Banking Agencies Propose Enhanced Cyber Risk Management Standards

The Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency ("OCC") and the FDIC (collectively, the "Agencies") requested comments on an Advanced Notice of Proposed Rulemaking ("ANPR") that would enhance cyber risk management standards for large and interconnected entities under the Agencies' supervision, and for the entities' service providers. The ANPR addresses five categories of cyber standards: (i) cyber risk governance, (ii) cyber risk management, (iii) internal dependency management, (iv) external dependency management, and (v) incident response, cyber resilience, and situational awareness. The proposed enhanced standards would apply to certain entities with consolidated assets that total $50 billion or more on an enterprise-wide basis.