In an era of hyperconnectivity, cybercriminals are constantly innovating their tactics to exploit human error and technological vulnerabilities. Adapting to the changing threat landscape is essential for any organization to remain secure in the digital age. The onus falls not only on technology enterprises, but also banks, where cybersecurity models must be dynamic enough to account for evolving threats.
The US Federal Financial Institutions Examination Council (FFIEC) is a formal government interagency body that includes 5 banking regulators.1 The FFIEC developed the Cybersecurity Assessment Tool (CAT) on behalf of its members to help organizations identify risk and determine their cybersecurity maturity level. The tool was released on 30 June 2015, and updated in May 2017.2
As stated in the FFIEC Cybersecurity Assessment Tool documentation, "[T]he assessment provides institutions with a repeatable and measurable process to inform management of their organization’s risks and cybersecurity preparedness."3 The key words are "repeatable," which produces the benefit of identifying patterns in behavior, and "measurable," which can help manage cyberrisk. After all, one can only manage what can be measured. The tool is based on recognized IT and cybersecurity frameworks such as the FFIEC Information Technology Examination Handbook and the US National Institute of Standards and Technology (NIST) Cybersecurity Framework.4 The CAT is much more comprehensive and is targeted to financial institutions.
The FFIEC CAT is divided into 39 questions to identify the bank’s inherent risk profile and 494 declarative statements (i.e., controls and processes) to gain a better understanding of the cybersecurity maturity level.5
The Inherent Risk Profile section of the assessment contains 5 risk levels: Least, Minimal, Moderate, Significant and Most.6 Each risk level encompasses the following 5 categories and subcategories:7
- Technologies and Connection Types—14 subcategories
- Delivery Channels—3 subcategories
- Online/Mobile Products and Technology Services—14 subcategories
- Organizational Characteristics—7 subcategories
- External Threats—1 subcategory
As management works to identify the bank’s inherent cyberrisk, it must consider information that is sometimes overlooked in annual IT audits. This process is essential for understanding the volume, types and frequency of attacks the financial institution faces.
The Cybersecurity Maturity portion of the assessment is divided into 5 domains:8
- Cyber Risk Management and Oversight
- Threat Intelligence and Collaboration
- Cybersecurity Controls
- External Dependency Management
- Cyber Incident Management and Resilience
These domains, in addition to assessment factors, components and individual declarative statements, are evaluated across 5 maturity levels:9
- Baseline
- Evolving
- Intermediate
- Advanced
- Innovative
It is essential to highlight that the assessment is not designed to identify an overall cybersecurity maturity level for the organization; instead, management can determine its maturity level in each domain. The tool also requires that to achieve a domain’s maturity level, all declarative statements in that level, and the levels before it, must be accomplished and sustained.
Boards of Directors (BoDs) and senior management have had conversations with examiners about the tool used to conduct the examinations; therefore, it will be considered a best practice to test the effectiveness of the controls in place and identify any gaps in the maturity levels suggested by the tool, given the bank’s inherent cyberrisk. Management should decide what maturity level it would like to achieve and identify the processes and controls needed to reach it.
Editor’s Note
ISACA's CMMI® Cybermaturity Platform is an industry-leading, cloud-hosted platform trusted by enterprises worldwide to assess, manage and mitigate cybersecurity risk and build enterprise cybermaturity. To learn how it can improve your enterprise’s cyberresilience or to schedule a demo, visit https://www.isaca.org/enterprise/cmmi-cybermaturity-platform.
Endnotes
1 US Federal Financial Institutions Examination Council, Cybersecurity Assessment Tool USA, 2017
2 Ibid.
3 Ibid.
4 Ibid.
5 Ibid.
6 Ibid.
7 Ibid.
8 Ibid.
9 Ibid.
Alejandro Mijares, CISA, CRISC
Is the director of IT and cybersecurity for banks at Kaufman Rossin. He specializes in providing IT internal audit, system validation and security review services to financial institutions. He conducts technical risk assessments and US Gramm Leach Bliley Act (GLBA) risk assessments for financial institutions throughout Latin America and the United States. Mijares works with chief information security officers (CISOs), chief information officers (CIOs) and business leaders to effectively develop and execute a variety of IT, information security and digitalization tactics. He also conducts IT-related presentations and was named a 2017 Top-Rated Speaker by ISACA®.