OCC Preserves Cybersecurity Program Alignment With NIST Framework

The OCC updated the structure and references of its Cybersecurity Supervision Work Program ("CSW") to keep it aligned with the revised National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

In a bulletin, the OCC stated that it did not add or alter any procedures in the CSW. Instead, the agency updated the CSW's structure to align with the updated NIST CSF categories and subcategories. The OCC reiterated that the CSW does not establish new regulatory expectations and that banks are not required to use the work program to assess cybersecurity preparedness. The agency encourages, but does not require, a standardized approach, and banks may choose among available tools and frameworks.

The CSW remains scalable for banks of varying size and complexity, and examiners may apply its procedures during community bank cybersecurity examinations. The CSW supplements the OCC's bank IT examination procedures in the "Community Bank Supervision," "Large Bank Supervision," and "Federal Branches and Agencies Supervision" booklets of the Comptroller's Handbook, and in the booklets of the Federal Financial Institutions Examination Council IT Examination Handbook. A separate CSW References page cross-references those sources plus the Center for Internet Security Critical Security Controls and the Cyber Risk Institute Profile.

The bulletin rescinds OCC Bulletin 2023-22, issued in June 2023.