Cyber Incidents and Breaches

Position

• Any federal or state cybersecurity legislation, regulation, guidance, or framework should recognize existing mandates and standards to ensure community banks are not burdened with the obligation to reassess their critical systems against a duplicative or overlapping standards, which would yield similar results.

• Regulators should not mandate the use of any one framework, tool, or assessment, but rather support community banks’ ability to use the framework, tool or assessment that best suits their institution’s size, complexity, and risk tolerance.

• ICBA supports voluntary information sharing among financial institutions of all sizes, public-private partnerships, and federal agencies for the purpose of identifying, responding to, and mitigating cybersecurity threats and vulnerabilities while appropriately balancing the need to secure customer information.

• Regulators must broaden their supervision to include additional core processors, fintech companies, and other third-party technology and service providers on which community banks rely. Employees and subcontractors of technology service providers should comply with nondisclosure and confidentiality requirements similar to those that apply to banks.

• Congress must subject credit reporting agencies and other customer financial data collectors/aggregators to federal examination and supervision comparable to that which applies to community banks and other financial institutions.

• ICBA supports cybersecurity initiatives such as .BANK and Sheltered Harbor and will work with community bank core processors to ensure equitable and reasonable access to these initiatives.

• ICBA supports stronger cybersecurity standards and practices for law enforcement, regulatory agencies, and other governmental departments and agencies.

Background

The financial services industry, including community banks, is on the front lines defending against cybersecurity threats and takes its role in securing data and personal information very seriously. As a result of sophisticated and constantly evolving cyber threats and intrusions, the federal government and private industry are increasingly focused on cybersecurity.

Cybersecurity Risk Assessment Tools

Standards and technology policymakers must not be proscriptive in the use of cybersecurity frameworks. There are many acceptable tools and assessments such as the National Institute of Standards and Technology’s Cybersecurity Framework, and the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT).

Threat Information Sharing is Critical

The sharing of advanced threat and attack data between federal agencies and financial services sector participants helps manage cyber threats and protect critical systems. ICBA supports community banks’ involvement with services such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), a non-profit information-sharing forum established by financial services industry participants to facilitate public and private sector sharing of physical and cybersecurity threat and vulnerability information.

ICBA supports FS-ISAC’s cross-sector information sharing efforts to enhance overall resiliency of the nation’s critical infrastructure. ICBA’s Sector Fraud Working Group shares fraud intelligence with a wide range of public and private stakeholders.

Oversight and Mitigation of Third-Party Risk

Community banks significantly rely on third party technology and service providers to support their systems and business activities. While community banks are diligent in their management of third parties, mitigating sophisticated cyber threats against them can be challenging, especially when they have connections to other institutions and servicers.

Regulators must be aware of the significant interconnectivity of these third parties and collaborate with them to mitigate risk. The agencies should evaluate the concentration risks of service providers to financial institutions and broaden supervision of technology service providers to include additional third-party technology and service providers.

Among other issues, employees of technology and service providers have access to confidential bank information that could be used to commit fraud, damage a bank’s reputation, or compromise customer privacy. Regulators must ensure that these service providers implement nondisclosure and confidentiality requirements similar to existing regulatory requirements for banks. They must provide disclosure when employees or contractors are non-U.S. citizens.

Examination and Supervision of Credit Rating Agencies

The 2017 Equifax data breach demonstrated how important it is that the credit rating agencies (CRAs) and other collectors/aggregators of customer financial data be subject to examination and supervision by prudential regulators. The release of this information has the potential to adversely affect American consumers for the remainder of their lives and presents unique challenges for all financial institutions in authenticating new and existing customers. Subjecting CRAs and similar organizations to appropriate oversight may prevent future breaches.

Sector Cybersecurity Initiatives

The .BANK web domain is a trusted, verified, secure, and easily identifiable location on the internet for the banking community and the customers it serves. With rigorous security standards in place, users of a .BANK website can be assured they are landing on participants’ actual websites as opposed to being redirected elsewhere such as a malicious or spoofed site. .BANK also provides email authentication to mitigate spoofing and phishing as well as encryption for internet connections to ensure data privacy and security.

Sheltered Harbor is designed to improve resiliency and provide enhanced protection for financial institution customer accounts and data. Sheltered Harbor enables financial institutions to securely store and rapidly restore account information. When an institution is unable to recover from a cyber incident in a timely fashion, Sheltered Harbor makes account information available to customers through a service provider or another financial institution.

Governmental Departments and Agencies

Despite issuing cybersecurity regulations and guidance covering financial institutions, governmental departments and agencies have also been subject to data breaches. The government has a responsibility to safeguard sensitive information. Liability and costs of a breach of governmental systems may be unfairly assigned to the banking sector and result in a loss in confidence. Additionally, there is high risk of identity theft of American citizens.