OCC Updates Cyber Audit Rules for Banks
OCC modernizes cybersecurity audit framework for banks without new requirements
In brief
OCC modernizes cybersecurity audit framework for banks without new requirements Banks must use existing cybersecurity tools but no new rules apply to their cyber readiness Originally reported by Pymnts.
OCC updates cyber audit framework
OCC revised the Cybersecurity Supervision Work Program structure to align with updated NIST Cybersecurity Framework categories and subcategories.
No new cybersecurity rules for banks
Banks do not need to implement new cybersecurity procedures; the OCC encourages but does not require standardized assessments.
OCC rescinds old cyber bulletin
OCC Bulletin 2023-22 was canceled to reflect updated cybersecurity supervision practices.
AI threat focus for banks
OCC warns banks about AI-driven cyber threats and recommends multifactor authentication and timely patch management.
OCC prioritizes material risks
OCC aims to focus oversight on cyber and liquidity risks rather than procedural issues through tighter definitions.
The headline
Banks must use existing cybersecurity tools but no new rules apply to their cyber readiness
