Community Banks

What arrives

The Interagency Guidelines
12 CFR Part 364, Appendix B. A risk assessment of foreseeable threats to customer information, service provider oversight, and an annual report to the board.
Source
The 36-hour notice
FDIC computer-security incident notification, 12 CFR 304.23. Notice to the primary federal regulator no later than 36 hours after a notification incident is determined.
Source
The bank service provider notice
12 CFR 304.24. A bank service provider notifies each affected bank customer when an incident disrupts or degrades covered services for four or more hours.
Source
Third-party risk guidance
Interagency Guidance on Third-Party Relationships: Risk Management, final as of June 6, 2023. Bank risk management across every stage of a third-party relationship.
Source
A tall marble-floored lobby with a reception desk at the far end.

Request an Introduction