FFIEC Cybersecurity Assessment Tool

FFIEC
Cybersecurity Assessment Tool
May 2017

Paperwork Reduction Act (PRA) – OMB Control No. 1557-0328; Expiration date: August 31, 2019
The above OMB Control Number and expiration date pertain to a requirement of the Paperwork Reduction
Act and its implementing regulation that a federal agency may not conduct or sponsor, and a person (or
organization) is not required to respond to, a collection of information unless it displays a currently valid
OMB control number and, if appropriate, an expiration date. See 44 USC 3506(c)(1)(B) and 5 CFR
1320.5(b)(2)(i), 1320.8(b)(1).

FFIEC Cybersecurity Assessment Tool

Contents

Contents
Contents ........................................................................................................................................... i
User’s Guide ................................................................................................................................... 1
Overview ..................................................................................................................................... 1
Background ................................................................................................................................. 2
Completing the Assessment ........................................................................................................ 2
Part One: Inherent Risk Profile ............................................................................................... 3
Part Two: Cybersecurity Maturity .......................................................................................... 5
Interpreting and Analyzing Assessment Results..................................................................... 8
Resources .................................................................................................................................. 10
Inherent Risk Profile ..................................................................................................................... 11
Cybersecurity Maturity ................................................................................................................. 19
Domain 1: Cyber Risk Management and Oversight ................................................................. 19
Domain 2: Threat Intelligence and Collaboration .................................................................... 30
Domain 3: Cybersecurity Controls ........................................................................................... 34
Domain 4: External Dependency Management ........................................................................ 47
Domain 5: Cyber Incident Management and Resilience .......................................................... 51

Additional Resources
Overview for Chief Executive Officers and Boards of Directors
Appendix A: Mapping Baseline Statements to FFIEC IT Examination Handbook
Appendix B: Mapping Cybersecurity Assessment Tool to NIST Cybersecurity Framework
Appendix C: Glossary

May 2017

i

FFIEC Cybersecurity Assessment Tool

User’s Guide

User’s Guide
Overview
In light of the increasing volume and sophistication of cyber threats, the Federal Financial
Institutions Examination Council 1 (FFIEC) developed the Cybersecurity Assessment Tool
(Assessment), on behalf of its members, to help institutions identify their risks and determine
their cybersecurity maturity.
The content of the Assessment is consistent with the principles of the FFIEC Information
Technology Examination Handbook (IT Handbook) and the National Institute of Standards and
Technology (NIST) Cybersecurity Framework, 2 as well as industry accepted cybersecurity
practices. The Assessment provides institutions with a repeatable and measureable process to
inform management of their institution’s risks and cybersecurity preparedness.
The Assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The
Inherent Risk Profile identifies the institution’s inherent risk before implementing controls. The
Cybersecurity Maturity includes domains, assessment factors, components, and individual
declarative statements across five maturity levels to identify specific controls and practices that
are in place. While management can determine the institution’s maturity level in each domain,
the Assessment is not designed to identify an overall cybersecurity maturity level.
To complete the Assessment, management first assesses the institution’s inherent risk profile
based on five categories:
•
•
•
•
•

Technologies and Connection Types
Delivery Channels
Online/Mobile Products and Technology Services
Organizational Characteristics
External Threats

Management then evaluates the institution’s Cybersecurity Maturity level for each of five
domains:
•
•
•
•
•

Cyber Risk Management and Oversight
Threat Intelligence and Collaboration
Cybersecurity Controls
External Dependency Management
Cyber Incident Management and Resilience

1

The FFIEC comprises the principals of the following: The Board of Governors of the Federal Reserve System,
Federal Deposit Insurance Corporation, National Credit Union Administration, Office of the Comptroller of the
Currency, Consumer Financial Protection Bureau, and State Liaison Committee.

2

A mapping is available in Appendix B: Mapping Cybersecurity Assessment Tool to the NIST Cybersecurity
Framework. NIST reviewed and provided input on the mapping to ensure consistency with Framework principles
and to highlight the complementary nature of the two resources.

May 2017

1

FFIEC Cybersecurity Assessment Tool

User’s Guide

By reviewing both the institution’s inherent risk profile and maturity levels across the domains,
management can determine whether its maturity levels are appropriate in relation to its risk. If
not, the institution may take action either to reduce the level of risk or to increase the levels of
maturity. This process is intended to complement, not replace, an institution’s risk management
process and cybersecurity program.

Background
The Assessment is based on the cybersecurity assessment that the FFIEC members piloted in
2014, which was designed to evaluate community institutions’ preparedness to mitigate cyber
risks. NIST defines cybersecurity as “the process of protecting information by preventing,
detecting, and responding to attacks.” As part of cybersecurity, institutions should consider
managing internal and external threats and vulnerabilities to protect infrastructure and
information assets. The definition builds on information security as defined in FFIEC guidance.
Cyber incidents can have financial, operational, legal, and reputational impact. Recent highprofile cyber attacks demonstrate that cyber incidents can significantly affect capital and
earnings. Costs may include forensic investigations, public relations campaigns, legal fees,
consumer credit monitoring, and technology changes. As such, cybersecurity needs to be
integrated throughout an institution as part of enterprise-wide governance processes, information
security, business continuity, and third-party risk management. For example, an institution’s
cybersecurity policies may be incorporated within the information security program. In addition,
cybersecurity roles and processes referred to in the Assessment may be separate roles within the
security group (or outsourced) or may be part of broader roles across the institution.

Completing the Assessment
The Assessment is designed to provide a measurable and repeatable process to assess an
institution’s level of cybersecurity risk and preparedness. Part one of this Assessment is the
Inherent Risk Profile, which identifies an institution’s inherent risk relevant to cyber risks. Part
two is the Cybersecurity Maturity, which determines an institution’s current state of
cybersecurity preparedness represented by maturity levels across five domains. For this
Assessment to be an effective risk management tool, an institution may want to complete it
periodically and as significant operational and technological changes occur.
Cyber risk programs build upon and align existing information security, business continuity, and
disaster recovery programs. The Assessment is intended to be used primarily on an enterprisewide basis and when introducing new products and services as follows:
•

•

Enterprise-wide. Management may review the Inherent Risk Profile and the declarative
statements to understand which policies, procedures, processes, and controls are in place
enterprise-wide and where gaps may exist. Following this review, management can
determine appropriate maturity levels for the institution in each domain or the target state for
Cybersecurity Maturity. Management can then develop action plans for achieving the target
state.
New products, services, or initiatives. Using the Assessment before launching a new
product, service, or initiative can help management understand how these might affect the
institution’s inherent risk profile and resulting desired maturity levels.

May 2017

2

FFIEC Cybersecurity Assessment Tool

User’s Guide

Part One: Inherent Risk Profile
Part one of the Assessment identifies the institution’s inherent risk. The Inherent Risk Profile
identifies activities, services, and products organized in the following categories:
•

•

•

•

•

Technologies and Connection Types. Certain types of connections and technologies may
pose a higher inherent risk depending on the complexity and maturity, connections, and
nature of the specific technology products or services. This category includes the number of
Internet service provider (ISP) and third-party connections, whether systems are hosted
internally or outsourced, the number of unsecured connections, the use of wireless access,
volume of network devices, end-of-life systems, extent of cloud services, and use of personal
devices.
Delivery Channels. Various delivery channels for products and services may pose a higher
inherent risk depending on the nature of the specific product or service offered. Inherent risk
increases as the variety and number of delivery channels increases. This category addresses
whether products and services are available through online and mobile delivery channels and
the extent of automated teller machine (ATM) operations.
Online/Mobile Products and Technology Services. Different products and technology
services offered by institutions may pose a higher inherent risk depending on the nature of
the specific product or service offered. This category includes various payment services, such
as debit and credit cards, person-to-person payments, originating automated clearing house
(ACH), retail wire transfers, wholesale payments, merchant remote deposit capture, treasury
services and clients and trust services, global remittances, correspondent banking, and
merchant acquiring activities. This category also includes consideration of whether the
institution provides technology services to other organizations.
Organizational Characteristics. This category considers organizational characteristics, such
as mergers and acquisitions, number of direct employees and cybersecurity contractors,
changes in security staffing, the number of users with privileged access, changes in
information technology (IT) environment, locations of business presence, and locations of
operations and data centers.
External Threats. The volume and type of attacks (attempted or successful) affect an
institution’s inherent risk exposure. This category considers the volume and sophistication of
the attacks targeting the institution.

Risk Levels
Risk Levels incorporate the type, volume, and complexity of the institution’s operations and
threats directed at the institution. Inherent risk does not include mitigating controls.

May 2017

3

FFIEC Cybersecurity Assessment Tool

User’s Guide

Select the most appropriate inherent risk level for each activity, service, or product within each
category. The levels range from Least Inherent Risk to Most Inherent Risk (Figure 1) and
incorporate a wide range of descriptions. The risk levels provide parameters for determining the
inherent risk for each category. These parameters are not intended to be rigid but rather
instructive to assist with assessing a risk level within each activity, service, or product. For
situations where the risk level falls between two levels, management should select the higher risk
level.
Figure 1: Inherent Risk Profile Layout

Risk Levels
Risk Levels

Category: Technologies and
Connection Types

Activity,
Service, or
Product

Least

Minimal

Moderate

Significant

Most

Total number of Internet service provider
(ISP) connections (including branch
connections)

No connections

Minimal complexity (1–
20 connections)

Moderate complexity
(21–100 connections)

Significant complexity
(101–200 connections)

Substantial complexity
(>200 connections)

Unsecured external connections, number
of connections not users (e.g., file transfer
protocol (FTP), Telnet, rlogin)

None

Few instances of
unsecured
connections (1–5)

Several instances of
unsecured connections
(6–10)

Significant instances of
unsecured connections
(11–25)

Substantial instances of
unsecured connections
(>25)

Wireless network access

No wireless access

Separate access
points for guest
wireless and corporate
wireless

Guest and corporate
wireless network access
are logically separated;
limited number of users
and access points (1–
250 users; 1–25 access
points)

Wireless corporate
network access;
significant number of
users and access points
(251–1,000 users; 26–
100 access points)

Wireless corporate
network access; all
employees have
access; substantial
number of access
points (>1,000 users;
>100 access points)

Determine Inherent Risk Profile
Management can determine the institution’s overall Inherent Risk Profile based on the number of
applicable statements in each risk level for all activities (Figure 2). For example, when a majority
of activities, products, or services fall within the Moderate Risk Level, management may
determine that the institution has a Moderate Inherent Risk Profile. Each category may, however,
pose a different level of inherent risk. Therefore, in addition to evaluating the number of
instances that an institution selects for a specific risk level, management may also consider
evaluating whether the specific category poses additional risk.
Figure 2: Inherent Risk Summary
Risk Levels
Least

Minimal

Moderate

Significant

Most

Least

Minimal

Moderate

Significant

Most

Number of Statements Selected in Each
Risk Level
Based on Individual Risk Levels
Selected, Assign an Inherent Risk Profile

The following includes definitions of risk levels.
•

•

•

Least Inherent Risk. An institution with a Least Inherent Risk Profile generally has very
limited use of technology. It has few computers, applications, systems, and no connections.
The variety of products and services are limited. The institution has a small geographic
footprint and few employees.
Minimal Inherent Risk. An institution with a Minimal Inherent Risk Profile generally has
limited complexity in terms of the technology it uses. It offers a limited variety of less risky
products and services. The institution’s mission-critical systems are outsourced. The
institution primarily uses established technologies. It maintains a few types of connections to
customers and third parties with limited complexity.
Moderate Inherent Risk. An institution with a Moderate Inherent Risk Profile generally
uses technology that may be somewhat complex in terms of volume and sophistication. The

May 2017

4

FFIEC Cybersecurity Assessment Tool

•

•

User’s Guide

institution may outsource mission-critical systems and applications and may support
elements internally. There is a greater variety of products and services offered through
diverse channels.
Significant Inherent Risk. An institution with a Significant Inherent Risk Profile generally
uses complex technology in terms of scope and sophistication. The institution offers highrisk products and services that may include emerging technologies. The institution may host
a significant number of applications internally. The institution allows either a large number
of personal devices or a large variety of device types. The institution maintains a substantial
number of connections to customers and third parties. A variety of payment services are
offered directly rather than through a third party and may reflect a significant level of
transaction volume.
Most Inherent Risk. An institution with a Most Inherent Risk Profile uses extremely
complex technologies to deliver myriad products and services. Many of the products and
services are at the highest level of risk, including those offered to other organizations. New
and emerging technologies are utilized across multiple delivery channels. The institution may
outsource some mission-critical systems or applications, but many are hosted internally. The
institution maintains a large number of connection types to transfer data with customers and
third parties.

Part Two: Cybersecurity Maturity
After determining the Inherent Risk Profile, the institution transitions to the Cybersecurity
Maturity part of the Assessment to determine the institution’s maturity level within each of the
following five domains:
•
•
•
•
•

Domain 1: Cyber Risk Management and Oversight
Domain 2: Threat Intelligence and Collaboration
Domain 3: Cybersecurity Controls
Domain 4: External Dependency Management
Domain 5: Cyber Incident Management and Resilience

Domains, Assessment Factors, Components, and Declarative Statements
Within each domain are assessment factors and contributing components. Under each
component, there are declarative statements describing an activity that supports the assessment
factor at that level of maturity. Table 1 provides definitions for each domain and the underlying
assessment factors.

May 2017

5

FFIEC Cybersecurity Assessment Tool

User’s Guide

Table 1: Domains and Assessment Factors Defined

Domains and Assessment Factors Defined
Domain 1
Cyber Risk Management and Oversight
Cyber risk management and oversight addresses the board of directors’ (board’s) oversight and management’s
development and implementation of an effective enterprise-wide cybersecurity program with comprehensive policies
and procedures for establishing appropriate accountability and oversight.
Assessment
Factors

Governance includes oversight, strategies, policies, and IT asset management to implement an
effective governance of the cybersecurity program.
Risk Management includes a risk management program, risk assessment process, and audit
function to effectively manage risk and assess the effectiveness of key controls.
Resources include staffing, tools, and budgeting processes to ensure the institution’s staff or
external resources have knowledge and experience commensurate with the institution’s risk profile.
Training and Culture includes the employee training and customer awareness programs
contributing to an organizational culture that emphasizes the mitigation of cybersecurity threats.

Domain 2
Threat Intelligence and Collaboration
Threat intelligence and collaboration includes processes to effectively discover, analyze, and understand cyber
threats, with the capability to share information internally and with appropriate third parties.
Assessment
Factors

Threat Intelligence refers to the acquisition and analysis of information to identify, track, and
predict cyber capabilities, intentions, and activities that offer courses of action to enhance decision
making.
Monitoring and Analyzing refers to how an institution monitors threat sources and what analysis
may be performed to identify threats that are specific to the institution or to resolve conflicts in the
different threat intelligence streams.
Information Sharing encompasses establishing relationships with peers and information-sharing
forums and how threat information is communicated to those groups as well as internal
stakeholders.

Domain 3
Cybersecurity Controls
Cybersecurity controls are the practices and processes used to protect assets, infrastructure, and information by
strengthening the institution’s defensive posture through continuous, automated protection and monitoring.
Assessment
Factors

Preventative Controls deter and prevent cyber attacks and include infrastructure management,
access management, device and end-point security, and secure coding.
Detective Controls include threat and vulnerability detection, anomalous activity detection, and
event detection, may alert the institution to network and system irregularities that indicate an
incident has or may occur.
Corrective Controls are utilized to resolve system and software vulnerabilities through patch
management and remediation of issues identified during vulnerability scans and penetration testing.

Domain 4
External Dependency Management
External dependency management involves establishing and maintaining a comprehensive program to oversee and
manage external connections and third-party relationships with access to the institution’s technology assets and
information.
Assessment
Factors

Connections incorporate the identification, monitoring, and management of external connections
and data flows to third parties.
Relationship Management includes due diligence, contracts, and ongoing monitoring to help
ensure controls complement the institution’s cybersecurity program.

May 2017

6

FFIEC Cybersecurity Assessment Tool

User’s Guide

Domain 5
Cyber Incident Management and Resilience
Cyber incident management includes establishing, identifying, and analyzing cyber events; prioritizing the
institution’s containment or mitigation; and escalating information to appropriate stakeholders. Cyber resilience
encompasses both planning and testing to maintain and recover ongoing operations during and following a cyber
incident.
Assessment
Factors

Incident Resilience Planning & Strategy incorporates resilience planning and testing into existing
business continuity and disaster recovery plans to minimize service disruptions and the destruction
or corruption of data.
Detection, Response, & Mitigation refers to the steps management takes to identify, prioritize,
respond to, and mitigate the effects of internal and external threats and vulnerabilities.
Escalation & Reporting ensures key stakeholders are informed about the impact of cyber
incidents, and regulators, law enforcement, and customers are notified as required.
Figure 3: Cybersecurity Maturity Levels

Each maturity level includes a set of declarative
statements that describe how the behaviors,
practices, and processes of an institution can
consistently produce the desired outcomes.
The Assessment starts at the Baseline maturity
level and progresses to the highest maturity, the
Innovative level (Figure 3). Table 2 provides
definitions for each of the maturity levels, which
are cumulative.

Innovative
Advanced
Intermediate
Evolving

Baseline

Table 2: Maturity Levels Defined
Maturity Levels Defined
Baseline

Baseline maturity is characterized by minimum expectations required by law and regulations or
recommended in supervisory guidance. This level includes compliance-driven objectives.
Management has reviewed and evaluated guidance.

Evolving

Evolving maturity is characterized by additional formality of documented procedures and policies
that are not already required. Risk-driven objectives are in place. Accountability for cybersecurity is
formally assigned and broadened beyond protection of customer information to incorporate
information assets and systems.

Intermediate

Intermediate maturity is characterized by detailed, formal processes. Controls are validated and
consistent. Risk-management practices and analysis are integrated into business strategies.

Advanced

Advanced maturity is characterized by cybersecurity practices and analytics that are integrated
across lines of business. Majority of risk-management processes are automated and include
continuous process improvement. Accountability for risk decisions by frontline businesses is
formally assigned.

Innovative

Innovative maturity is characterized by driving innovation in people, processes, and technology for
the institution and the industry to manage cyber risks. This may entail developing new controls, new
tools, or creating new information-sharing groups. Real-time, predictive analytics are tied to
automated responses.

May 2017

7

FFIEC Cybersecurity Assessment Tool

User’s Guide

Completing the Cybersecurity Maturity
Each domain and maturity level has a set of declarative statements organized by assessment
factor. To assist the institution’s ability to follow common themes across maturity levels,
statements are categorized by components. The components are groups of similar declarative
statements to make the Assessment easier to use (Figure 4).
Figure 4: Cybersecurity Maturity
Domain
Domain 1: Cyber Risk Management and Oversight

Maturity
Level

Assessment Factor: Governance

OVERSIGHT

Y, Y(C), N
Baseline

Assessment
Factor

Designated members of management are held accountable by the board or an appropriate board committee for implementing
and managing the information security and business continuity programs. (FFIEC Information Security Booklet, page 3)
Information security risks are discussed in management meetings when prompted by highly visible cyber events or regulatory
alerts. (FFIEC Information Security Booklet, page 6)

Management provides a written report on the overall status of the information security and business continuity programs to the
board or an appropriate board committee at least annually. (FFIEC Information Security Booklet, page 5)
The budgeting process includes information security related expenses and tools. (FFIEC E-Banking Booklet, page 20)
Management considers the risks posed by other critical infrastructures (e.g., telecommunications, energy) to the institution.
(FFIEC Business Continuity Planning Booklet, page J-12)
Evolving

At least annually, the board or an appropriate board committee reviews and approves the institution’s cybersecurity program.

Declarative
Statement

Management is responsible for ensuring compliance with legal and regulatory requirements related to cybersecurity.

Component

Cybersecurity tools and staff are requested through the budget process.
There is a process to formally discuss and estimate potential expenses associated with cybersecurity incidents as part of the
budgeting process.

Management determines which declarative statements best fit the current practices of the
institution. All declarative statements in each maturity level, and previous levels, must be
attained and sustained to achieve that domain’s maturity level. Attained and sustained requires
affirmative answers to either “Yes” or “Yes with Compensating Controls” 3 for each of the
declarative questions within a maturity level. While management can determine the institution’s
maturity level in each domain, the Assessment is not designed to identify an overall
cybersecurity maturity level.
Management may determine that a declarative statement has been sufficiently sustained based on
proven results. Certain declarative statements may not apply to all institutions if the product,
service, or technology is not offered or used. Declarative statements that may not be applicable
to all institutions are clearly designated and would not affect the determination of the specific
maturity level.

Interpreting and Analyzing Assessment Results
Management can review the institution’s Inherent Risk Profile in relation to its Cybersecurity
Maturity results for each domain to understand whether they are aligned.
Table 3 depicts the relationship between an institution’s Inherent Risk Profile and its domain
Maturity Levels, as there is no single expected level for an institution. In general, as inherent risk
3

Compensating control - A management, operational, and/or technical control (e.g., safeguard or countermeasure)
employed by an organization in lieu of a recommended security control in the low, moderate, or high baselines
that provides equivalent or comparable protection for an information system.

May 2017

8

FFIEC Cybersecurity Assessment Tool

User’s Guide

rises, an institution’s maturity levels should increase. An institution’s inherent risk profile and
maturity levels will change over time as threats, vulnerabilities, and operational environments
change. Thus, management should consider reevaluating its inherent risk profile and
cybersecurity maturity periodically and when planned changes can affect its inherent risk profile
(e.g., launching new products or services, new connections).
Table 3: Risk/Maturity Relationship
Inherent Risk Levels

Cybersecurity Maturity Level for Each
Domain

Least

Minimal

Moderate

Significant

Most

Innovative

Advanced

Intermediate

Evolving

Baseline

If management determines that the institution’s maturity levels are not appropriate in relation to
the inherent risk profile, management should consider reducing inherent risk or developing a
strategy to improve the maturity levels. This process includes
•
•
•
•
•
•

determining target maturity levels.
conducting a gap analysis.
prioritizing and planning actions.
implementing changes.
reevaluating over time.
communicating the results.

Management can set target maturity levels for each domain or across domains based on the
institution’s business objectives and risk appetite. Management can conduct a gap analysis
between the current and target maturity levels and initiate improvements based on the gaps. Each
declarative statement can represent a range of strategies and processes that have enterprise-wide
impact. For example, declarative statements not yet attained provide insights for policies,
processes, procedures, and controls that may improve risk management in relation to a specific
risk or the institution’s overall cybersecurity preparedness.
Using the maturity levels in each domain, management can identify potential actions that would
increase the institution’s overall cybersecurity preparedness. Management can review declarative
statements at maturity levels beyond what the institution has achieved to determine the actions
needed to reach the next level and implement changes to address gaps. Management’s periodic

May 2017

9

FFIEC Cybersecurity Assessment Tool

User’s Guide

reevaluations of the inherent risk profile and maturity levels may further assist the institution in
maintaining an appropriate level of cybersecurity preparedness. In addition, management may
also seek an independent validation, such as by the internal audit function, of the institution’s
Assessment process and findings.
The Assessment results should be communicated to the chief executive officer (CEO) and board.
More information and questions to consider are contained in the “Overview for Chief Executive
Officers and Boards of Directors.”

Resources
In addition to the “Overview for Chief Executive Officers and Boards of Directors,” the FFIEC
has released the following documents to assist institutions with the Cybersecurity Assessment
Tool.
•
•
•

Appendix A: Mapping Baseline Statements to FFIEC IT Examination Handbook
Appendix B: Mapping Cybersecurity Assessment Tool to NIST Cybersecurity Framework
Appendix C: Glossary

May 2017

10

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile

Inherent Risk Profile
Risk Levels
Category: Technologies and
Connection Types

Least

Minimal

Moderate

Significant

Most

Total number of Internet service
provider (ISP) connections (including
branch connections)

No connections

Minimal complexity
(1–20 connections)

Moderate complexity Significant
(21–100 connections) complexity (101–200
connections)

Substantial complexity
(>200 connections)

Unsecured external connections,
number of connections not users
(e.g., file transfer protocol (FTP),
Telnet, rlogin)

None

Few instances of
unsecured
connections (1–5)

Several instances of
unsecured
connections (6–10)

Significant instances
of unsecured
connections (11–25)

Substantial instances of
unsecured connections
(>25)

Wireless network access

No wireless access

Separate access
points for guest
wireless and
corporate wireless

Guest and corporate
wireless network
access are logically
separated; limited
number of users and
access points (1–250
users; 1–25 access
points)

Wireless corporate
network access;
significant number of
users and access
points (251–1,000
users; 26–100
access points)

Wireless corporate
network access; all
employees have access;
substantial number of
access points (>1,000
users; >100 access
points)

Personal devices allowed to connect
to the corporate network

None

Only one device type
available; available
to <5% of employees
(staff, executives,
managers); e-mail
access only

Multiple device types
used; available to
<10% of employees
(staff, executives,
managers) and
board; e-mail access
only

Multiple device types
used; available to
<25% of authorized
employees (staff,
executives,
managers) and
board; e-mail and
some applications
accessed

Any device type used;
available to >25% of
employees (staff,
executives, managers)
and board; all
applications accessed

Third parties, including number of
organizations and number of
individuals from vendors and
subcontractors, with access to
internal systems (e.g., virtual private
network, modem, intranet, direct
connection)

No third parties and
no individuals from
third parties with
access to systems

Limited number of
third parties (1–5)
and limited number
of individuals from
third parties (<50)
with access; low
complexity in how
they access systems

Moderate number of
third parties (6–10)
and moderate
number of individuals
from third parties
(50–500) with
access; some
complexity in how
they access systems

Significant number of
third parties (11–25)
and significant
number of individuals
from third parties
(501–1,500) with
access; high level of
complexity in terms
of how they access
systems

Substantial number of
third parties (>25) and
substantial number of
individuals from third
parties (>1,500) with
access; high complexity
in how they access
systems

April 2017

11

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Technologies and
Connection Types

Least

Minimal

Moderate

Significant

Most

Wholesale customers with dedicated
connections

None

Few dedicated
connections
(between 1–5)

Several dedicated
connections
(between 6–10)

Significant number of
dedicated
connections
(between 11–25)

Substantial number of
dedicated connections
(>25)

Internally hosted and developed or
modified vendor applications
supporting critical activities

No applications

Few applications
(between 1–5)

Several applications
(between 6–10)

Significant number of
applications
(between 11–25)

Substantial number of
applications and
complexity (>25)

Internally hosted, vendor-developed
applications supporting critical
activities

Limited applications
(0–5)

Few applications (6–
30)

Several applications
(31–75)

Significant number of
applications (76–200)

Substantial number of
applications and
complexity (>200)

User-developed technologies and
user computing that support critical
activities (includes Microsoft Excel
spreadsheets and Access databases
or other user-developed tools)

No user-developed
technologies

1–100 technologies

101–500
technologies

501–2,500
technologies

>2,500 technologies

End-of-life (EOL) systems

No systems
(hardware or
software) that are
past EOL or at risk of
nearing EOL within 2
years

Few systems that are
at risk of EOL and
none that support
critical operations

Several systems that
will reach EOL within
2 years and some
that support critical
operations

A large number of
systems that support
critical operations at
EOL or are at risk of
reaching EOL in 2
years

Majority of critical
operations dependent
on systems that have
reached EOL or will
reach EOL within the
next 2 years or an
unknown number of
systems that have
reached EOL

Open Source Software (OSS)

No OSS

Limited OSS and
none that support
critical operations

Several OSS that
support critical
operations

Large number of
OSS that support
critical operations

Majority of operations
dependent on OSS

Network devices (e.g., servers,
routers, and firewalls; include
physical and virtual)

Limited or no network
devices (<250)

Few devices (250–
1,500)

Several devices
(1,501–25,000)

Significant number of
devices (25,001–
50,000)

Substantial number of
devices (>50,000)

Third-party service providers storing
and/or processing information that
support critical activities (Do not have
access to internal systems, but the
institution relies on their services)

No third parties that
support critical
activities

1–25 third parties
that support critical
activities

26–100 third parties
that support critical
activities

101–200 third parties
that support critical
activities; 1 or more
are foreign-based

>200 third parties that
support critical activities;
1 or more are foreignbased

April 2017

12

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Technologies and
Connection Types
Cloud computing services hosted
externally to support critical activities

Least
No cloud providers

Minimal
Few cloud providers;
private cloud only (1–
3)

Moderate
Several cloud
providers (4–7)

Significant

Most

Significant number of
cloud providers (8–
10); cloud-provider
locations used
include international;
use of public cloud

Substantial number of
cloud providers (>10);
cloud-provider locations
used include
international; use of
public cloud

Significant

Most

Risk Levels
Category: Delivery Channels

Least

Minimal

Moderate

Online presence (customer)

No Web-facing
applications or social
media presence

Serves as an
informational Web
site or social media
page (e.g., provides
branch and ATM
locations and
marketing materials)

Serves as a delivery
channel for retail
online banking; may
communicate to
customers through
social media

Serves as a delivery
channel for
wholesale
customers; may
include retail account
origination

Internet applications
serve as a channel to
wholesale customers to
manage large value
assets

Mobile presence

None

SMS text alerts or
notices only;
browser-based
access

Mobile banking
application for retail
customers (e.g., bill
payment, mobile
check capture,
internal transfers
only)

Mobile banking
application includes
external transfers
(e.g., for corporate
clients, recurring
external transactions)

Full functionality,
including originating new
transactions (e.g., ACH,
wire)

Automated Teller Machines (ATM)
(Operation)

No ATM services

ATM services offered
but no owned
machines

ATM services
managed by a third
party; ATMs at local
and regional
branches; cash
reload services
outsourced

ATM services
managed internally;
ATMs at U.S.
branches and retail
locations; cash
reload services
outsourced

ATM services managed
internally; ATM services
provided to other
financial institutions;
ATMs at domestic and
international branches
and retail locations;
cash reload services
managed internally

April 2017

13

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Online/Mobile Products
and Technology Services

Least

Minimal

Moderate

Issue debit or credit cards

Do not issue debit or
credit cards

Issue debit and/or
credit cards through
a third party; <10,000
cards outstanding

Issue debit or credit
cards through a third
party; between
10,000–50,000 cards
outstanding

Issue debit or credit
cards directly;
between 50,000–
100,000 cards
outstanding

Issue debit or credit
cards directly; >100,000
cards outstanding; issue
cards on behalf of other
financial institutions

Prepaid cards

Do not issue prepaid
cards

Issue prepaid cards
through a third party;
<5,000 cards
outstanding

Issue prepaid cards
through a third party;
5,000–10,000 cards
outstanding

Issue prepaid cards
through a third party;
10,001–20,000 cards
outstanding

Issue prepaid cards
internally, through a
third party, or on behalf
of other financial
institutions; >20,000
cards outstanding

Emerging payments technologies
(e.g., digital wallets, mobile wallets)

Do not accept or use
emerging payments
technologies

Indirect acceptance
or use of emerging
payments
technologies
(customer use may
affect deposit or
credit account)

Direct acceptance or
use of emerging
payments
technologies; partner
or co-brand with nonbank providers;
limited transaction
volume

Direct acceptance or
use of emerging
payments
technologies; small
transaction volume;
no foreign payments

Direct acceptance of
emerging payments
technologies; moderate
transaction volume
and/or foreign payments

Person-to-person payments (P2P)

Not offered

Customers allowed
to originate
payments; used by
<1,000 customers or
monthly transaction
volume is <50,000

Customers allowed to
originate payments;
used by 1,000–5,000
customers or monthly
transaction volume is
between 50,000–
100,000

Customers allowed
to originate
payments; used by
5,001–10,000
customers or monthly
transaction volume is
between 100,001–
1 million

Customers allowed to
request payment or to
originate payment; used
by >10,000 customers
or monthly transaction
volume >1 million

Originating ACH payments

No ACH origination

Originate ACH
credits; daily volume
<3% of total assets

Originate ACH debits
and credits; daily
volume is 3%–5% of
total assets

Sponsor third-party
payment processor;
originate ACH debits
and credits with daily
volume 6%–25% of
total assets

Sponsor nested thirdparty payment
processors; originate
debits and credits with
daily volume that is
>25% of total assets

Daily originated
wholesale payment
volume <3% of total
assets

Daily originated
wholesale payment
volume 3%–5% of
total assets

Daily originated
wholesale payment
volume 6%–25% of
total assets

Daily originated
wholesale payment
volume >25% of total
assets

Originating wholesale payments (e.g., Do not originate
wholesale payments
CHIPS)

April 2017

Significant

Most

14

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Online/Mobile Products
and Technology Services

Least

Minimal

Moderate

Significant

Most

Wire transfers

Not offered

In person wire
requests only;
domestic wires only;
daily wire volume
<3% of total assets

In person, phone,
and fax wire
requests; domestic
daily wire volume
3%–5% of total
assets; international
daily wire volume
<3% of total assets

Multiple request
channels (e.g.,
online, text, e-mail,
fax, and phone); daily
domestic wire
volume 6%–25% of
total assets; daily
international wire
volume 3%–10% of
total assets

Multiple request
channels (e.g., online,
text, e-mail, fax, and
phone); daily domestic
wire volume >25% of
total assets; daily
international wire
volume >10% of total
assets

Merchant remote deposit capture
(RDC)

Do not offer Merchant <100 merchant
RDC
clients; daily volume
of transactions is
<3% of total assets

100–500 merchant
clients; daily volume
of transactions is
3%–5% of total
assets

501–1,000 merchant
clients; daily volume
of transactions is
6%–25% of total
assets

>1,000 merchant clients;
daily volume of
transactions is >25% of
total assets

Global remittances

Do not offer global
remittances

Gross daily
transaction volume is
<3% of total assets

Gross daily
transaction volume is
3%–5% of total
assets

Gross daily
transaction volume is
6%–25% of total
assets

Gross daily transaction
volume is >25% of total
assets

Treasury services and clients

No treasury
management
services are offered

Limited services
offered; number of
clients is <1,000

Services offered
include lockbox, ACH
origination, and
remote deposit
capture; number of
clients is between
1,000–10,000

Services offered
include accounts
receivable solutions
and liquidity
management;
number of clients is
between 10,001–
20,000

Multiple services offered
including currency
services, online
investing, and
investment sweep
accounts; number of
clients is >20,000

Trust services

Trust services are not
offered

Trust services are
offered through a
third-party provider;
assets under
management total
<$500 million

Trust services
provided directly;
portfolio of assets
under management
total $500 million–
$999 million

Trust services
provided directly;
assets under
management total
$1 billion–$10 billion

Trust services provided
directly; assets under
management total
>$10 billion

Act as a correspondent bank
(Interbank transfers)

Do not act as a
correspondent bank

Act as a
correspondent bank
for <100 institutions

Act as a
correspondent bank
for 100–250
institutions

Act as a
correspondent bank
for 251–500
institutions

Act as a correspondent
bank for >500
institutions

April 2017

15

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Online/Mobile Products
and Technology Services

Least

Minimal

Moderate

Significant

Most

Merchant acquirer (sponsor
merchants or card processor activity
into the payment system)

Do not act as a
merchant acquirer

Act as a merchant
acquirer; <1,000
merchants

Act as a merchant
acquirer; outsource
card payment
processing; 1,000–
10,000 merchants

Act as a merchant
acquirer and card
payment processor;
10,001–100,000
merchants

Act as a merchant
acquirer and card
payment processor;
>100,000 merchants

Host IT services for other
organizations (either through joint
systems or administrative support)

Do not provide IT
services for other
organizations

Host or provide IT
services for affiliated
organizations

Host or provide IT
services for up to 25
unaffiliated
organizations

Host or provide IT
services for 26–50
unaffiliated
organizations

Host or provide IT
services for >50
unaffiliated
organizations

Risk Levels
Category: Organizational
Characteristics

Least

Minimal

Moderate

Significant

Most

Mergers and acquisitions (including
divestitures and joint ventures)

None planned

Open to initiating
discussions or
actively seeking a
merger or acquisition

In discussions with
at least 1 party

A sale or acquisition
has been publicly
announced within the
past year, in
negotiations with 1 or
more parties

Multiple ongoing
integrations of
acquisitions are in
process

Direct employees (including
information technology and
cybersecurity contractors)

Number of
employees totals <50

Number of
employees totals 50–
2,000

Number of
employees totals
2,001–10,000

Number of employees
totals 10,001–50,000

Number of employees is
>50,000

Changes in IT and information
security staffing

Key positions filled;
low or no turnover of
personnel

Staff vacancies exist
for non-critical roles

Some turnover in
key or senior
positions

Frequent turnover in
key staff or senior
positions

Vacancies in senior or
key positions for long
periods; high level of
employee turnover in IT
or information security

Privileged access (Administrators–
network, database, applications,
systems, etc.)

Limited number of
administrators;
limited or no external
administrators

Level of turnover in
administrators does
not affect operations
or activities; may
utilize some external
administrators

Level of turnover in
administrators
affects operations;
number of
administrators for
individual systems or
applications exceeds
what is necessary

High reliance on
external
administrators;
number of
administrators is not
sufficient to support
level or pace of
change

High employee turnover
in network
administrators; many or
most administrators are
external (contractors or
vendors); experience in
network administration
is limited

April 2017

16

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Category: Organizational
Characteristics

Least

Minimal

Moderate

Significant

Most

Changes in IT environment (e.g.,
network, infrastructure, critical
applications, technologies supporting
new products or services)

Stable IT
environment

Infrequent or minimal
changes in the IT
environment

Frequent adoption of
new technologies

Volume of significant
changes is high

Substantial change in
outsourced provider(s)
of critical IT services;
large and complex
changes to the
environment occur
frequently

Locations of branches/business
presence

1 state

1 region

1 country

1–20 countries

>20 countries

Locations of operations/data centers

1 state

1 region

1 country

1–10 countries

>10 countries

Risk Levels
Category: External Threats
Attempted cyber attacks

April 2017

Least

Minimal

Moderate

Significant

Most

No attempted attacks
or reconnaissance

Few attempts
monthly (<100); may
have had generic
phishing campaigns
received by
employees and
customers

Several attempts
monthly (100– 500);
phishing campaigns
targeting employees
or customers at the
institution or third
parties supporting
critical activities; may
have experienced an
attempted Distributed
Denial of Service
(DDoS) attack within
the last year

Significant number of
attempts monthly
(501–100,000); spear
phishing campaigns
targeting high net
worth customers and
employees at the
institution or third
parties supporting
critical activities;
Institution specifically
is named in threat
reports; may have
experienced multiple
attempted DDoS
attacks within the last
year

Substantial number of
attempts monthly
(>100,000); persistent
attempts to attack senior
management and/or
network administrators;
frequently targeted for
DDoS attacks

17

FFIEC Cybersecurity Assessment Tool

Inherent Risk Profile
Risk Levels

Total

Least

Minimal

Moderate

Significant

Most

Least

Minimal

Moderate

Significant

Most

Number of Statements Selected in
Each Risk Level
Based on Individual Risk Levels
Selected, Assign an Inherent Risk
Profile

April 2017

18

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 1

Cybersecurity Maturity
Domain 1: Cyber Risk Management and Oversight
Assessment Factor: Governance

OVERSIGHT

Y, Y(C), N
Baseline

Designated members of management are held accountable by the board or
an appropriate board committee for implementing and managing the
information security and business continuity programs. (FFIEC Information
Security Booklet, page 3)
Information security risks are discussed in management meetings when
prompted by highly visible cyber events or regulatory alerts. (FFIEC
Information Security Booklet, page 6)
Management provides a written report on the overall status of the
information security and business continuity programs to the board or an
appropriate board committee at least annually. (FFIEC Information Security
Booklet, page 5)
The budgeting process includes information security related expenses and
tools. (FFIEC E-Banking Booklet, page 20)
Management considers the risks posed by other critical infrastructures (e.g.,
telecommunications, energy) to the institution. (FFIEC Business Continuity
Planning Booklet, page J-12)

Evolving

At least annually, the board or an appropriate board committee reviews and
approves the institution’s cybersecurity program.
Management is responsible for ensuring compliance with legal and
regulatory requirements related to cybersecurity.
Cybersecurity tools and staff are requested through the budget process.
There is a process to formally discuss and estimate potential expenses
associated with cybersecurity incidents as part of the budgeting process.

Intermediate

The board or an appropriate board committee has cybersecurity expertise
or engages experts to assist with oversight responsibilities.
The standard board meeting package includes reports and metrics that go
beyond events and incidents to address threat intelligence trends and the
institution’s security posture.
The institution has a cyber risk appetite statement approved by the board or
an appropriate board committee.
Cyber risks that exceed the risk appetite are escalated to management.
The board or an appropriate board committee ensures management’s

April 2017

19

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 1

annual cybersecurity self-assessment evaluates the institution’s ability to
meet its cyber risk management standards.
The board or an appropriate board committee reviews and approves
management’s prioritization and resource allocation decisions based on the
results of the cyber assessments.
The board or an appropriate board committee ensures management takes
appropriate actions to address changing cyber risks or significant
cybersecurity issues.
The budget process for requesting additional cybersecurity staff and tools is
integrated into business units’ budget processes.
Advanced

The board or board committee approved cyber risk appetite statement is
part of the enterprise-wide risk appetite statement.
Management has a formal process to continuously improve cybersecurity
oversight.
The budget process for requesting additional cybersecurity staff and tools
maps current resources and tools to the cybersecurity strategy.
Management and the board or an appropriate board committee hold
business units accountable for effectively managing all cyber risks
associated with their activities.
Management identifies root cause(s) when cyber attacks result in material
loss.
The board or an appropriate board committee ensures that management’s
actions consider the cyber risks that the institution poses to the financial
sector.

Innovative

The board or an appropriate board committee discusses ways for
management to develop cybersecurity improvements that may be adopted
sector-wide.
The board or an appropriate board committee verifies that management’s
actions consider the cyber risks that the institution poses to other critical
infrastructures (e.g., telecommunications, energy).

April 2017

20

STRATEGY/ POLICIES

FFIEC Cybersecurity Assessment Tool
Baseline

Cybersecurity Maturity: Domain 1

The institution has an information security strategy that integrates
technology, policies, procedures, and training to mitigate risk. (FFIEC
Information Security Booklet, page 3)
The institution has policies commensurate with its risk and complexity that
address the concepts of information technology risk management. (FFIEC
Information Security Booklet, page, 16)
The institution has policies commensurate with its risk and complexity that
address the concepts of threat information sharing. (FFIEC E-Banking
Booklet, page 28)
The institution has board-approved policies commensurate with its risk and
complexity that address information security. (FFIEC Information Security
Booklet, page 16)
The institution has policies commensurate with its risk and complexity that
address the concepts of external dependency or third-party management.
(FFIEC Outsourcing Booklet, page 2)
The institution has policies commensurate with its risk and complexity that
address the concepts of incident response and resilience. (FFIEC
Information Security Booklet, page 83)
All elements of the information security program are coordinated enterprisewide. (FFIEC Information Security Booklet, page 7)

Evolving

The institution augmented its information security strategy to incorporate
cybersecurity and resilience.
The institution has a formal cybersecurity program that is based on
technology and security industry standards or benchmarks.
A formal process is in place to update policies as the institution’s inherent
risk profile changes.

Intermediate

The institution has a comprehensive set of policies commensurate with its
risk and complexity that address the concepts of threat intelligence.
Management periodically reviews the cybersecurity strategy to address
evolving cyber threats and changes to the institution’s inherent risk profile.
The cybersecurity strategy is incorporated into, or conceptually fits within,
the institution’s enterprise-wide risk management strategy.
Management links strategic cybersecurity objectives to tactical goals.
A formal process is in place to cross-reference and simultaneously update
all policies related to cyber risks across business lines.

April 2017

21

FFIEC Cybersecurity Assessment Tool
Advanced

Cybersecurity Maturity: Domain 1

The cybersecurity strategy outlines the institution’s future state of
cybersecurity with short-term and long-term perspectives.
Industry-recognized cybersecurity standards are used as sources during
the analysis of cybersecurity program gaps.
The cybersecurity strategy identifies and communicates the institution’s role
as a component of critical infrastructure in the financial services industry.
The risk appetite is informed by the institution’s role in critical infrastructure.

IT ASSET MANAGEMENT

Management is continuously improving the existing cybersecurity program
to adapt as the desired cybersecurity target state changes.
Innovative

The cybersecurity strategy identifies and communicates the institution’s role
as it relates to other critical infrastructures.

Baseline

An inventory of organizational assets (e.g., hardware, software, data, and
systems hosted externally) is maintained. (FFIEC Information Security
Booklet, page 9)
Organizational assets (e.g., hardware, systems, data, and applications) are
prioritized for protection based on the data classification and business
value. (FFIEC Information Security Booklet, page 12)
Management assigns accountability for maintaining an inventory of
organizational assets. (FFIEC Information Security Booklet, page 9)
A change management process is in place to request and approve changes
to systems configurations, hardware, software, applications, and security
tools. (FFIEC Information Security Booklet, page 56)

Evolving

The asset inventory, including identification of critical assets, is updated at
least annually to address new, relocated, re-purposed, and sunset assets.
The institution has a documented asset life-cycle process that considers
whether assets to be acquired have appropriate security safeguards.
The institution proactively manages system EOL (e.g., replacement) to limit
security risks.
Changes are formally approved by an individual or committee with
appropriate authority and with separation of duties.

Intermediate

Baseline configurations cannot be altered without a formal change request,
documented approval, and an assessment of security implications.
A formal IT change management process requires cybersecurity risk to be
evaluated during the analysis, approval, testing, and reporting of changes.

April 2017

22

FFIEC Cybersecurity Assessment Tool
Advanced

Cybersecurity Maturity: Domain 1

Supply chain risk is reviewed before the acquisition of mission-critical
information systems including system components.
Automated tools enable tracking, updating, asset prioritizing, and custom
reporting of the asset inventory.
Automated processes are in place to detect and block unauthorized
changes to software and hardware.
The change management system uses thresholds to determine when a risk
assessment of the impact of the change is required.

Innovative

A formal change management function governs decentralized or highly
distributed change requests and identifies and measures security risks that
may cause increased exposure to cyber attack.
Comprehensive automated enterprise tools are implemented to detect and
block unauthorized changes to software and hardware.

RISK MANAGEMENT PROGRAM

Assessment Factor: Risk Management
Baseline

An information security and business continuity risk management
function(s) exists within the institution. (FFIEC Information Security Booklet,
page 68)

Evolving

The risk management program incorporates cyber risk identification,
measurement, mitigation, monitoring, and reporting.
Management reviews and uses the results of audits to improve existing
cybersecurity policies, procedures, and controls.
Management monitors moderate and high residual risk issues from the
cybersecurity risk assessment until items are addressed.

Intermediate

The cybersecurity function has a clear reporting line that does not present a
conflict of interest.
The risk management program specifically addresses cyber risks beyond
the boundaries of the technological impacts (e.g., financial, strategic,
regulatory, compliance).
Benchmarks or target performance metrics have been established for
showing improvements or regressions of the security posture over time.
Management uses the results of independent audits and reviews to improve
cybersecurity.
There is a process to analyze and assign potential losses and related
expenses, by cost center, associated with cybersecurity incidents.

April 2017

23

FFIEC Cybersecurity Assessment Tool
Advanced

Cybersecurity Maturity: Domain 1

Cybersecurity metrics are used to facilitate strategic decision-making and
funding in areas of need.
Independent risk management sets and monitors cyber-related risk limits
for business units.
Independent risk management staff escalates to management and the
board or an appropriate board committee significant discrepancies from
business unit’s assessments of cyber-related risk.
A process is in place to analyze the financial impact cyber incidents have
on the institution’s capital.
The cyber risk data aggregation and real-time reporting capabilities support
the institution’s ongoing reporting needs, particularly during cyber incidents.

Innovative

The risk management function identifies and analyzes commonalities in
cyber events that occur both at the institution and across other sectors to
enable more predictive risk management.

RISK ASSESSMENT

A process is in place to analyze the financial impact that a cyber incident at
the institution may have across the financial sector.
Baseline

A risk assessment focused on safeguarding customer information
identifies reasonable and foreseeable internal and external threats, the
likelihood and potential damage of threats, and the sufficiency of policies,
procedures, and customer information systems. (FFIEC Information
Security Booklet, page 8)
The risk assessment identifies internet-based systems and high-risk
transactions that warrant additional authentication controls. (FFIEC
Information Security Booklet, page 12)
The risk assessment is updated to address new technologies, products,
services, and connections before deployment. (FFIEC Information Security
Booklet, page 13)

Evolving

Risk assessments are used to identify the cybersecurity risks stemming
from new products, services, or relationships.
The focus of the risk assessment has expanded beyond customer
information to address all information assets.
The risk assessment considers the risk of using EOL software and
hardware components.

Intermediate

April 2017

The risk assessment is adjusted to consider widely known risks or risk
management practices.

24

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 1

Advanced

An enterprise-wide risk management function incorporates cyber threat
analysis and specific risk exposure as part of the enterprise risk
assessment.

Innovative

The risk assessment is updated in real time as changes to the risk profile
occur, new applicable standards are released or updated, and new
exposures are anticipated.
The institution uses information from risk assessments to predict threats
and drive real-time responses.

AUDIT

Advanced or automated analytics offer predictive information and real-time
risk metrics.
Baseline

Independent audit or review evaluates policies, procedures, and controls
across the institution for significant risks and control issues associated with
the institution's operations, including risks in new products, emerging
technologies, and information systems. (FFIEC Audit Booklet, page 4)
The independent audit function validates controls related to the storage or
transmission of confidential data. (FFIEC Audit Booklet, page 1)
Logging practices are independently reviewed periodically to ensure
appropriate log management (e.g., access controls, retention, and
maintenance). (FFIEC Operations Booklet, page 29)
Issues and corrective actions from internal audits and independent
testing/assessments are formally tracked to ensure procedures and control
lapses are resolved in a timely manner. (FFIEC Information Security
Booklet, page 6)

Evolving

The independent audit function validates that the risk management
function is commensurate with the institution’s risk and complexity.
The independent audit function validates that the institution’s threat
information sharing is commensurate with the institution’s risk and
complexity.
The independent audit function validates that the institution’s cybersecurity
controls function is commensurate with the institution’s risk and
complexity.
The independent audit function validates that the institution’s third-party
relationship management is commensurate with the institution’s risk and
complexity.
The independent audit function validates that the institution’s incident
response program and resilience are commensurate with the institution’s
risk and complexity.

April 2017

25

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 1

A formal process is in place for the independent audit function to update its
procedures based on changes to the institution’s inherent risk profile.
The independent audit function validates that the institution’s threat
intelligence and collaboration are commensurate with the institution’s risk
and complexity.
The independent audit function regularly reviews management’s cyber risk
appetite statement.
Independent audits or reviews are used to identify gaps in existing security
capabilities and expertise.

Advanced

A formal process is in place for the independent audit function to update its
procedures based on changes to the evolving threat landscape across the
sector.
The independent audit function regularly reviews the institution’s cyber risk
appetite statement in comparison to assessment results and incorporates
gaps into the audit strategy.
Independent audits or reviews are used to identify cybersecurity
weaknesses, root causes, and the potential impact to business units.

Innovative

A formal process is in place for the independent audit function to update its
procedures based on changes to the evolving threat landscape across
other sectors the institution depends upon.
The independent audit function uses sophisticated data mining tools to
perform continuous monitoring of cybersecurity processes or controls.

STAFFING

Assessment Factor: Resources
Baseline

Information security roles and responsibilities have been identified. (FFIEC
Information Security Booklet, page 7)
Processes are in place to identify additional expertise needed to improve
information security defenses. (FFIEC Information Security Work Program,
Objective I: 2-8)

April 2017

26

FFIEC Cybersecurity Assessment Tool
Evolving

Cybersecurity Maturity: Domain 1

A formal process is used to identify cybersecurity tools and expertise that
may be needed.
Management with appropriate knowledge and experience leads the
institution's cybersecurity efforts.
Staff with cybersecurity responsibilities have the requisite qualifications to
perform the necessary tasks of the position.
Employment candidates, contractors, and third parties are subject to
background verification proportional to the confidentiality of the data
accessed, business requirements, and acceptable risk.

Intermediate

The institution has a program for talent recruitment, retention, and
succession planning for the cybersecurity and resilience staffs.

Advanced

The institution benchmarks its cybersecurity staffing against peers to
identify whether its recruitment, retention, and succession planning are
commensurate.
Dedicated cybersecurity staff develops, or contributes to developing,
integrated enterprise-level security and cyber defense strategies.

Innovative

The institution actively partners with industry associations and academia to
inform curricula based on future cybersecurity staffing needs of the
industry.

TRAINING

Assessment Factor: Training and Culture
Baseline

Annual information security training is provided. (FFIEC Information
Security Booklet, page 66)
Annual information security training includes incident response, current
cyber threats (e.g., phishing, spear phishing, social engineering, and
mobile security), and emerging issues. (FFIEC Information Security
Booklet, page 66)
Situational awareness materials are made available to employees when
prompted by highly visible cyber events or by regulatory alerts. (FFIEC
Information Security Booklet, page 7)
Customer awareness materials are readily available (e.g., DHS’
Cybersecurity Awareness Month materials). (FFIEC E-Banking Work
Program, Objective 6-3)

April 2017

27

FFIEC Cybersecurity Assessment Tool
Evolving

Cybersecurity Maturity: Domain 1

The institution has a program for continuing cybersecurity training and skill
development for cybersecurity staff.
Management is provided cybersecurity training relevant to their job
responsibilities.
Employees with privileged account permissions receive additional
cybersecurity training commensurate with their levels of responsibility.
Business units are provided cybersecurity training relevant to their
particular business risks.
The institution validates the effectiveness of training (e.g., social
engineering or phishing tests).

Intermediate

Management incorporates lessons learned from social engineering and
phishing exercises to improve the employee awareness programs.
Cybersecurity awareness information is provided to retail customers and
commercial clients at least annually.
Business units are provided cybersecurity training relevant to their
particular business risks, over and above what is required of the institution
as a whole.

CULTURE

The institution routinely updates its training to security staff to adapt to new
threats.
Advanced

Independent directors are provided with cybersecurity training that
addresses how complex products, services, and lines of business affect
the institution's cyber risk.

Innovative

Key performance indicators are used to determine whether training and
awareness programs positively influence behavior.

Baseline

Management holds employees accountable for complying with the
information security program. (FFIEC Information Security Booklet, page
7)

Evolving

The institution has formal standards of conduct that hold all employees
accountable for complying with cybersecurity policies and procedures.
Cyber risks are actively discussed at business unit meetings.
Employees have a clear understanding of how to identify and escalate
potential cybersecurity issues.

April 2017

28

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 1

Management ensures performance plans are tied to compliance with
cybersecurity policies and standards in order to hold employees
accountable.
The risk culture requires formal consideration of cyber risks in all business
decisions.
Cyber risk reporting is presented and discussed at the independent risk
management meetings.

Advanced

Management ensures continuous improvement of cyber risk cultural
awareness.

Innovative

The institution leads efforts to promote cybersecurity culture across the
sector and to other sectors that they depend upon.

April 2017

29

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 2

Domain 2: Threat Intelligence and Collaboration
Assessment Factor: Threat Intelligence

THREAT INTELLIGENCE AND INFORMATION

Y, Y(C), N
Baseline

The institution belongs or subscribes to a threat and vulnerability information
sharing source(s) that provides information on threats (e.g., Financial
Services Information Sharing and Analysis Center [FS-ISAC], U.S. Computer
Emergency Readiness Team [US-CERT]). (FFIEC E-Banking Work Program,
page 28)
Threat information is used to monitor threats and vulnerabilities. (FFIEC
Information Security Booklet, page 83)
Threat information is used to enhance internal risk management and controls.
(FFIEC Information Security Booklet, page 4)

Evolving

Threat information received by the institution includes analysis of tactics,
patterns, and risk mitigation recommendations.

Intermediate

A formal threat intelligence program is implemented and includes
subscription to threat feeds from external providers and internal sources.
Protocols are implemented for collecting information from industry peers and
government.
A read-only, central repository of cyber threat intelligence is maintained.

Advanced

A cyber intelligence model is used for gathering threat information.
Threat intelligence is automatically received from multiple sources in real
time.
The institution’s threat intelligence includes information related to geopolitical
events that could increase cybersecurity threat levels.

Innovative

A threat analysis system automatically correlates threat data to specific risks
and then takes risk-based automated actions while alerting management.
The institution is investing in the development of new threat intelligence and
collaboration mechanisms (e.g., technologies, business processes) that will
transform how information is gathered and shared.

April 2017

30

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 2

MONITORING AND ANALYZING

Assessment Factor: Monitoring and Analyzing
Baseline

Audit log records and other security event logs are reviewed and retained in
a secure manner. (FFIEC Information Security Booklet, page 79)
Computer event logs are used for investigations once an event has
occurred. (FFIEC Information Security Booklet, page 83)

Evolving

A process is implemented to monitor threat information to discover
emerging threats.
The threat information and analysis process is assigned to a specific group
or individual.
Security processes and technology are centralized and coordinated in a
Security Operations Center (SOC) or equivalent.
Monitoring systems operate continuously with adequate support for efficient
incident handling.

Intermediate

A threat intelligence team is in place that evaluates threat intelligence from
multiple sources for credibility, relevance, and exposure.
A profile is created for each threat that identifies the likely intent, capability,
and target of the threat.
Threat information sources that address all components of the threat profile
are prioritized and monitored.
Threat intelligence is analyzed to develop cyber threat summaries including
risks to the institution and specific actions for the institution to consider.

Advanced

A dedicated cyber threat identification and analysis committee or team
exists to centralize and coordinate initiatives and communications.
Formal processes have been defined to resolve potential conflicts in
information received from sharing and analysis centers or other sources.
Emerging internal and external threat intelligence and correlated log
analysis are used to predict future attacks.
Threat intelligence is viewed within the context of the institution's risk profile
and risk appetite to prioritize mitigating actions in anticipation of threats.
Threat intelligence is used to update architecture and configuration
standards.

April 2017

31

FFIEC Cybersecurity Assessment Tool
Innovative

Cybersecurity Maturity: Domain 2

The institution uses multiple sources of intelligence, correlated log analysis,
alerts, internal traffic flows, and geopolitical events to predict potential future
attacks and attack trends.
Highest risk scenarios are used to predict threats against specific business
targets.
IT systems automatically detect configuration weaknesses based on threat
intelligence and alert management so actions can be prioritized.

INFORMATION SHARING

Assessment Factor: Information Sharing
Baseline

Information security threats are gathered and shared with applicable internal
employees. (FFIEC Information Security Booklet, page 83)
Contact information for law enforcement and the regulator(s) is maintained
and updated regularly. (FFIEC Business Continuity Planning Work Program,
Objective I: 5-1)
Information about threats is shared with law enforcement and regulators
when required or prompted. (FFIEC Information Security Booklet, page 84)

Evolving

A formal and secure process is in place to share threat and vulnerability
information with other entities.
A representative from the institution participates in law enforcement or
information-sharing organization meetings.

Intermediate

A formal protocol is in place for sharing threat, vulnerability, and incident
information to employees based on their specific job function.
Information-sharing agreements are used as needed or required to facilitate
sharing threat information with other financial sector organizations or third
parties.
Information is shared proactively with the industry, law enforcement,
regulators, and information-sharing forums.
A process is in place to communicate and collaborate with the public sector
regarding cyber threats.

Advanced

Management communicates threat intelligence with business risk context
and specific risk management recommendations to the business units.
Relationships exist with employees of peer institutions for sharing cyber
threat intelligence.
A network of trust relationships (formal and/or informal) has been
established to evaluate information about cyber threats.

April 2017

32

FFIEC Cybersecurity Assessment Tool
Innovative

Cybersecurity Maturity: Domain 2

A mechanism is in place for sharing cyber threat intelligence with business
units in real time including the potential financial and operational impact of
inaction.
A system automatically informs management of the level of business risk
specific to the institution and the progress of recommended steps taken to
mitigate the risks.
The institution is leading efforts to create new sector-wide informationsharing channels to address gaps in external-facing information-sharing
mechanisms.

April 2017

33

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

Domain 3: Cybersecurity Controls
Assessment Factor: Preventative Controls

INFRASTRUCTURE MANAGEMENT

Y, Y(C), N
Baseline

Network perimeter defense tools (e.g., border router and firewall) are
used. (FFIEC Information Security Booklet, page 33)
Systems that are accessed from the Internet or by external parties are
protected by firewalls or other similar devices. (FFIEC Information
Security Booklet, page 46)
All ports are monitored. (FFIEC Information Security Booklet, page 50)
Up to date antivirus and anti-malware tools are used. (FFIEC Information
Security Booklet, page 78)
Systems configurations (for servers, desktops, routers, etc.) follow
industry standards and are enforced. (FFIEC Information Security
Booklet, page 56)
Ports, functions, protocols and services are prohibited if no longer needed
for business purposes. (FFIEC Information Security Booklet, page 50)
Access to make changes to systems configurations (including virtual
machines and hypervisors) is controlled and monitored. (FFIEC
Information Security Booklet, page 56)
Programs that can override system, object, network, virtual machine, and
application controls are restricted. (FFIEC Information Security Booklet,
page 41)
System sessions are locked after a pre-defined period of inactivity and
are terminated after pre-defined conditions are met. (FFIEC Information
Security Booklet, page 23)
Wireless network environments require security settings with strong
encryption for authentication and transmission. (*N/A if there are no
wireless networks.) (FFIEC Information Security Booklet, page 40)

Evolving

There is a firewall at each Internet connection and between any
Demilitarized Zone (DMZ) and internal network(s).
Antivirus and intrusion detection/prevention systems (IDS/IPS) detect and
block actual and attempted attacks or intrusions.
Technical controls prevent unauthorized devices, including rogue wireless
access devices and removable media, from connecting to the internal
network(s).
A risk-based solution is in place at the institution or Internet hosting

April 2017

34

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

provider to mitigate disruptive cyber attacks (e.g., DDoS attacks).
Guest wireless networks are fully segregated from the internal network(s).
(*N/A if there are no wireless networks.)
Domain Name System Security Extensions (DNSSEC) is deployed
across the enterprise.
Critical systems supported by legacy technologies are regularly reviewed
to identify for potential vulnerabilities, upgrade opportunities, or new
defense layers.
Controls for unsupported systems are implemented and tested.
Intermediate

The enterprise network is segmented in multiple, separate trust/security
zones with defense-in-depth strategies (e.g., logical network
segmentation, hard backups, air-gapping) to mitigate attacks.
Security controls are used for remote access to all administrative
consoles, including restricted virtual systems.
Wireless network environments have perimeter firewalls that are
implemented and configured to restrict unauthorized traffic. (*N/A if there
are no wireless networks.)
Wireless networks use strong encryption with encryption keys that are
changed frequently. (*N/A if there are no wireless networks.)
The broadcast range of the wireless network(s) is confined to institutioncontrolled boundaries. (*N/A if there are no wireless networks.)
Technical measures are in place to prevent the execution of unauthorized
code on institution owned or managed devices, network infrastructure,
and systems components.

Advanced

Network environments and virtual instances are designed and configured
to restrict and monitor traffic between trusted and untrusted zones.
Only one primary function is permitted per server to prevent functions that
require different security levels from co-existing on the same server.
Anti-spoofing measures are in place to detect and block forged source IP
addresses from entering the network.

Innovative

The institution risk scores all of its infrastructure assets and updates in
real time based on threats, vulnerabilities, or operational changes.
Automated controls are put in place based on risk scores to infrastructure
assets, including automatically disconnecting affected assets.
The institution proactively seeks to identify control gaps that may be used
as part of a zero-day attack.

April 2017

35

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

ACCESS AND DATA MANAGEMENT

Public-facing servers are routinely rotated and restored to a known clean
state to limit the window of time a system is exposed to potential threats.
Baseline

Employee access is granted to systems and confidential data based on
job responsibilities and the principles of least privilege. (FFIEC
Information Security Booklet, page 19)
Employee access to systems and confidential data provides for
separation of duties. (FFIEC Information Security Booklet, page 19)
Elevated privileges (e.g., administrator privileges) are limited and tightly
controlled (e.g., assigned to individuals, not shared, and require stronger
password controls). (FFIEC Information Security Booklet, page 19)
User access reviews are performed periodically for all systems and
applications based on the risk to the application or system. (FFIEC
Information Security Booklet, page 18)
Changes to physical and logical user access, including those that result
from voluntary and involuntary terminations, are submitted to and
approved by appropriate personnel. (FFIEC Information Security Booklet,
page 18)
Identification and authentication are required and managed for access to
systems, applications, and hardware. (FFIEC Information Security
Booklet, page 21)
Access controls include password complexity and limits to password
attempts and reuse. (FFIEC Information Security Booklet, page 66)
All default passwords and unnecessary default accounts are changed
before system implementation. (FFIEC Information Security Booklet,
page 61)
Customer access to Internet-based products or services requires
authentication controls (e.g., layered controls, multifactor) that are
commensurate with the risk. (FFIEC Information Security Booklet, page
21)
Production and non-production environments are segregated to prevent
unauthorized access or changes to information assets. (*N/A if no
production environment exists at the institution or the institution’s third
party.) (FFIEC Information Security Booklet, page 64)
Physical security controls are used to prevent unauthorized access to
information systems and telecommunication systems. (FFIEC Information
Security Booklet, page 47)
All passwords are encrypted in storage and in transit. (FFIEC Information
Security Booklet, page 21)

April 2017

36

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

Confidential data are encrypted when transmitted across public or
untrusted networks (e.g., Internet). (FFIEC Information Security Booklet,
page 51)
Mobile devices (e.g., laptops, tablets, and removable media) are
encrypted if used to store confidential data. (*N/A if mobile devices are
not used.) (FFIEC Information Security Booklet, page 51)
Remote access to critical systems by employees, contractors, and third
parties uses encrypted connections and multifactor authentication.
(FFIEC Information Security Booklet, page 45)
Administrative, physical, or technical controls are in place to prevent
users without administrative responsibilities from installing unauthorized
software. (FFIEC Information Security Booklet, page 25)
Customer service (e.g., the call center) utilizes formal procedures to
authenticate customers commensurate with the risk of the transaction or
request. (FFIEC Information Security Booklet, page 19)
Data is disposed of or destroyed according to documented requirements
and within expected time frames. (FFIEC Information Security Booklet,
page 66)
Evolving

Changes to user access permissions trigger automated notices to
appropriate personnel.
Administrators have two accounts: one for administrative use and one for
general purpose, non-administrative tasks.
Use of customer data in non-production environments complies with
legal, regulatory, and internal policy requirements for concealing or
removing of sensitive data elements.
Physical access to high-risk or confidential systems is restricted, logged,
and unauthorized access is blocked.
Controls are in place to prevent unauthorized access to cryptographic
keys.

April 2017

37

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 3

The institution has implemented tools to prevent unauthorized access to
or exfiltration of confidential data.
Controls are in place to prevent unauthorized escalation of user
privileges.
Access controls are in place for database administrators to prevent
unauthorized downloading or transmission of confidential data.
All physical and logical access is removed immediately upon notification
of involuntary termination and within 24 hours of an employee’s voluntary
departure.
Multifactor authentication and/or layered controls have been implemented
to secure all third-party access to the institution's network and/or systems
and applications.
Multifactor authentication (e.g., tokens, digital certificates) techniques are
used for employee access to high-risk systems as identified in the risk
assessment(s). (*N/A if no high risk systems.)
Confidential data are encrypted in transit across private connections (e.g.,
frame relay and T1) and within the institution’s trusted zones.
Controls are in place to prevent unauthorized access to collaborative
computing devices and applications (e.g., networked white boards,
cameras, microphones, online applications such as instant messaging
and document sharing). (* N/A if collaborative computing devices are not
used.)

Advanced

Encryption of select data at rest is determined by the institution’s data
classification and risk assessment.
Customer authentication for high-risk transactions includes methods to
prevent malware and man-in-the-middle attacks (e.g., using visual
transaction signing).

April 2017

38

FFIEC Cybersecurity Assessment Tool
Innovative

Cybersecurity Maturity: Domain 3

Adaptive access controls de-provision or isolate an employee, third-party,
or customer credentials to minimize potential damage if malicious
behavior is suspected.
Unstructured confidential data are tracked and secured through an
identity-aware, cross-platform storage system that protects against
internal threats, monitors user access, and tracks changes.
Tokenization is used to substitute unique values for confidential
information (e.g., virtual credit card).
The institution is leading efforts to create new technologies and
processes for managing customer, employee, and third-party
authentication and access.

DEVICE/END-POINT SECURITY

Real-time risk mitigation is taken based on automated risk scoring of user
credentials.
Baseline

Controls are in place to restrict the use of removable media to authorized
personnel. (FFIEC Information Security Work Program, Objective I: 4-1)

Evolving

Tools automatically block attempted access from unpatched employee
and third-party devices.
Tools automatically block attempted access by unregistered devices to
internal networks.
The institution has controls to prevent the unauthorized addition of new
connections.
Controls are in place to prevent unauthorized individuals from copying
confidential data to removable media.
Antivirus and anti-malware tools are deployed on end-point devices (e.g.,
workstations, laptops, and mobile devices).
Mobile devices with access to the institution’s data are centrally managed
for antivirus and patch deployment. (*N/A if mobile devices are not used.)
The institution wipes data remotely on mobile devices when a device is
missing or stolen. (*N/A if mobile devices are not used.)

Intermediate

Data loss prevention controls or devices are implemented for inbound
and outbound communications (e.g., e-mail, FTP, Telnet, prevention of
large file transfers).
Mobile device management includes integrity scanning (e.g.,
jailbreak/rooted detection). (*N/A if mobile devices are not used.)
Mobile devices connecting to the corporate network for storing and
accessing company information allow for remote software version/patch
validation. (*N/A if mobile devices are not used.)

April 2017

39

FFIEC Cybersecurity Assessment Tool
Advanced

Cybersecurity Maturity: Domain 3

Employees’ and third parties’ devices (including mobile) without the latest
security patches are quarantined and patched before the device is
granted access to the network.

SECURE CODING

Confidential data and applications on mobile devices are only accessible
via a secure, isolated sandbox or a secure container.
Innovative

A centralized end-point management tool provides fully integrated patch,
configuration, and vulnerability management, while also being able to
detect malware upon arrival to prevent an exploit.

Baseline

Developers working for the institution follow secure program coding
practices, as part of a system development life cycle (SDLC), that meet
industry standards. (FFIEC Information Security Booklet, page 56)
The security controls of internally developed software are periodically
reviewed and tested. (*N/A if there is no software development.) (FFIEC
Information Security Booklet, page 59)
The security controls in internally developed software code are
independently reviewed before migrating the code to production. (*N/A if
there is no software development.) (FFIEC Development and Acquisition
Booklet, page 2)
Intellectual property and production code are held in escrow. (*N/A if
there is no production code to hold in escrow.) (FFIEC Development and
Acquisition Booklet, page 39)

Evolving

Security testing occurs at all post-design phases of the SDLC for all
applications, including mobile applications. (*N/A if there is no software
development.)

Intermediate

Processes are in place to mitigate vulnerabilities identified as part of the
secure development of systems and applications.
The security of applications, including Web-based applications connected
to the Internet, is tested against known types of cyber attacks (e.g., SQL
injection, cross-site scripting, buffer overflow) before implementation or
following significant changes.
Software code executables and scripts are digitally signed to confirm the
software author and guarantee that the code has not been altered or
corrupted.
A risk-based, independent information assurance function evaluates the
security of internal applications.

Advanced

Vulnerabilities identified through a static code analysis are remediated
before implementing newly developed or changed applications into
production.
All interdependencies between applications and services have been

April 2017

40

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

identified.
Independent code reviews are completed on internally developed or
vendor-provided custom applications to ensure there are no security
gaps.
Innovative

Software code is actively scanned by automated tools in the development
environment so that security weaknesses can be resolved immediately
during the design phase.

THREAT AND VULNERABILITY DETECTION

Assessment Factor: Detective Controls
Baseline

Independent testing (including penetration testing and vulnerability
scanning) is conducted according to the risk assessment for externalfacing systems and the internal network. (FFIEC Information Security
Booklet, page 61)
Antivirus and anti-malware tools are used to detect attacks. (FFIEC
Information Security Booklet, page 55)
Firewall rules are audited or verified at least quarterly. (FFIEC Information
Security Booklet, page 82)
E-mail protection mechanisms are used to filter for common cyber threats
(e.g., attached malware or malicious links). (FFIEC Information Security
Booklet, page 39)

Evolving

Independent penetration testing of network boundary and critical Webfacing applications is performed routinely to identify security control gaps.
Independent penetration testing is performed on Internet-facing
applications or systems before they are launched or undergo significant
change.
Antivirus and anti-malware tools are updated automatically.
Firewall rules are updated routinely.
Vulnerability scanning is conducted and analyzed before
deployment/redeployment of new/existing devices.
Processes are in place to monitor potential insider activity that could lead
to data theft or destruction.

Intermediate

Audit or risk management resources review the penetration testing scope
and results to help determine the need for rotating companies based on
the quality of the work.
E-mails and attachments are automatically scanned to detect malware
and are blocked when malware is present.

April 2017

41

FFIEC Cybersecurity Assessment Tool
Advanced

Cybersecurity Maturity: Domain 3

Weekly vulnerability scanning is rotated among environments to scan all
environments throughout the year.
Penetration tests include cyber attack simulations and/or real-world
tactics and techniques such as red team testing to detect control gaps in
employee behavior, security defenses, policies, and resources.
Automated tool(s) proactively identifies high-risk behavior signaling an
employee who may pose an insider threat.

Innovative

User tasks and content (e.g., opening an e-mail attachment) are
automatically isolated in a secure container or virtual environment so that
malware can be analyzed but cannot access vital data, end-point
operating systems, or applications on the institution’s network.

ANOMALOUS ACTIVITY DETECTION

Vulnerability scanning is performed on a weekly basis across all
environments.
Baseline

The institution is able to detect anomalous activities through monitoring
across the environment. (FFIEC Information Security Booklet, page 32)
Customer transactions generating anomalous activity alerts are
monitored and reviewed. (FFIEC Wholesale Payments Booklet, page 12)
Logs of physical and/or logical access are reviewed following events.
(FFIEC Information Security Booklet, page 73)
Access to critical systems by third parties is monitored for unauthorized or
unusual activity. (FFIEC Outsourcing Booklet, page 26)
Elevated privileges are monitored. (FFIEC Information Security Booklet,
page 19)

Evolving

Systems are in place to detect anomalous behavior automatically during
customer, employee, and third-party authentication.
Security logs are reviewed regularly.
Logs provide traceability for all system access by individual users.
Thresholds have been established to determine activity within logs that
would warrant management response.

April 2017

42

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 3

Online customer transactions are actively monitored for anomalous
behavior.
Tools to detect unauthorized data mining are used.
Tools actively monitor security logs for anomalous behavior and alert
within established parameters.
Audit logs are backed up to a centralized log server or media that is
difficult to alter.
Thresholds for security logging are evaluated periodically.
Anomalous activity and other network and system alerts are correlated
across business units to detect and prevent multifaceted attacks (e.g.,
simultaneous account takeover and DDoS attack).

Advanced

An automated tool triggers system and/or fraud alerts when customer
logins occur within a short period of time but from physically distant IP
locations.
External transfers from customer accounts generate alerts and require
review and authorization if anomalous behavior is detected.
A system is in place to monitor and analyze employee behavior (network
use patterns, work hours, and known devices) to alert on anomalous
activities.
An automated tool(s) is in place to detect and prevent data mining by
insider threats.
Tags on fictitious confidential data or files are used to provide advanced
alerts of potential malicious activity when the data is accessed.

Innovative

The institution has a mechanism for real-time automated risk scoring of
threats.
The institution is developing new technologies that will detect potential
insider threats and block activity in real time.

April 2017

43

EVENT DETECTION

FFIEC Cybersecurity Assessment Tool
Baseline

Cybersecurity Maturity: Domain 3

A normal network activity baseline is established. (FFIEC Information
Security Booklet, page 77)
Mechanisms (e.g., antivirus alerts, log event alerts) are in place to alert
management to potential attacks. (FFIEC Information Security Booklet,
page 78)
Processes are in place to monitor for the presence of unauthorized users,
devices, connections, and software. (FFIEC Information Security Work
Program, Objective II: M-9)
Responsibilities for monitoring and reporting suspicious systems activity
have been assigned. (FFIEC Information Security Booklet, page 83)
The physical environment is monitored to detect potential unauthorized
access. (FFIEC Information Security Booklet, page 47)

Evolving

A process is in place to correlate event information from multiple sources
(e.g., network, application, or firewall).

Intermediate

Controls or tools (e.g., data loss prevention) are in place to detect
potential unauthorized or unintentional transmissions of confidential data.
Event detection processes are proven reliable.
Specialized security monitoring is used for critical assets throughout the
infrastructure.

Advanced

Automated tools detect unauthorized changes to critical system files,
firewalls, IPS, IDS, or other security devices.
Real-time network monitoring and detection is implemented and
incorporates sector-wide event information.
Real-time alerts are automatically sent when unauthorized software,
hardware, or changes occur.
Tools are in place to actively correlate event information from multiple
sources and send alerts based on established parameters.

Innovative

The institution is leading efforts to develop event detection systems that
will correlate in real time when events are about to occur.
The institution is leading the development effort to design new
technologies that will detect potential insider threats and block activity in
real time.

April 2017

44

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

PATCH MANAGEMENT

Assessment Factor: Corrective Controls
Baseline

A patch management program is implemented and ensures that software
and firmware patches are applied in a timely manner. (FFIEC Information
Security Booklet, page 62)
Patches are tested before being applied to systems and/or software.
(FFIEC Operations Booklet, page 22)
Patch management reports are reviewed and reflect missing security
patches. (FFIEC Development and Acquisition Booklet, page 50)

Evolving

A formal process is in place to acquire, test, and deploy software patches
based on criticality.
Systems are configured to retrieve patches automatically.
Operational impact is evaluated before deploying security patches.
An automated tool(s) is used to identify missing security patches as well
as the number of days since each patch became available.
Missing patches across all environments are prioritized and tracked.

Intermediate

Patches for high-risk vulnerabilities are tested and applied when released
or the risk is accepted and accountability assigned.

Advanced

Patch monitoring software is installed on all servers to identify any
missing patches for the operating system software, middleware,
database, and other key software.
The institution monitors patch management reports to ensure security
patches are tested and implemented within aggressive time frames (e.g.,
0-30 days).

Innovative

The institution develops security patches or bug fixes or contributes to
open source code development for systems it uses.
Segregated or separate systems are in place that mirror production
systems allowing for rapid testing and implementation of patches and
provide for rapid fallback when needed.

April 2017

45

REMEDIATION

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 3

Baseline

Issues identified in assessments are prioritized and resolved based on
criticality and within the time frames established in the response to the
assessment report. (FFIEC Information Security Booklet, page 87)

Evolving

Data is destroyed or wiped on hardware and portable/mobile media when
a device is missing, stolen, or no longer needed.
Formal processes are in place to resolve weaknesses identified during
penetration testing.

Intermediate

Remediation efforts are confirmed by conducting a follow-up vulnerability
scan.
Penetration testing is repeated to confirm that medium- and high-risk,
exploitable vulnerabilities have been resolved.
Security investigations, forensic analysis, and remediation are performed
by qualified staff or third parties.
Generally accepted and appropriate forensic procedures, including chain
of custody, are used to gather and present evidence to support potential
legal action.
The maintenance and repair of organizational assets are performed by
authorized individuals with approved and controlled tools.
The maintenance and repair of organizational assets are logged in a
timely manner.

Advanced

All medium and high risk issues identified in penetration testing,
vulnerability scanning, and other independent testing are escalated to the
board or an appropriate board committee for risk acceptance if not
resolved in a timely manner.

Innovative

The institution is developing technologies that will remediate systems
damaged by zero-day attacks to maintain current recovery time
objectives.

April 2017

46

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 4

Domain 4: External Dependency Management
Assessment Factor: Connections

CONNECTIONS

Y, Y(C), N
Baseline

The critical business processes that are dependent on external
connectivity have been identified. (FFIEC Information Security Booklet,
page 9)
The institution ensures that third-party connections are authorized.
(FFIEC Information Security Booklet, page 17)
A network diagram is in place and identifies all external connections.
(FFIEC Information Security Booklet, page 9)
Data flow diagrams are in place and document information flow to
external parties. (FFIEC Information Security Booklet, page 10)

Evolving

Critical business processes have been mapped to the supporting external
connections.
The network diagram is updated when connections with third parties
change or at least annually.
Network and systems diagrams are stored in a secure manner with
proper restrictions on access.
Controls for primary and backup third-party connections are monitored
and tested on a regular basis.

Intermediate

A validated asset inventory is used to create comprehensive diagrams
depicting data repositories, data flow, infrastructure, and connectivity.
Security controls are designed and verified to detect and prevent
intrusions from third-party connections.
Monitoring controls cover all external connections (e.g., third-party
service providers, business partners, customers).
Monitoring controls cover all internal network-to-network connections.

Advanced

The security architecture is validated and documented before network
connection infrastructure changes.
The institution works closely with third-party service providers to maintain
and improve the security of external connections.

April 2017

47

FFIEC Cybersecurity Assessment Tool
Innovative

Cybersecurity Maturity: Domain 4

Diagram(s) of external connections is interactive, shows real-time
changes to the network connection infrastructure, new connections,
and volume fluctuations, and alerts when risks arise.
The institution's connections can be segmented or severed
instantaneously to prevent contagion from cyber attacks.

DUE DILIGENCE

Assessment Factor: Relationship Management
Baseline

Risk-based due diligence is performed on prospective third parties
before contracts are signed, including reviews of their background,
reputation, financial condition, stability, and security controls. (FFIEC
Information Security Booklet, page 69)
A list of third-party service providers is maintained. (FFIEC Outsourcing
Booklet, page 19)
A risk assessment is conducted to identify criticality of service
providers. (FFIEC Outsourcing Booklet, page 6)

Evolving

A formal process exists to analyze assessments of third-party
cybersecurity controls.
The board or an appropriate board committee reviews a summary of
due diligence results including management’s recommendations to use
third parties that will affect the institution’s inherent risk profile.

Intermediate

A process is in place to confirm that the institution’s third-party service
providers conduct due diligence of their third parties (e.g.,
subcontractors).
Pre-contract, physical site visits of high-risk vendors are conducted by
the institution or by a qualified third party.

Advanced

A continuous process improvement program is in place for third-party
due diligence activity.
Audits of high-risk vendors are conducted on an annual basis.

Innovative

The institution promotes sector-wide efforts to build due diligence
mechanisms that lead to in-depth and efficient security and resilience
reviews.
The institution is leading efforts to develop new auditable processes
and for conducting due diligence and ongoing monitoring of
cybersecurity risks posed by third parties.

April 2017

48

CONTRACTS

FFIEC Cybersecurity Assessment Tool
Baseline

Cybersecurity Maturity: Domain 4

Formal contracts that address relevant security and privacy
requirements are in place for all third parties that process, store, or
transmit confidential data or provide critical services. (FFIEC
Information Security Booklet, page 7)
Contracts acknowledge that the third party is responsible for the
security of the institution’s confidential data that it possesses, stores,
processes, or transmits. (FFIEC Information Security Booklet, page 12)
Contracts stipulate that the third-party security controls are regularly
reviewed and validated by an independent party. (FFIEC Information
Security Booklet, page 12)
Contracts identify the recourse available to the institution should the
third party fail to meet defined security requirements. (FFIEC
Outsourcing Booklet, page 12)
Contracts establish responsibilities for responding to security incidents.
(FFIEC E-Banking Booklet, page 22)
Contracts specify the security requirements for the return or destruction
of data upon contract termination. (FFIEC Outsourcing Booklet,
page 15)

Evolving

Responsibilities for managing devices (e.g., firewalls, routers) that
secure connections with third parties are formally documented in the
contract.
Responsibility for notification of direct and indirect security incidents
and vulnerabilities is documented in contracts or service-level
agreements (SLAs).
Contracts stipulate geographic limits on where data can be stored or
transmitted.

Intermediate

Third-party SLAs or similar means are in place that require timely
notification of security events.

Advanced

Contracts require third-party service provider’s security policies meet or
exceed those of the institution.
A third-party termination/exit strategy has been established and
validated with management.

Innovative

April 2017

The institution promotes a sector-wide effort to influence contractual
requirements for critical third parties to the industry.

49

ONGOING MONITORING

FFIEC Cybersecurity Assessment Tool
Baseline

Cybersecurity Maturity: Domain 4

The third-party risk assessment is updated regularly. (FFIEC
Outsourcing Booklet, page 3)
Audits, assessments, and operational performance reports are
obtained and reviewed regularly validating security controls for critical
third parties. (FFIEC Information Security Booklet, page 86)
Ongoing monitoring practices include reviewing critical third-parties’
resilience plans. (FFIEC Outsourcing Booklet, page 19)

Evolving

A process to identify new third-party relationships is in place, including
identifying new relationships that were established without formal
approval.
A formal program assigns responsibility for ongoing oversight of thirdparty access.
Monitoring of third parties is scaled, in terms of depth and frequency,
according to the risk of the third parties.
Automated reminders or ticklers are in place to identify when required
third-party information needs to be obtained or analyzed.

Intermediate

Third-party employee access to the institution's confidential data are
tracked actively based on the principles of least privilege.
Periodic on-site assessments of high-risk vendors are conducted to
ensure appropriate security controls are in place.

Advanced

Third-party employee access to confidential data on third-party hosted
systems is tracked actively via automated reports and alerts.

Innovative

The institution is leading efforts to develop new auditable processes for
ongoing monitoring of cybersecurity risks posed by third parties.

April 2017

50

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 5

Domain 5: Cyber Incident Management and Resilience
Assessment Factor: Incident Resilience Planning and Strategy

PLANNING

Y, Y(C), N
Baseline

The institution has documented how it will react and respond to cyber
incidents. (FFIEC Business Continuity Planning Booklet, page 4)
Communication channels exist to provide employees a means for
reporting information security events in a timely manner. (FFIEC
Information Security Booklet, page 83)
Roles and responsibilities for incident response team members are
defined. (FFIEC Information Security Booklet, page 84)
The response team includes individuals with a wide range of backgrounds
and expertise, from many different areas within the institution (e.g.,
management, legal, public relations, as well as information technology).
(FFIEC Information Security Booklet, page 84)
A formal backup and recovery plan exists for all critical business lines.
(FFIEC Business Continuity Planning Booklet, page 4)
The institution plans to use business continuity, disaster recovery, and
data backup programs to recover operations following an incident. (FFIEC
Information Security Booklet, page 71)

Evolving

The remediation plan and process outlines the mitigating actions,
resources, and time parameters.
The corporate disaster recovery, business continuity, and crisis
management plans have integrated consideration of cyber incidents.
Alternative processes have been established to continue critical activity
within a reasonable time period.
Business impact analyses have been updated to include cybersecurity.
Due diligence has been performed on technical sources, consultants, or
forensic service firms that could be called to assist the institution during or
following an incident.

April 2017

51

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 5

A strategy is in place to coordinate and communicate with internal and
external stakeholders during or following a cyber attack.
Plans are in place to re-route or substitute critical functions and/or
services that may be affected by a successful attack on Internet-facing
systems.
A direct cooperative or contractual agreement(s) is in place with an
incident response organization(s) or provider(s) to assist rapidly with
mitigation efforts.
Lessons learned from real-life cyber incidents and attacks on the
institution and other organizations are used to improve the institution’s
risk mitigation capabilities and response plan.

Advanced

Methods for responding to and recovering from cyber incidents are
tightly woven throughout the business units’ disaster recovery,
business continuity, and crisis management plans.
Multiple systems, programs, or processes are implemented into a
comprehensive cyber resilience program to sustain, minimize, and
recover operations from an array of potentially disruptive and
destructive cyber incidents.
A process is in place to continuously improve the resilience plan.

Innovative

The incident response plan is designed to ensure recovery from
disruption of services, assurance of data integrity, and recovery of lost
or corrupted data following a cybersecurity incident.

TESTING

The incident response process includes detailed actions and rulebased triggers for automated response.
Baseline

Scenarios are used to improve incident detection and response.
(FFIEC Information Security Booklet, page 71)
Business continuity testing involves collaboration with critical third
parties. (FFIEC Business Continuity Planning Booklet, page J-6)
Systems, applications, and data recovery is tested at least annually.
(FFIEC Business Continuity Planning Booklet, page J-7)

Evolving

Recovery scenarios include plans to recover from data destruction
and impacts to data integrity, data loss, and system and data
availability.
Widely reported events are used to evaluate and improve the
institution's response.
Information backups are tested periodically to verify they are
accessible and readable.

April 2017

52

FFIEC Cybersecurity Assessment Tool
Intermediate

Cybersecurity Maturity: Domain 5

Cyber-attack scenarios are analyzed to determine potential impact to
critical business processes.
The institution participates in sector-specific cyber exercises or
scenarios (e.g., FS-ISAC Cyber Attack (against) Payment Processors
(CAPP)).
Resilience testing is based on analysis and identification of realistic
and highly likely threats as well as new and emerging threats facing
the institution.
The critical online systems and processes are tested to withstand
stresses for extended periods (e.g., DDoS).
The results of cyber event exercises are used to improve the incident
response plan and automated triggers.

Advanced

Resilience testing is comprehensive and coordinated across all critical
business functions.
The institution validates that it is able to recover from cyber events
similar to by known sophisticated attacks at other organizations.
Incident response testing evaluates the institution from an attacker's
perspective to determine how the institution or its assets at critical
third parties may be targeted.
The institution corrects root causes for problems discovered during
cybersecurity resilience testing.
Cybersecurity incident scenarios involving significant financial loss are
used to stress test the institution's risk management.

Innovative

The institution tests the ability to shift business processes or functions
between different processing centers or technology systems for cyber
incidents without interruption to business or loss of productivity or
data.
The institution has validated that it is able to remediate systems
damaged by zero-day attacks to maintain current recovery time
objectives.
The institution is leading the development of more realistic test
environments.
Cyber incident scenarios are used to stress test potential financial
losses across the sector.

April 2017

53

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 5

DETECTION

Assessment Factor: Detection, Response, and Mitigation
Baseline

Alert parameters are set for detecting information security incidents that
prompt mitigating actions. (FFIEC Information Security Booklet, page 43)
System performance reports contain information that can be used as a
risk indicator to detect information security incidents. (FFIEC Information
Security Booklet, page 86)
Tools and processes are in place to detect, alert, and trigger the incident
response program. (FFIEC Information Security Booklet, page 84)

Evolving

The institution has processes to detect and alert the incident response
team when potential insider activity manifests that could lead to data theft
or destruction.

Intermediate

The incident response program is triggered when anomalous behaviors
and attack patterns or signatures are detected.
The institution has the ability to discover infiltration, before the attacker
traverses across systems, establishes a foothold, steals information, or
causes damage to data and systems.
Incidents are detected in real time through automated processes that
include instant alerts to appropriate personnel who can respond.
Network and system alerts are correlated across business units to better
detect and prevent multifaceted attacks (e.g., simultaneous DDoS attack
and account takeover).
Incident detection processes are capable of correlating events across the
enterprise.

Advanced

Sophisticated and adaptive technologies are deployed that can detect and
alert the incident response team of specific tasks when threat indicators
across the enterprise indicate potential external and internal threats.
Automated tools are implemented to provide specialized security
monitoring based on the risk of the assets to detect and alert incident
response teams in real time.

Innovative

April 2017

The institution is able to detect and block zero-day attempts and inform
management and the incident response team in real time.

54

RESPONSE AND MITIGATION

FFIEC Cybersecurity Assessment Tool

Cybersecurity Maturity: Domain 5

Baseline

Appropriate steps are taken to contain and control an incident to prevent
further unauthorized access to or use of customer information. (FFIEC
Information Security Booklet, page 84)

Evolving

The incident response plan is designed to prioritize incidents, enabling a
rapid response for significant cybersecurity incidents or vulnerabilities.
A process is in place to help contain incidents and restore operations with
minimal service disruption.
Containment and mitigation strategies are developed for multiple incident
types (e.g., DDoS, malware).
Procedures include containment strategies and notifying potentially
impacted third parties.
Processes are in place to trigger the incident response program when an
incident occurs at a third party.
Records are generated to support incident investigation and mitigation.
The institution calls upon third parties, as needed, to provide mitigation
services.
Analysis of events is used to improve the institution's security measures
and policies.

Intermediate

Analysis of security incidents is performed in the early stages of an
intrusion to minimize the impact of the incident.
Any changes to systems/applications or to access entitlements necessary
for incident management are reviewed by management for formal
approval before implementation.
Processes are in place to ensure assets affected by a security incident
that cannot be returned to operational status are quarantined, removed,
disposed of, and/or replaced.
Processes are in place to ensure that restored assets are appropriately
reconfigured and thoroughly tested before being placed back into
operation.

Advanced

The incident management function collaborates effectively with the cyber
threat intelligence function during an incident.
Links between threat intelligence, network operations, and incident
response allow for proactive response to potential incidents.
Technical measures apply defense-in-depth techniques such as deeppacket inspection and black holing for detection and timely response to
network-based attacks associated with anomalous ingress or egress
traffic patterns and/or DDoS attacks.

April 2017

55

FFIEC Cybersecurity Assessment Tool
Innovative

Cybersecurity Maturity: Domain 5

The institution’s risk management of significant cyber incidents results in
limited to no disruptions to critical services.
The technology infrastructure has been engineered to limit the effects of a
cyber attack on the production environment from migrating to the backup
environment (e.g., air-gapped environment and processes).

ESCALATION AND REPORTING

Assessment Factor: Escalation and Reporting
Baseline

A process exists to contact personnel who are responsible for analyzing
and responding to an incident. (FFIEC Information Security Booklet,
page 83)
Procedures exist to notify customers, regulators, and law enforcement as
required or necessary when the institution becomes aware of an incident
involving the unauthorized access to or use of sensitive customer
information. (FFIEC Information Security Booklet, page 84)
The institution prepares an annual report of security incidents or violations
for the board or an appropriate board committee. (FFIEC Information
Security Booklet, page 5)
Incidents are classified, logged, and tracked. (FFIEC Operations Booklet,
page 28)

Evolving

Criteria have been established for escalating cyber incidents or
vulnerabilities to the board and senior management based on the
potential impact and criticality of the risk.
Regulators, law enforcement, and service providers, as appropriate, are
notified when the institution is aware of any unauthorized access to
systems or a cyber incident occurs that could result in degradation of
services.
Tracked cyber incidents are correlated for trend analysis and reporting.

Intermediate

Employees that are essential to mitigate the risk (e.g., fraud, business
resilience) know their role in incident escalation.
A communication plan is used to notify other organizations, including third
parties, of incidents that may affect them or their customers.
An external communication plan is used for notifying media regarding
incidents when applicable.

Advanced

The institution has established quantitative and qualitative metrics for the
cybersecurity incident response process.
Detailed metrics, dashboards, and/or scorecards outlining cyber incidents
and events are provided to management and are part of the board
meeting package.

April 2017

56

FFIEC Cybersecurity Assessment Tool
Innovative

April 2017

Cybersecurity Maturity: Domain 5

A mechanism is in place to provide instantaneous notification of incidents
to management and essential employees through multiple communication
channels with tracking and verification of receipt.

57