ithandbook.ffiec.govFFIEC IT Examination Handbook InfoBase - Home

JavaScript must be enabled in your browser in order to use some functions. IT Booklets Audit Business Continuity Management Development and Acquisition E-Banking Information Security Management Operations Outsourcing Technology Services Retail Payment Systems Supervision of Technology Service Providers Wholesale Payment Systems Archived Booklets IT WorkPrograms Glossary FFIEC Home Welcome to FFIEC IT Examination Handbook InfoBase Prompt delivery of introductory, reference, and educational training material on specific topics of interest to field examiners from FFIEC members. IT Booklets Audit, Business Continuity Planning, Development and Acquisition, E-Banking, Information Security, Management, Operations, Outsourcing Technology Services, Retail Payment Systems, Supervision of Technology Service Providers, and Wholesale Payment Systems. IT WorkPrograms Easy to follow procedures to help determine the quality and effectiveness of the financial institution’s IT risk management. / Sign up for FFIEC IT Handbook InfoBase Email Updates and What’s New RSS Feed What's New Link to a feed containing any updates to the FFIEC IT Handbook InfoBase (e.g., booklets, appendices, and joint statements) Glossary Definitions of terms found in or relating to IT booklet concepts Laws, Regulations, & Guidance Link to the regulatory resources by IT booklet and further sorted by regulatory agency References This page contains topical materials that supplement booklet content and are for informational purposes × Table of Contents Audit Introduction IT Audit Roles and Responsibilities Board of Directors and Senior Management Audit Management Internal IT Audit Staff Operating Management External Auditors Independence and Staffing of Internal IT Audit Independence Staffing Internal Audit Program Risk Assessment and Risk-Based Auditing Program Elements Risk Scoring System Audit Participation in Application Development, Acquisition, Conversions, and Testing Outsourcing Internal IT Audit Independence of the External Auditor Providing Internal Audit Services Examples of Arrangements Third-Party Reviews of Technology Service Providers Appendix A: Examination Procedures Appendix B: Glossary Appendix C: Laws, Regulations, and Guidance Close × Table of Contents Business Continuity Management Introduction I Business Continuity Management II Business Continuity Management Governance II.A Board and Senior Management Responsibilities II.B Audit III Risk Management III.A Business Impact Analysis III.A.1 Identification of Critical Business Functions III.A.2 Interdependency Analysis III.A.3 Impact of Disruption III.B Risk Assessment III.B.1 Risk Identification III.B.2 Likelihood and Impact IV Business Continuity Strategies IV.A Resilience IV.A.1 Physical IV.A.2 Cyber Resilience IV.A.3 Data Backup and Replication IV.A.4 Personnel IV.A.5 Third-Party Service Providers IV.A.6 Telecommunications IV.A.7 Power IV.A.8 Change Management IV.B Communications V Business Continuity Plan V.A Event Management V.B Continuity and Recovery V.C Facilities and Infrastructure V.C.1 Data Center Recovery Alternatives V.C.2 Branch Relocation V.D Payment Systems V.E Liquidity Considerations V.F Other Components V.F.1 Incident Response V.F.2 Disaster Recovery V.F.3 Crisis or Emergency Management VI Training VII Exercises and Tests VII.A Exercise and Test Program VII.B Exercise and Test Policy VII.C Exercise and Test Strategies VII.D Exercise and Test Objectives VII.E Exercise and Test Plans VII.F Exercise and Test Scenarios VII.G Exercise and Test Methods VII.G.1 Full-Scale Exercise VII.G.2 Limited-Scale Exercise VII.G.3 Tabletop Exercise VII.G.4 Tests VII.H Industry Exercises and Resilience VII.I Third-Party Service Provider Testing VII.J Testing for Core and Significant Firms VII.K Post-Exercise and Post-Test Actions VIII Maintenance and Improvement IX Board Reporting Appendix A: Examination Procedures Appendix B: Glossary Appendix C: Abbreviations Appendix D: References Close × Table of Contents Development and Acquisition Introduction Examination Objectives Standards Accounting for Software Costs Information Security Project Management System Development Life Cycle Alternative Development Methodologies Roles and Responsibilities Project Plans Project Management Standards Project Planning Standards Configuration Management Standards Quality Assurance Standards Risk Management Standards Testing Standards Documentation Standards Project Management Tools Gantt Charts Project Evaluation Review Techniques Groupware Project Management Effectiveness Capability Maturity Model International Organization for Standardization Development Procedures Development Standards Systems Development Life Cycle Initiation Phase Planning Phase Design Phase Development Phase Testing Phase Implementation Phase Maintenance Phase Disposal Phase Large-Scale Integrated Systems Software Development Techniques Object-Oriented Programming Computer-Aided Software Engineering Rapid Application Development Databases Database Management Systems Acquisition Acquisition Standards Acquisition Project Guidance Escrowed Documentation Software Development Contracts and Licensing Agreements Overview Software Licenses - General Software Licenses and Copyright Violations Software Development Specifications and Performance Standards Documentation, Modification, Updates, and Conversion Bankruptcy Regulatory Requirements Payments Representations and Warranties Dispute Resolution Agreement Modifications Vendor Liability Limitations Security Subcontracting and Multiple Vendor Relationships Restrictions on Adverse Comments Maintenance Major Modifications Routine Modifications Emergency Modifications Patch Management Library Controls Conversions Utility Controls Documentation Maintenance Appendix A: Examination Procedures Appendix B: Glossary Close × Table of Contents E-Banking Introduction Definition of E-Banking Informational Websites Transactional Websites E-Banking Components E-Banking Support Services Weblinking Account Aggregation Electronic Authentication Website Hosting Payments for E-Commerce Wireless E-Banking E-Banking Risks Transaction/Operations Risk Credit Risk Liquidity, Interest Rate, Price/Market Risks Compliance/Legal Risk Strategic Risk Reputation Risk Risk Management of E-Banking Activities Board and Management Oversight E-Banking Strategy Cost-Benefit Analysis and Risk Assessment Monitoring and Accountability Audit Managing Outsourcing Relationships Due Diligence for Outsourcing Solutions Contracts for Third-Party Services Oversight and Monitoring of Third Parties Information Security Program Security Guidelines Information Security Controls Authenticating E-Banking Customers Administrative controls Internal Controls Business Continuity Controls Legal and Compliance Issues Trade Names on the Internet Website Content Customer Privacy and Confidentiality Transaction Monitoring and Consumer Disclosures Appendix A: Examination Procedures Appendix B: Glossary Appendix C: Laws, Regulations, and Guidance Appendix D: Aggregation Services Appendix E: Wireless Banking Close × Table of Contents Information Security Introduction I Governance of the Information Security Program I.A Security Culture I.B Responsibility and Accountability I.C Resources II Information Security Program Management II.A Risk Identification II.A.1 Threats II.A.2 Vulnerabilities II.A.3 Supervision of Cybersecurity Risk and Resources II.A.3(a) Supervision of Cybersecurity Risk II.A.3(b) Resources for Cybersecurity Preparedness II.B Risk Measurement II.C Risk Mitigation II.C.1 Policies, Standards, and Procedures II.C.2 Technology Design II.C.3 Control Types II.C.4 Control Implementation II.C.5 Inventory and Classification of Assets II.C.6 Mitigating Interconnectivity Risk II.C.7 User Security Controls II.C.7(a) Security Screening in Hiring Practices II.C.7(b) User Access Program II.C.7(c) Segregation of Duties II.C.7(d) Confidentiality Agreements II.C.7(e) Training II.C.8 Physical ...