FFIEC Updates Examiner IT Handbook

The Federal Financial Institutions Examination Council ("FFIEC") updated its "Development, Acquisition and Maintenance" booklet, one in a series that make up the FFIEC Information Technology Examination Handbook. 

Each member of FFIEC, including the FRB, the CFPB, the FDIC, the NCUA, the OCC and the State Liaison Committee "uses the principles outlined in this booklet consistent with the member’s supervisory authority." The booklet describes "the principles and practices that examiners can use when assessing an entity’s system development, acquisition, and maintenance activities." 

In the update, FFIEC identified potential weaknesses in IT which "may lead to issues with confidentiality, integrity, availability, and resilience of the entity's systems, components, and data." FFIEC explained that:

• Development involves "defining, designing, testing and implementing systems or components," whether through internal resources or third-party suppliers. This includes validating technology and integrating components into larger systems.
• Acquisition covers all stages of obtaining products or services, from identifying needs to contract completion. FFIEC highlighted the importance of supply chain risk management to ensure product and system security and resilience.
• Maintenance involves preventive measures to avoid failure or malfunction, as well as ongoing monitoring and updates (e.g., patches and feature additions) to ensure long-term performance and continuity.

The updated booklet replaced the Development and Acquisition booklet issued in April 2004. FFIEC said the "revised title now reflects the importance of maintenance in the life of a system or component." (Emphasis added.)