Banking Organizations & Bank Service Providers Subject To New Computer-Security Incident Notification Rule

On November, 18, 2021, the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (Board), and the Office of the Comptroller of the Currency (OCC) (collectively, "the agencies") issued a joint final rule to establish computer-security incident notification requirements for banking organizations (BO) and their bank service providers (BSP).

During the rule-making process, the agencies initially aligned the definition of a computer-security incident with language used by the National Institute of Standards and Technology (NIST). However, the agencies agreed that the NIST definition does not wholly align with the purposes of the rule and have therefore narrowed the final rule's definition. The final rule defines "computer-security incident" as an occurrence that results in actual harm to the confidentiality, integrity, or availability of an information system or the information that the system processes, stores, or transmits.