Sharing of Threat and Vulnerability Information with Financial Institutions

Submitting OIG:

Federal Deposit Insurance Corporation OIG

Date Issued:

Tuesday, August 29, 2023

Agency Reviewed / Investigated:

Federal Deposit Insurance Corporation

Submitting OIG-Specific Report Number:

EVAL-23-002

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
EVAL-23-002-REDACTED-FINAL.pdf	1.63 MB

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	No
Share threat and vulnerability information that is uniquely developed or summarized by the FDIC with financial institutions or other financial sector entities to further strengthen their threat intelligence activities. This includes results from the FDIC’s 2022 Ransomware Horizontal Review and relevant trending and analysis conducted by the Division of Risk Management Supervision.
2	Open	No
Conduct training for examiners on the requirements for recording computersecurity incidents, the information to include, and specific requirements for Notification Rule incidents.
4	Open	No
Conduct a review of computer-security incidents reported since May 1, 2022 to ensure Virtual Supervisory Information on the Net system records are complete and accurate.
5	Open	No
Ensure FDIC threat and vulnerability communication procedures facilitate the sharing of unclassified non-cyber related threat and vulnerability information.
6	Open	No
Update the Division of Risk Management Supervision Threat and Vulnerability Communication Operating Procedures to: (1) account for a more appropriate methodology for determining when to share threat and vulnerability information created internally and by other credible sources; (2) formalize processes for (a) coordinating with the Intelligence and Threat Sharing Unit and accounting for threat and vulnerability information received from the Intelligence and Threat Sharing Unit, (b) coordinating with the Chief Information Officer Organization under the Vulnerability Disclosure Policy program, and (c) coordinating with other FDIC Divisions and Offices that may obtain relevant threat and vulnerability information that requires communication to financial institutions; and (3) specify the key documents that should be retained to support the Division of Risk Management Supervision threat sharing decisions.
7	Open	No
Develop and implement a feedback process for external threat sharing activities.
8	Open	No
Develop performance measures to assess the effectiveness of its external threat and vulnerability information sharing activities
9	Open	No
Evaluate and, if necessary, obtain the resources needed for the timely implementation of the recommendations in this report to further mature the FDIC’s threat information sharing program. Evaluate and, if necessary, obtain the resources needed for the timely implementation of the recommendations in this report to further mature the FDIC’s threat information sharing program.
10	Open	No
Ensure that all data sets within the FDIC that contain relevant threat and vulnerability information are assessed and natural language processing or alternative technological capabilities are considered for enhancing threat and vulnerability information sharing operations.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Share threat and vulnerability information that is uniquely developed or summarized by the FDIC with financial institutions or other financial sector entities to further strengthen their threat intelligence activities. This includes results from the FDIC’s 2022 Ransomware Horizontal Review and relevant trending and analysis conducted by the Division of Risk Management Supervision.

Open

Conduct training for examiners on the requirements for recording computersecurity incidents, the information to include, and specific requirements for Notification Rule incidents.

Open

Conduct a review of computer-security incidents reported since May 1, 2022 to ensure Virtual Supervisory Information on the Net system records are complete and accurate.

Open

Ensure FDIC threat and vulnerability communication procedures facilitate the sharing of unclassified non-cyber related threat and vulnerability information.