Federal Banking Agencies Propose New Cybersecurity Regulations

On Oct. 19, 2016, the Board of Governors of the Federal Reserve System (“Federal Reserve”), the Office of the Comptroller of the Currency (“OCC”) and the Federal Deposit Insurance Corporation (“FDIC,” collectively the “Agencies”) issued a joint advance notice of proposed rulemaking (“Notice”) inviting public comment on cybersecurity regulations and guidance designed to improve the safety and soundness of the U.S. financial system.[1] The Notice includes 39 questions on which the Agencies seek input, including whether the Agencies ultimately issue a formal regulation, guidance or some combination of those tools.[2] That choice will be particularly important as it may determine whether the regulatory regime remains flexible enough for covered entities to adapt to new technologies and evolving threats. The Agencies will receive public comments until Jan. 17, 2017.[3] The Agencies are “considering establishing enhanced standards for the largest and most interconnected entities under their supervision, as well as for services that that these entities receive from third parties.”[4]

The Notice proposes a two-tiered framework in which all covered institutions would have to meet a minimum standard, and “those entities that are critical to the functioning of the financial sector,” which the Notice refers to as “sector-critical systems,” would have to meet with “more stringent standards.”[5] The Agencies ambitiously call for entities that provide sector-critical systems to ensure they can recover those systems within two hours of a cyber event and validate their efforts with regular, quantitative testing.

If the Agencies do in fact issue binding standards, they will go beyond the existing, largely nonbinding frameworks that apply to covered institutions, such as the Gramm-Leach-Bliley Act[6] (and the rules promulgated thereunder, including the Interagency Guidelines Establishing Information Security Standards[7]), the Federal Financial Institution Examination Council’s IT Handbook[8] and the National Institute of Standards and Technology Cybersecurity Framework.[9] Further, the Agencies are also considering going beyond the Interagency Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System,[10] written by the Federal Reserve, the OCC, and the Securities and Exchange Commission, which concerned clearing and settlement activities, to address the cyber risks that could impact the largest, most interconnected U.S. financial entities in all their operations.[11]

Who Is Covered

The Agencies propose to apply the new enhanced standards to institutions under their supervision (including non-bank financial institutions) with total consolidated assets of $50 billion or more.[12] In addition, the Federal Reserve proposes to apply the standards to financial market utilities for which it acts as “Supervisory Agent” and other financial market infrastructures over which it has primary supervisory authority or which are operated by the Federal Reserve Banks. Further, the Notice also contemplates defining who is covered based on the overall “number of connections an entity (including its services providers) has to other entities in the financial sector.” However, as the notice acknowledges, metrics such as “connections” may be difficult to quantify.

The Notice’s enhanced standards apply with equal force to the service providers of any of the above entities. The Agencies also foresee that in some instances, entities that are not covered institutions and thus not themselves subject to the enhanced standards will nonetheless be subject to the highest tier of standards (sector-critical standards) if they “provide services considered sector-critical [either] directly to the financial sector or through covered entities.”[13]

Standards Applicable to All Covered Institutions

The Notice outlines five categories of standards that will apply to all covered institutions on an enterprise-wide basis (i.e., across all subsidiaries and affiliates).

Cyber Risk Governance

Many covered entities already have strategic plans and risk governance structures that anticipate and build resilience against shocks that threaten their businesses and operations. The Notice anticipates making it a legal requirement that covered entities approach cyber risk in that same way, and that they continually monitor the residual risk that remains after their efforts at mitigation.[14] To aid the board of director’s ability to receive timely and accurate information about cyber risks, the Notice considers “requiring the senior leaders with responsibility for cyber risk to be independent of business line management.”[15]

Cyber Risk Management

The Notice encourages covered entities to assess and protect against cyber risk in three overlapping ways. First, covered entities should consider each business unit separately, considering the internal and external assets it depends on in order to understand the risks specific to that business unit. Second, covered entities should integrate cyber risk into their existing independent risk management functions to understand the risks they face on the enterprise level. Finally, regular assessment of cyber risk and the covered entity’s cybersecurity program should be a significant component of the covered entity’s audit plan. For example, the Agencies are considering requiring covered entities to assess and quantitatively measure the “completeness, effectiveness, and timeliness” with which they reduce the residual and aggregate risk they face so they can demonstrate that they are meeting their board-approved risk levels.[16] Depending on the size, complexity, scope of operations and interconnectedness of the covered entity, such an audit should include penetration testing and other appropriate vulnerability assessment activities.[17] The Agencies are likewise seeking comment on possible consistent, repeatable methods to measure the cyber risk within covered entities.[18]

Internal Dependency Management

The Notice calls for covered entities to inventory the assets that their operations depend upon, looking both at assets under their control and under the control of third parties. The “internal dependencies” of a covered entity are the “business assets (i.e., workforce, data, technology, and facilities) … upon which such entity depends to deliver services, as well as the information flows and interconnections among those assets.” The Agencies would like covered entities to generate and maintain a current, accurate and complete listing of all their internal assets and business functions, including the information flows and interconnections between them, on which the covered entity can map associated risks.[19] Each covered entity should assess the risk of a new asset prior to deployment as well as throughout its lifecycle, attend to all known violations of or deviations from its cybersecurity policy, and regularly test its backup systems.[20]

External Dependency Management

Likewise, the Notice calls for covered entities to inventory and assess their “external dependencies,” which are their “relationships with outside vendors, suppliers, customers, utilities (such as power and telecommunications), and other external organizations and service providers that the covered entity depends on to deliver services, as well as the information flows and interconnections between the entity and those external parties.”[21] As with internal dependencies, the Notice anticipates that covered entities will inventory and rank the systems outside their direct control to prioritize their cyber risk management efforts.

Incident Response, Cyber Resilience and Situational Awareness

The Notice calls for covered entities to create and implement plans that will allow them to “anticipate, withstand, contain, and rapidly recover from a disruption caused by a significant cyber event.” Those plans should consider the impact of “multiple concurrent or widespread interruptions and cyber-attacks” on critical infrastructure, including the U.S. energy and telecommunications grids. Covered entities should also make themselves aware of their connections to sector partners and external stakeholders so that they limit “cyber contagion.”[22] The Agencies envision that covered entities will establish recovery time objectives appropriate for each of their systems. Such plans should recognize that malware and corrupted data can propagate through connected systems and should ensure recovery point objectives appropriate to the nature of specific kinds of data so that the covered entity is resilient against attacks that corrupt or destroy important data.[23] Interestingly, the Agencies propose that covered entities store data using a shared defined data standard so that other covered entities or even the FDIC can rapidly take over and carry on the operations of covered entities incapacitated by an attack.[24]

In all of these areas, covered entities must timely identify and assess potential cyber risks to the organization by tracking and analyzing relevant data and learning about current threats and solutions.[25] At various points, the Notice highlights that boards and business lines need to have sufficient personnel with the cybersecurity expertise to properly assess, mitigate and adapt to technology and cyber risks as they evolve.[26] The Notice encourages reporting up pertinent cybersecurity information to senior management and the board so that the leadership of the covered entity is fully informed of the organization’s risks and strategies.[27]

Sector-Critical Standards for Specific Systems

What Makes a System Sector-Critical

The sector-critical standards apply not to institutions or entities but rather to specific systems that would profoundly affect the financial sector if disrupted. Therefore, as noted above, entities not otherwise subject to the enhanced standards may still be required to implement the sector-critical standards for certain of their systems, particularly the third parties that covered entities rely upon to conduct their operations.[28] The Notice proposes several possible metrics for determining which systems are “sector-critical”:

• “systems that support the clearing or settlement of at least five percent of the value of transactions (on a consistent basis) in one or more of the markets for federal funds, foreign exchange, commercial paper, U.S. Government and agency securities, and corporate debt and equity securities”;
• “systems that support the clearing or settlement of at least five percent of the value of transactions (on a consistent basis) in other markets (for example, exchange-traded and over-the-counter derivatives)”;
• systems “that support the maintenance of a significant share (for example, five percent) of the total U.S. deposits or balances due from other depository institutions in the United States”;
• “systems that provide key functionality to the financial sector for which alternatives are limited or nonexistent, or would take excessive time to implement (for example, due to incompatibility)”; and
• “systems that act as key nodes to the financial sector due to their extensive interconnectedness to other financial entities.”[29]

The Substance of Sector-Critical Standards

The entity that provides a sector-critical system must “substantially mitigate the risk of a disruption due to a cyber event.”[30] For example, entities must “establish protocols for secure, immutable, transferable storage of critical records” “including financial records of the institution, loan data, asset management account information, and daily deposit account records, including balances and ownership details” and prioritize maintaining an up-to-date inventory and assessment of the internal and external dependencies of their sector-critical systems.[31]

Perhaps the most striking part of the Notice is the proposal that entities be required to secure, and validate by testing, a recovery time objective of only two hours for sector-critical systems. Thus, covered entities and third parties would have to ensure that their sector-critical systems could return to full operation within two hours of a cyber event “with the overall goal of completing material pending transactions on the scheduled settlement date.”[32]  

Some sector-critical systems may be outside of U.S. control or at smaller institutions that may have more difficulty reaching the level of resilience the Notice aspires to achieve. For example, the hackers who robbed more $100 million from the central bank of Bangladesh succeeded by placing malware on the central bank’s computers that keylogged the bank’s credentials and then placed apparently authenticated SWIFT transfers with the New York Bank of the Federal Reserve over the weekend.[33] While the Federal Reserve and other banks’ suspicions prevented a further $869 million in transactions from being completed, the Bangladesh hack illustrates how interconnected the global financial sector is, and how hard it may be to secure a sector-critical system.[34]

Conclusion

The Notice invites public comment on what the Agencies intend to be a robust and wide-reaching policy to enhance the cybersecurity of the U.S. financial sector. The formal regulations, guidance, or other policy the Agencies ultimately issue will likely reach far more entities than the $50 billion-or-greater institutions the Notice aims to protect. The careful thought and openness reflected in the Notice and the 39 questions the Agencies posed to the public indicate that the Agencies are taking cybersecurity seriously and seek to increase the resilience of the U.S. financial sector in a rigorous but practical manner.

Authored by Joseph P. Vitale, Michael L. Yaeger and Noah N. Gillespie.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

---

[1] Board of Governors of the Federal Reserve System, Office of the Comptroller of the Currency, &Federal Deposit Insurance Corporation Joint Press Release, Agencies Issue Advanced Notice of Proposed Rulemaking on Enhanced Cyber Risk Management Standards (Oct. 19, 2016), available at http://www.federalreserve.gov/newsevents/press/bcreg/20161019a.htm; Joint Advance Notice of Proposed Rulemaking, Enhanced Cyber Risk Management Standards, available at http://www.federalreserve.gov/newsevents/press/bcreg/bcreg20161019a1.pdf (hereinafter “Notice”).

[2] Notice at 44-45.

[3] Id. at 2.

[4] Id. at 8.

[5] Id. at 8.

[6] 15 U.S.C. §§ 6801-6809.

[7] See 12 CFR part 208, App. D-2 and 12 CFR part 225, App. F (Federal Reserve); 12 CFR 30, App. B (OCC); and 12 CFR part 364, App. B and 12 CFR part 391, subpart B, App. B (FDIC).

[8] FFIEC, IT Examination HandBook InfoBase, available at http://ithandbook.ffiec.gov/it-booklets.aspx (last visited Oct. 24, 2016).

[9] NIST, Framework for Improving Critical Infrastructure Cybersecurity (v. 1) (Feb. 2014), available at https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf.

[10] Available at https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurity-framework-021214.pdf.

[11] Id. at 12.

[12] Id. at 13. In the case of non-U.S. banks subject to Federal Reserve supervision, only U.S. assets would be counted towards the threshold.

[13] Id. at 21 (Question 12).

[14] Id. at 24.

[15] Id. at 25.

[16] Id. at 28.

[17] Id. at 29-30.

[18] Id. at 43.

[19] Id. at 32.

[20] Id. at 33.

[21] Id. at 22.

[22] Id. at 37.

[23] Id. at 37.

[24] Id. at 38; see also id. at 40 (Question 24). There might be tension between adopting a common data standard and protecting data from being stolen or destroyed. A common format might interfere with the creation of overlying proprietary or non-common solutions that prevent data from being transferred.

[25] Id. at 39.

[26] E.g., id. at 25.

[27] Id. at 30.

[28] Id. at 21.

[29] Id. at 18-19.

[30] Id. at 22.

[31] Id. at 21, 31, 34, 38.

[32] Id. at 41.

[33] Michael L. Yaeger et al., The Bangladesh Bank Hack and Compliance Programmes, E-Finance & Payments Law & Policy (May 2016), available at https://www.srz.com/images/content/7/8/v2/78899/E-Finance-Payments-Law-Policy-The-Bangladesh-Bank-Hack-and-Compl.pdf.

[34] See id.

---

This information has been prepared by Schulte Roth & Zabel LLP (“SRZ”) for general informational purposes only. It does not constitute legal advice, and is presented without any representation or warranty as to its accuracy, completeness or timeliness. Transmission or receipt of this information does not create an attorney-client relationship with SRZ. Electronic mail or other communications with SRZ cannot be guaranteed to be confidential and will not (without SRZ agreement) create an attorney-client relationship with SRZ. Parties seeking advice should consult with legal counsel familiar with their particular circumstances. The contents of these materials may constitute attorney advertising under the regulations of various jurisdictions.