resources to support the program.

1. Determine whether the institution has a culture that

contributes to the effectiveness of the information
security program.
a. Determine whether the institution's board and
management understand and support information
security and provide appropriate resources for the
implementation of an effective security program.
b. Determine whether the information security program
is integrated with the institution's lines of business,
support functions, and management of third parties.
c. Review for indicators of an effective information
security culture (e.g., method of introducing new
business initiatives and manner in which the
institution holds lines of business and employees
accountable for promoting information security).

2. Determine whether the board, or a committee of the

board, is responsible for overseeing the development,

September 2016 2
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
implementation, and maintenance of the institution’s
information security program.

3. Determine whether the board holds management

accountable for the following:
a. Central oversight and coordination.
b. Assignment of responsibility.
c. Support of the information security program.
d. Effectiveness of the information security program.

4. Determine whether the board approves a written

information security program and receives a report on the
effectiveness of the information security program at least
annually. Determine whether the report to the board
describes the overall status of the information security
program and discusses material matters related to the
program such as the following:
a. Risk assessment process, including threat
identification and assessment.
b. Risk management and control decisions.
c. Service provider arrangements.
d. Results of security operations activities and
summaries of assurance reports.
e. Security breaches or violations and management's
responses.
f. Recommendations for changes or updates to the
information security program.

5. Determine whether management responsibilities are

appropriate and include the following:
a. Implementation of the information security program
by clearly communicating responsibilities and
holding appropriate individuals accountable for
carrying out these responsibilities.
b. Establishment of appropriate policies, standards, and
procedures to support the information security
program.
c. Participation in assessing the effect of security
threats or incidents on the institution and its business
lines and processes.
d. Delineation of clear lines of responsibility and
communication of accountability for information
security.
e. Adherence to risk thresholds established by the
board relating to information security threats or
incidents, including those relating to cybersecurity.
f. Oversight of risk mitigation activities that support
the information security program.
g. Establishment of appropriate segregation of duties.
h. Coordination of both information and physical
security.
i. Integration of security controls throughout the
institution.

September 2016 3
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
j. Protection of data consistently throughout the
institution.
k. Definition of the information security
responsibilities of third parties.
l. Facilitation of annual information security and
awareness training and ongoing security-related
communications to employees.

6. Determine whether management has designated one or

more individuals as an information security officer and
determine appropriateness of the reporting line.

7. Determine whether security officers and employees

know, understand, and are accountable for fulfilling their
security responsibilities.

8. Determine the adequacy of audit coverage and reporting

of the information security program by reviewing
appropriate audit reports and board or audit committee
minutes. (For further questions, refer to the IT
Handbook’s “Audit” booklet examination procedures.) 1

9. Review the roles and responsibilities of all levels of

management, including executive management, CIO or
CTO, CISO, IT line management, and IT business unit
management, to ensure that there is a clear delineation
between management and oversight functions and
operational duties.

10. Determine whether the board provides adequate funding

to develop and implement a successful information
security function. Review whether the institution has the
following:
a. Appropriate staff with the necessary skills to meet
the institution's technical and managerial needs.
b. Personnel with knowledge of technology standards,
practices, and risk methodologies.
c. Training to prepare staff for their short- and long-
term security responsibilities.
d. Oversight of third parties when they supplement an
institution's technical and managerial capabilities.

11. Determine whether management has adequately

incorporated information security into its overall ITRM
process. (For further questions, refer to the IT
Handbook's "Management" booklet examination
procedures.)2

1 See the IT Handbook’s “Audit” booklet examination procedures.

2 See the IT Handbook’s “Management” booklet examination procedures.

September 2016 4
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref

Objective 3: Determine whether management of the information security program is appropriate

and supports the institution's ITRM process, integrates with lines of business and support functions,
and integrates third-party service provider activities with the information security program.

1. Determine whether the institution has an effective

information security program that supports the ITRM
process. Review whether the program includes the
following:
a. Identification of threats and risks.
b. Measurement of risks.
c. Implementation of risk mitigation.
d. Monitoring and reporting of risks.
e. Methods to assess the program's effectiveness.

2. Determine whether management appropriately integrates

the information security program across the institution's
lines of business and support functions. Review whether
management has the following:
a. Security policies, standards, and procedures that are
designed to support and to align with the policies in
the lines of business.
b. Incident response programs that include all affected
lines of business and support units.
c. Common awareness and enforcement mechanisms
between lines of business and information security.
d. Visibility to assess the likelihood of threats and
potential damage to the institution.
e. The ability to identify and implement controls over
the root causes of an incident.

3. If the institution outsources activities to a third-party

service provider, determine whether management
integrates those activities with the information security
program. Verify that the third-party management
program evidences expectations that align with the
institution's information security program.

Objective 4: As part of the information security program, determine whether management has
established risk identification processes.

1. Determine whether management effectively identifies

threats and vulnerabilities continuously.

2. Determine whether the risk identification process

produces manageable groupings of information security
threats, including cybersecurity threats. Review whether
management has the following:
a. A threat assessment to help focus the risk
identification efforts.
b. A method or taxonomy for categorizing threats,
sources, and vulnerabilities.

September 2016 5
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
c. A process to determine the institution's information
security risk profile.
d. A validation of the risk identification process
through audits, self-assessments, penetration tests,
and vulnerability assessments.
e. A validation though audits, self-assessments,
penetration tests, and vulnerability assessments that
risk decisions are informed by appropriate
identification and analysis of threats and other
potential causes of loss.

3. Determine whether management has a means to collect

data on potential threats to identify information security
risks. Determine whether management uses threat
modeling (e.g., development of attack trees) to assist in
identifying and quantifying risk and in better
understanding the nature, frequency, and sophistication
of threats.

4. Determine whether management has continuous,

established routines to identify and assess vulnerabilities.
Determine whether management has processes to receive
vulnerability information disclosed by external
individuals or groups, such as security or vulnerability
researchers.

5. Determine whether management adjusts the information

security program for institutional changes and changes in
legislation, regulation, regulatory policy, guidance, and
industry practices. Review whether management has
processes to do the following:
a. Maintain awareness of new legal and regulatory
requirements or changes to industry practices.
b. Update the information security program to reflect
changes.
c. Report changes of the information security program
to the board.

Objective 5: Determine whether management measures the risk to guide its recommendations for
and use of mitigating controls.

1. Determine whether management uses tools to perform

threat analysis and analyzes information security events
to help do the following:
a. Map threats and vulnerabilities.
b. Incorporate legal and regulatory requirements.
c. Improve consistency in risk measurement.
d. Highlight potential areas for mitigation.
e. Allow comparisons among different threats, events,
and potential mitigating controls.

September 2016 6
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref

Objective 6: Determine whether management effectively implements controls to mitigate

identified risk.

1. Determine whether policies, standards, and procedures

are of sufficient scope and depth to guide information
security-related decisions. Review whether policies,
standards, and procedures have the following
characteristics:
a. Are appropriately implemented and enforced.
b. Delineate areas of responsibility.
c. Are communicated in a clear and understandable
manner.
d. Are reviewed and agreed to by employees.
e. Are appropriately flexible to address changes in the
environment.

2. Determine whether the information security policy is

annually reviewed and approved by the board.

3. Determine whether the institution continually assesses the

capability of technology needed to sustain an appropriate
level of information security based on the size,
complexity, and risk appetite of the institution.

4. Determine whether management implements an

integrated control system characterized by the use of
different control types that mitigates identified risks.
Review whether management does the following:
a. Implements a layered control system using different
controls at different points in a transaction process.
b. Uses controls of different classifications, including
preventive, detective, and corrective.
c. Verifies that compensating controls are used
appropriately to compensate for weaknesses with
the system or process.

5. Determine whether management implements controls that

appropriately align security with the nature of the
institution's operations and strategic direction.
Specifically, review whether management does the
following:
a. Implements controls based on the institution's risk
assessment to mitigate risk from information
security threats and vulnerabilities, such as
interconnectivity risk.
b. Evaluates whether the institution has the necessary
resources, personnel training, and testing to
maximize the effectiveness of the controls.
c. Reviews and improves or updates the security
controls, where necessary.

September 2016 7
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
6. Determine whether management effectively maintains an
inventory(ies) of hardware, software, information, and
connections. Review whether management does the
following:
a. Identifies assets that require protection, such as
those that store, transmit, or process sensitive
customer information, or trade secrets.
b. Classifies assets appropriately.
c. Uses the classification to determine the sensitivity
and criticality of assets.
d. Uses the classification to implement controls
required to safeguard the institution's assets.
e. Updates the inventory(ies) appropriately.

7. Determine whether management comprehensively and

effectively identifies, measures, mitigates, monitors, and
reports interconnectivity risk. Review whether
management does the following:
a. Identifies connections with third parties.
b. Identifies access points and connection types that
pose risk.
c. Identifies connections between and access across
low-risk and high-risk systems.
d. Measures the risk associated with connections with
third parties with remote access.
e. Implements and assesses the adequacy of
appropriate controls to ensure the security of
connections.
f. Monitors and reports on the institution's
interconnectivity risk.

8. Determine whether management effectively mitigates

risks posed by users. Review whether management does
the following:

a. Develops and maintains a culture that fosters

responsible and controlled access for users.
b. Establishes and effectively administers appropriate
security screening in IT hiring practices.
c. Establishes and appropriately administers a user
access program for physical and logical access.
d. Employs appropriate segregation of duties.
e. Obtains agreements from employees, contractors,
and service providers covering confidentiality,
nondisclosure, and authorized use.
f. Provides training to support awareness and policy
compliance.

September 2016 8
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
9. Determine whether management applies appropriate
physical security controls to protect its premises and
more sensitive areas, such as its data center(s).

10. Determine whether management secures access to its

computer networks through multiple layers of access
controls. Review whether management does the
following:
a. Establishes zones (e.g., trusted and untrusted)
according to risk with appropriate access
requirements within and between each zone.
b. Maintains accurate network diagrams and data flow
charts.
c. Implements appropriate controls over wired and
wireless networks.

11. Determine whether management has a process to

introduce changes to the environment (e.g., configuration
management of IT systems and applications, hardening of
systems and applications, use of standard builds, and
patch management) in a controlled manner. Determine
whether management does the following:
a. Maintains procedures to guide the process of
introducing changes to the environment.
b. Defines change requirements.
c. Restricts changes to authorized users.
d. Reviews the potential impact changes have on
security controls.
e. Identifies all system components affected by the
changes.
f. Develops test scripts and implementation plans.
g. Performs necessary tests of all changes to the
environment (e.g., systems testing, integration
testing, functional testing, user acceptance testing,
and security testing).
h. Defines rollback procedures in the event of
unintended or negative consequences with the
introduced changes.
i. Verifies the application or system owner has
authorized changes in advance.
j. Maintains strict version control of all software
updates.
k. Validates that new hardware complies with
institution policies and guidelines.
l. Verifies network devices are properly configured
and function appropriately within the environment
m. Maintains an audit trail of all changes.

12. Determine whether appropriate processes exist for

configuration management (managing and controlling
configurations of systems, applications, and other
technology).

September 2016 9
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
13. Determine whether management has processes to harden
applications and systems (e.g., installing minimum
services, installing necessary patches, configuring
appropriate security settings, enforcing principle of least
privilege, changing default passwords, and enabling
logging).

14. Determine whether management uses standard builds,

allowing one documented configuration to be applied to
multiple computers in a controlled manner, to create
hardware and software inventories, update or patch
systems, restore systems, investigate anomalies, and audit
configurations.

15. Determine whether management has a process to update

and patch operating systems, network devices, and
software applications, including internally developed
software provided to customers, for newly discovered
vulnerabilities. Review whether patch management
processes include the following:
a. An effective monitoring process that identifies the
availability of software patches.
b. A process to evaluate the patches against the threat
and network environment.
c. A prioritization process to determine which patches
to apply across classes of computers and
applications.
d. A process for obtaining, testing, and securely
installing the patches.
e. An exception process, with appropriate
documentation, for patches that an institution
decides to delay or not apply.
f. A process to ensure that all patches installed in the
production environment are also installed in the
disaster recovery environment.
g. A documentation process to ensure the institution's
information assets and technology inventory and
disaster recovery plans are updated as appropriate
when patches are applied.
h. Actions to ensure that patches do not compromise
the security of the institution's systems.

16. Determine whether management plans for the life cycles

of the institution's systems, eventual end of life, and any
corresponding business impacts. Review whether the
institution's life cycle management includes the
following:
a. Maintaining inventories of systems and
applications.
b. Adhering to an approved end-of-life or sunset
policy for older systems.

September 2016 10
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
c. Tracking changes made to the systems and
applications, availability of updates, and the
planned end of support by the vendor.
d. Planning for the update or replacement of systems
nearing obsolescence.
e. Outlining procedures for the secure destruction or
wiping of hard drives being returned to vendors or
donated to prevent the inadvertent disclosure of
sensitive information.

17. Determine whether management has implemented

defense-in-depth to protect, detect, and respond to
malware.

18. Determine whether management maintains policies and

effectively controls and protects access to and
transmission of information to avoid loss or damage.
Review whether management does the following:
a. Requires secure storage of all types of sensitive
information, whether on computer systems, portable
devices, physical media, or hard-copy documents.
b. Establishes controls to limit access to data.
c. Requires appropriate controls over data stored in a
cloud environment.
d. Implements appropriate controls over the electronic
transmission of information or, if appropriate
safeguards are unavailable, restricts the type of
information that can be transmitted.
e. Has appropriate disposal procedures for both paper-
based and electronic information.
f. Maintains the security of physical media, including
backup tapes, containing sensitive information
while in transit, including to off-site storage, or
when shared with third parties.
g. Has policies restricting the use of unsanctioned or
unapproved IT resources (e.g., online storage
services, unapproved mobile device applications,
and unapproved devices).

19. Determine whether management identifies factors that

may increase risk from supply chain attacks and responds
with appropriate risk mitigation. Review whether
management implements the following as appropriate:
a. Purchases are made only through reputable sellers.
b. Purchases are made through a third party to shield
the institution's identity.
c. Hardware is reviewed for anomalies.
d. Software is reviewed through both automated
software testing and code reviews.
e. Reliability of the items purchased is regularly
reviewed post-implementation.

20. Determine whether management has an effective process

to administer logical security access rights for the

September 2016 11
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
network, operating systems, applications, databases, and
network devices. Review whether management has the
following:
a. An enrollment process to add new users to the
system.
b. An authorization process to add, delete, or modify
authorized user access to operating systems,
applications, directories, files, and specific types of
information.
c. A monitoring process to oversee and manage the
access rights granted to each user on the system.
d. A process to control privileged access.
e. A process to change or disable default user accounts
and passwords.

21. As part of management's process to secure the operating

system and all system components, determine whether
management does the following:
a. Limits the number of employees with access to
operating system and system utilities and grants
only the minimum level of access required to
perform job responsibilities.
b. Restricts and logs access to and activity on
operating system parameters, system utilities
(especially those with data-altering capabilities),
and sensitive system resources (including files,
programs, and processes), and supplements with
additional security software, as necessary.
c. Restricts operating system access to specific
terminals in physically secure and monitored
locations.
d. Secures or removes external drives and portable
media from system consoles, terminals, or PCs
running terminal emulations, residing outside of
physically secure locations.
e. Prohibits remote access to operating system and
system utilities, where feasible, and, at a minimum,
requires strong authentication and encrypted
sessions before allowing such remote access.
f. Filters and reviews logs for potential security events
and provides adequate reports and alerts.
g. Independently monitors operating system access by
user, terminal, date, and time of access.

22. Determine whether management controls access to

applications. Review whether management does the
following:
a. Implements a robust authentication method
consistent with the criticality and sensitivity of the
application.
b. Manages application access rights by using group
profiles.

September 2016 12
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
c. Periodically reviews and approves the application
access assigned to users for appropriateness.
d. Communicates and enforces the responsibilities of
programmers, security administrators, and
application owners in maintaining effective
application access control.
e. Sets time-of-day or terminal limitations for some
applications or for more sensitive functions within
an application.
f. Logs access and events, defines alerts for significant
events, and develops processes to monitor and
respond to anomalies and alerts.

23. Determine whether management has policies and

procedures to ensure that remote access by employees,
whether using institution or personally owned devices, is
provided in a safe and sound manner. Review whether
management does the following:
a. Provides remote access in a safe and sound manner.
b. Implements the controls necessary to offer remote
access securely (e.g., disables unnecessary remote
access, obtains approvals for and performs audits of
remote access, maintains robust configurations,
enables logging and monitoring, secures devices,
restricts remote access during specific times,
controls applications, enables strong authentication,
and uses encryption).

24. Determine whether management effectively controls

employees' use of remote devices. Review whether
management does the following:
a. Implements controls over institution owned and
personally owned devices used by employees to
access the network (e.g., disallows remote access
without business justification, requires management
approval, reviews remote access approvals, restricts
access to authorized network areas, logs remote
access, implements robust authentication, uses
encryption, and uses application white-listing).
b. Implements controls over remote devices provided
by the institution (e.g., securely configures remote
access devices, protects devices against malware,
patches and updates software, encrypts sensitive
data, implements secure containers, audits device
access, uses remote disable and wipe capabilities,
and uses geolocation).
c. Uses an effective method to ensure personally
owned devices meet defined institution security
standards (e.g., such as operating system version,
patch levels, and anti-malware solutions).

25. Determine whether management effectively provides

secure customer access to financial services and plans for

September 2016 13
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
potential interruptions in service. Review whether
management does the following:
a. Develops and maintains policies and procedures to
securely offer and ensure the resilience of remote
financial services (e.g., using appropriate
authentication, layered security controls, and fraud
detection monitoring). (For additional questions,
refer to the "Mobile Financial Services"
examination procedures.)
b. Plans and coordinates with ISPs and third parties to
minimize exposure to incidents and continue
services when faced with an incident (e.g., monitors
threat alerts, service availability, applications, and
network traffic for indicators of nefarious activity,
and ensures traffic filtering).
c. Develops and tests a response plan in conjunction
with the institution's ISPs and third-party service
providers to mitigate the interruption of mobile or
remote financial services.

26. Determine whether management develops customer

awareness and education efforts that address both retail
(consumer) and commercial account holders.

27. Determine whether management uses applications that

were developed by following secure development
practices and that meet a prudent level of security.
Determine whether management develops security
control requirements for applications, whether they are
developed in-house or externally. Determine whether
information security personnel are involved in monitoring
the application development process to verify secure
development practices. Review whether applications in
use provide the following capabilities:
a. Provide a prudent level of security (e.g., password
and audit policies), audit trails of security and
access changes, and user activity logs.
b. Have user and group profiles to manage user access
for applications if they are not part of a centralized
identity access management system.
c. Provide the ability to change and disable default
application accounts upon installation.
d. Allow administrators to review and install patches
for applications in a timely manner.
e. Use validation controls for data entry and data
processing.
f. Integrate additional authentication and encryption
controls, as necessary.
g. Protect web or Internet-facing applications through
additional controls, including web application
firewalls, regular scanning for new or recurring
vulnerabilities, mitigation or remediation of

September 2016 14
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
common security weaknesses, and network
segregation.

28. With respect to developed software, determine whether

institution management does the following:
a. Reviews mitigation of potential flaws in
applications.
b. Obtains attestation or evidence from third-party
developers that the applications acquired by the
institution meet the necessary security requirements
and that noted vulnerabilities or flaws are
remediated in a timely manner.
c. Performs ongoing risk assessments to consider the
adequacy of application-level controls in light of
changing threat, network, and host environments.
d. Implements minimum controls recommended by
third-party service providers and considers
supplemental controls as appropriate.
e. Reviews available audit reports, and considers and
implements appropriate control recommendations.
f. Collects data to build metrics and reporting of
configuration management compliance, and
vulnerability management.

29. For database security, determine whether management

implemented or enabled controls commensurate with the
sensitivity of the data stored in or accessed by the
database(s). Determine whether management
appropriately restricts access and applies the rule of least
privilege in assigning authorizations.

30. Determine how and where management uses encryption

and if the type and strength are sufficient to protect
information appropriately. Additionally, determine
whether management has effective controls over
encryption key management.

31. Determine whether management appropriately oversees

the effectiveness of information security controls over
outsourced operations and is accountable for the
mitigation of risks involved with the use of third-party
service providers. Review the due diligence involved,
security controls to mitigate risk, and monitoring
capabilities over the institution's third parties. Review the
institution's policies, standards, and procedures related to
the use of the following:
a. Third-party service providers that facilitate
operational activities (e.g., core processing, mobile
financial services, cloud storage and computing, and
managed security services).
b. Due diligence in research and selection of third-
party service providers.

September 2016 15
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
c. Contractual assurances from third-party service
providers for security responsibilities, controls, and
reporting.
d. Nondisclosure agreements with third-party service
providers with access to the institution's systems
and data (including before, during, and following
termination of the contract).
e. Independent review of the third-party service
provider's security through appropriate reports from
audits and tests.
f. Coordination of incident response policies and
contractual notification requirements.
g. Verification that information and cybersecurity
risks are appropriately identified, measured,
mitigated, monitored, and reported.

32. If the institution outsources cloud computing or storage to

a third-party service provider, refer to the FFIEC’s
“Outsourced Cloud Computing” statement. 3

33. If the institution outsources the management of security

services to a third-party service provider, refer to the
information available in appendix D of the IT Handbook's
"Outsourcing Technology Services" booklet and the
related examination procedures.4

34. Determine whether management effectively manages the

following information security considerations related to
business continuity planning. Review management's
ability to do the following:
a. Identify personnel with key information security
roles during a disaster and training of personnel in
those roles.
b. Define information security needs for backup sites
and alternate communication networks.
c. Develop policies that address the concepts of
information security incident response and
resilience and test information security incident
scenarios.
35. Determine whether management has an effective log
management process that involves a central logging
repository, timely transmission of log files, and effective
log analysis. Review whether management has the
following:
a. Log retention policies that meet incident response
and analysis needs.
b. Processes for the security and integrity of log files
(e.g., encryption of log files, adequate storage
capacity, secure backup and disposal of logs,

3 See the FFIEC’s “Outsourced Cloud Computing” statement.

4 Refer to the IT Handbook’s “Outsourcing Technology Services” booklet for the MSSP Examination Procedures.

September 2016 16
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
logging to a separate computer, use of read-only
media, controlled log parameters, and restricted
access to log files).
c. Independent review of logging practices.
d. Processes to effectively collect, aggregate, analyze,
and correlate security event information from
discrete systems and applications.
Objective 7: Determine whether management has effective risk monitoring and reporting
processes.

1. Determine whether the institution has risk monitoring

and reporting processes that address changing threat
conditions in both the institution and the greater financial
industry. Determine whether these processes address
information security events faced by the institution, the
effectiveness of management's response, and the
institution's resilience to those events. Review whether
the reporting process includes a method of disseminating
those reports to appropriate members of management.

2. Determine whether the risk monitoring and reporting

process is regular and prompts action, when necessary, in
a timely manner.

3. Determine whether program monitoring and reporting

instigate appropriate changes that are effective in
maintaining an acceptable level of risk.

4. Determine whether management develops and effectively

uses metrics as part of the risk monitoring and reporting
processes for the information security program. Review
whether management does the following:
a. Uses metrics that are timely, comprehensive, and
actionable to improve the program's effectiveness
and efficiency.
b. Develops metrics that demonstrate the extent to
which the information security program is
implemented and whether the program is effective.
c. Uses metrics to measure security policy
implementation, the adequacy of security services
delivery, and the impact of security events on
business processes.
d. Establishes metrics to measure conformance to the
standards and procedures that are used to implement
policies.
e. Uses metrics to quantify and report risks in the
information security program.

September 2016 17
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref

Objective 8: Determine whether management has security operations that encompass necessary
security-related functions, are guided by defined processes, are integrated with lines of business and
activities outsourced to third-party service providers, and have adequate resources (e.g., staff and
technology).

1. Determine whether the institution's security operations

activities include the following:
a. Security software and device management (e.g.,
maintaining the signatures on signature-based
devices and firewall rules).
b. Forensics (e.g., analysis of potentially compromised
systems).
c. Vulnerability identification (e.g., operation or
supervision of vulnerability scans, self-assessments,
penetration tests, and analysis of audit results).
d. Vulnerability cataloging and remediation tracking.
e. Physical security management (e.g., CCTV, guards,
and badge systems).
f. Law enforcement interface (e.g., data retention and
lawful intercepts).
g. Third-party integration (e.g., managed security
services and incident detection services).
h. Monitoring of network, host, and application
activity.
i. Threat identification and assessment.
j. Incident detection and management.
k. Enforcement of access controls.
l. Back-office operations and transaction processing.
m. Customer service.
n. Systems development and support.
o. Internal controls and processes.
p. Capacity planning.

2. Determine whether management establishes defined

processes and appropriate governance to facilitate the
performance of security operations. Determine whether
management coordinates security operations activities
with the institution’s lines of business and with the
institution’s third-party service providers.

3. Determine whether management has effective threat

identification and assessment processes, including the
following:
a. Maintaining procedures for obtaining, monitoring,
assessing, and responding to evolving threat and
vulnerability information.
b. Identifying and assessing threats (e.g., threat
information is often ad hoc, although some
providers present threat information within a
defined framework that readily lends itself to
analytical operations).
c. Using tools to assist in the analysis of
vulnerabilities (e.g., design of system, operation of

September 2016 18
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
the system, security procedures, business line
controls, and implementation of the system and
controls).
d. Using threat knowledge to drive risk assessment
and response.
e. Designing policies to allow immediate and
consequential threats to be dealt with expeditiously.
f. Developing appropriate processes to evaluate and
respond to vulnerability information from external
groups or individuals.

4. Determine whether management has effective threat

monitoring processes, including the following:
a. Defining threat monitoring policies that provide for
both continual and ad hoc monitoring of
communications and systems, effective incident
detection and response, and the use of monitoring
reports in subsequent legal proceedings.
b. Establishing responsibility and accountability for
security personnel and system administrators for
monitoring.
c. Appropriately reviewing and providing approval of
the monitoring tools used.
d. Monitoring of indicators, including vulnerabilities,
attacks, compromised systems, and suspicious
users.
e. Monitoring both incoming and outgoing network
traffic to identify malicious activity and data
exfiltration.
f. Establishing and documenting a process to
independently monitor administrators and other
users with higher privileges.

5. Determine whether management has effective incident

identification and assessment processes to do the
following:
a. Identify indicators of compromise.
b. Analyze the event associated with the indicators.
c. Classify the event.
d. Enable the use of response teams and responses
depending on the type of event.
e. Escalate the event consistent with the classification.
f. Report internally and externally as appropriate.
g. Identify personnel empowered to declare an
incident.
h. Develop procedures to test the incident escalation,
response, and reporting processes.

6. Determine whether management has effective incident

response processes, including the following:
a. Protocols defined in the incident response policy to
declare and respond to an incident once identified.

September 2016 19
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
b. Procedures to minimize damage through the
containment of the incident, restoration of systems,
preservation of data and evidence, and notification,
as appropriate, to customers and others as needed.
c. Appropriate balance of adequate people and
technologies in the response.
d. A plan that is comprehensive, coordinated,
integrated, and periodically tested with appropriate
internal and external parties.
e. Policies and procedures to guide the response,
assigning responsibilities to individuals; providing
appropriate training; formalizing information flows;
and selecting, installing, and understanding the tools
used in the response effort.
f. Thresholds for reporting significant security
incidents and processes to notify, as appropriate, the
institution's regulators of those incidents that may
affect the institution or the financial system.
g. Assignment of responsibilities, training, and testing.
h. Containment strategies.
i. Restoration and follow-up strategies.

Objective 9: Determine whether management has an effective information security program.

1. Determine whether the information security program is

subject to periodic review and whether management
provides for continual improvement in the program's
effectiveness. Verify whether that review does the
following:
a. Addresses the program in its current environment.
b. Demonstrates that lessons learned from experience,
audit findings, and other opportunities for
improvement are identified and applied.

Objective 10: Determine whether assurance activities provide sufficient confidence that the
security program is operating as expected and reaching intended goals.

1. Review whether management ascertains assurance

through the following:
a. Testing and evaluations through a combination of
self-assessments, penetration tests, vulnerability
assessments, and audits with appropriate coverage,
depth, and independence.
b. Alignment of personnel skills and program needs.
c. Reporting that is timely, complete, transparent, and
relevant to management decisions.

2. Determine whether management considers the following

key testing factors when developing and implementing
independent tests:
a. Scope.
b. Personnel.
c. Notifications.

September 2016 20
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
d. Confidentiality, integrity, and availability of the
institution's information.
e. Confidentiality of test plans and data.
f. Frequency.

3. Determine whether management uses the following types

of tests and evaluations to determine the effectiveness of
the information security program. Verify whether
management ensures the following are done:
a. Periodic self-assessments performed by the
organizational unit being assessed.
b. Penetration tests that subject a system to real-world
attacks and identify weaknesses.
c. Vulnerability assessments that define, identify, and
classify the security holes found in the system.
d. Audits performed by independent internal
departments or third parties.

4. Determine whether management uses independent

organizations to test aspects of its information security
programs.

5. Determine whether management uses reporting of the

results of self-assessments, penetration tests, vulnerability
assessments, and audits to support management decision
making.

6. Determine whether the annual information security report

is timely and contains adequate information.

Objective 11: Discuss corrective action and communicate findings.

1. Review preliminary conclusions with the examiner-in-

charge regarding:
a. Violations of laws and regulations.
b. Significant issues warranting inclusion as matters
requiring attention or recommendations in the report
of examination.
c. Proposed Uniform Rating System for Information
Technology management component rating and the
potential impact of the examiner’s conclusions on
composite or other component IT ratings.
d. Potential impact of the examiner’s conclusions on
the institution’s risk assessment.

2. Discuss findings with management and obtain proposed

corrective action for significant deficiencies.

3. Document conclusions in a memorandum to the

examiner-in-charge that provides report-ready comments
for all relevant sections of the report of examination and
guidance to future examiners.

September 2016 21
 FFIEC IT Examination Handbook Information Security

Work
Examiner Comments
Paper Ref
4. Organize work papers to ensure clear support for
significant findings by examination objective.

September 2016 22