The Office of the Comptroller of the Currency (OCC) has updated its Cybersecurity Supervision Work Program (CSW). The new structure aligns with the updated National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) categories and subcategories to address evolving risks and support IT examinations.
The updated bulletin maps to the Federal Financial Institutions Examination Council (FFIEC) IT Examination Handbook. It supplements existing procedures for community banks, large banks, and federal branches. This update officially rescinds the previous OCC Bulletin 2023-22, which was issued on June 26, 2023.
The OCC clarified that the CSW does not establish new regulatory expectations. Banks are not required to use this specific program for assessing cybersecurity preparedness. The regulator continues to encourage the use of standardized approaches but allows banks to choose from various available tools and frameworks.
In a separate initiative, the OCC highlighted that artificial intelligence is reshaping the cyber threat landscape. The regulator recommends that banks mitigate AI-related risks by deploying AI for defense, implementing multifactor authentication, and managing patches. The agency aims to focus oversight on material financial risks.
