Learn How to Do a Risk Based Audit of IT Security

Learn How to Do a Risk Based Audit of IT Security

The Federal Financial Institutions Examination Council (FFIEC) recently issued a revised Information Security booklet. The update addresses how to:

• Assess the level of security risks facing a financial institution's information systems
• Assess the integration of information security into the institution's overall risk management program
• Identify, monitor, and respond to cyber threats and incidents

You need to have a plan in place to demonstrate that your institution can effectively manage the confidentiality, integrity, and availability of sensitive information. That plan must incorporate the latest guidance. Serious violations could result in a consent order—regulators consider weaknesses to be a safety and soundness issue.

• How can you integrate security advisories and controls throughout your institution’s business processes?
• What do regulators expect?
• Are your cybersecurity measures sufficient?
• How can you evaluate the effectiveness of security controls?
• How can you mitigate threats as technologies and business conditions evolve?
• Is there enough support from your institution’s board and senior management?
• How can an enterprise risk management approach integrate processes, people, and technology to maintain a risk profile consistent with the board’s risk appetite?
• How should you monitor outsourced IT security functions?

BankersWeb.com Quality Commitment