As a reminder, a joint final rule was issued to establish computer-security incident notification requirements for banking organizations and their bank service providers. The effective dates are fast approaching.  The new rule goes into effect on April 1, 2022, with full compliance extended to May 1, 2022.

The new rule is highlighted by the FDIC in FIL 74-2021, which can be found here.

In the new rule, a banking organization must notify its primary federal regulator of any significant computer-security incident as soon as possible and no later than 36 hours after the banking organization determines a cyber incident has occurred.

In addition to making requirements for bank organizations, the rule also outlines requirements for bank service providers.  A bank service provider is required to notify affected banking organization customers as soon as possible when the provider determines that it has experienced a computer-security incident that has materially affected or is reasonably likely to materially affect banking organization customers for four or more hours.

CCI recommends updating incident response plans with the new reporting requirements for banking organizations as outlined in the rule.  CCI also recommends contacting your most critical vendors, such as your core and ATM providers, to ensure they know about their notification requirements and consider asking them to update contract documents to incorporate the new requirements.

CCI now offers IT Management Solutions!  Please reach out to CCI for more details.

Sincerely,

David McPhillips, CBCM, CBSM