ICBA Policy Resolutions: Cybersecurity and Data Security, Privacy and Fraud

Policymakers must recognize existing cybersecurity frameworks, tools, and assessments, such as the Commerce Department’s National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Federal Financial Institutions Examination Council (FFIEC) Cybersecurity Assessment Tool (CAT).

NIST provides a structure that organizations, regulators, and customers may use to create, guide, assess, or improve comprehensive cybersecurity programs. CAT is a voluntary framework now commonly used by community banks and examiners.

The sharing of advanced threat and attack data between federal agencies and financial sector participants helps manage cyber threats and protect critical systems.

ICBA supports community banks’ involvement with services such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), a non-profit information-sharing forum established by financial services industry participants to facilitate the public and private sectors’ sharing of physical and cybersecurity threat and vulnerability information.

ICBA also supports FS-ISAC’s cross-sector information sharing efforts to enhance overall resiliency of the nation’s critical infrastructure.

Community banks significantly rely on third party service providers to support their systems and business activities. While community banks are diligent in their management of third parties, mitigating sophisticated cyber threats against these third parties can be challenging, especially when they have connections to other institutions and servicers.

Regulators must be aware of the significant interconnectivity of these third parties and collaborate with them to mitigate risk. The agencies should evaluate the concentration risks of service providers to financial institutions and broaden supervision of technology service providers to include additional core, IT service providers.

Because employees of technology service providers have access to confidential bank information that could be used to commit fraud, damage a bank’s reputation, or compromise customer privacy, regulators must ensure that these service providers implement nondisclosure and confidentiality requirements which are similar to existing regulatory requirements for banks.

The 2017 Equifax data breach demonstrated how important it is that the credit rating agencies (CRAs) and other collectors/aggregators of customer financial data be subject to examination and supervision by prudential regulators.

The release of this information has the potential to adversely affect American consumers for the remainder of their lives and presents unique challenges for all financial institutions in authenticating new and existing customers. Subjecting CRAs and similar organizations to this level of oversight may prevent future breaches.

The .BANK web domain is a trusted, verified, secure, and easily identifiable location on the Internet for the banking community and the customers it serves. With rigorous security standards in place, users of a .BANK website can be assured they are landing on participants’ actual websites as opposed to being redirected elsewhere such as a malicious or spoofed site. .BANK also provides email authentication to mitigate spoofing and phishing and encryption for internet connections to ensure data privacy and security.

Sheltered Harbor is designed to improve resiliency and provide enhanced protections for financial institution customer accounts and data. Sheltered Harbor enables financial institutions to securely store and rapidly restore account information, making it available to customers through a service provider or another financial institution when an institution is unable to recover from a cyber incident in a timely fashion.

Under current federal law, retailers, technology companies, and other parties that process or store consumer financial data are not subject to the same federal data security standards and oversight as financial institutions.

Securing financial data at financial institutions is of limited value if it remains exposed at the point-of-sale and other processing points. To effectively secure customer data, all participants in the payments system, and all entities with access to customer financial information, should be subject to and maintain well-recognized standards such as those created by the Gramm-Leach-Bliley Act (GLBA).

Many states have enacted laws with differing requirements for providing notice in the event of a data breach. This patchwork of state notification laws and potentially overly broad notification requirements only increase burdens and costs, foster confusion, and ultimately are detrimental to customers. 

While notifying customers is appropriate, any national notification standard needs to be accompanied by GLBA-like data security standards for all participants of the financial services industry to provide consumers a greater level of protection. Federal banking agencies should continue to set the standard for financial institutions.

It is equally important that community banks receive timely notification concerning the nature and scope of any breach when bank customer information may have been compromised so that they may take steps to mitigate the damage. Enhanced breach notifications can save community banks time and money while better serving the impacted consumer.

Regardless of where a breach occurs, banks are stewards of the customer financial relationship and take a variety of steps at their own expense to protect the integrity of customer accounts.

These costs should ultimately be borne by the party that incurs the breach. Barring a liability shift, community banks should have access to various cost recovery options. Too often, the breached entity skates by while financial institutions are left to mitigate damages to their customers.

Despite issuing rules, regulations, and guidance, and examining financial institutions for the safekeeping of customer data, regulatory bodies have also been subject to data breaches. During bank examinations, regulators become privy to, and hold, sensitive bank information, including customer information.

Like banks, regulatory agencies have a responsibility to safeguard this sensitive information. Liability from a potential breach into any of the prudential regulators’ systems may be unfairly assigned to community banks that securely submitted their data.