US federal bank regulatory agencies have approved a new rule ordering banks to notify their primary federal regulators of significant computer-security incidents within 36 hours.
Banks are only required to report major cyberattacks if they have or will likely impact their operations, the ability to deliver banking products and services, or the US financial sector’s stability.
Bank service providers will also have to notify customers “as soon as possible” if a cyberattack has materially affected or will likely affect the customers for four or more hours.
Examples of incidents that need to be reported under the new rule include large-scale distributed denial of service attacks that disrupt customer account access to banking services or computer hacking incidents that takedown banking operations for extended periods of time.
“Computer-security incidents can result from destructive malware or malicious software (cyberattacks), as well as the non-malicious failure of hardware and software, personnel errors, and other causes,” the Computer-Security Incident Notification Final Rule explains (PDF).
“Cyberattacks targeting the financial services industry have increased in frequency and severity in recent years. These cyberattacks can adversely affect banking organizations’ networks, data, and systems, and ultimately their ability to resume normal operations.”
Compliance required by May 2022
The final rule issued by the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (Board), and the Office of the Comptroller of the Currency (OCC) will take effect on April 1, 2022, with full compliance extended to May 1, 2022.
“The FDIC will provide supervised institutions logistics for FDIC notification in early 2022,” the Federal Deposit Insurance Corporation (FDIC) said on Thursday.
The new cyberattack reporting rule is designed to boost banking supervisors’ awareness of emerging threats to banking orgs and the broader US financial system.
This, in turn, will allow the federal bank regulatory agencies to react to these increasing and accumulating threats before they will become systemic.
“The final rule seeks to allow the banking supervisors to be informed of the most significant cyberattacks in a timely fashion while avoiding unnecessarily difficult or time-consuming reporting obligations,” said FDIC Chairman Jelena McWilliams.
DataBreaches.net Read More
