Federal Financial Institutions Examination Council members onTuesday released a revised management booklet, which is part of the“FFIEC Information Technology Examination Handbook.” The NCUA is amember of the FFIEC.

The booklet, which includes IT examination procedures, wassubstantially revised, the FFIEC said in a release. It outlines theprinciples of sound governance and IT governance, and explains howIT risk management relates to enterprise-wide risk management andgovernance.

The updated examination procedures assist examiners inevaluating IT governance as part of overall governance and IT riskmanagement as part of enterprise-wide risk management, bothtailored specifically to financial institutions.

Other relevant changes included:

• Incorporation of cybersecurity concepts as part of informationsecurity.
• Incorporation of management-related concepts from otherbooklets of the IT handbook.
• Augmentation and further delineation of the stages of the ITrisk management process, including risk identification,measurement, mitigation, monitoring and reporting.

The IT handbook, which includes the updated management portion,can be accessed online at http://ithandbook.ffiec.gov/it-booklets/management.aspx.

In July, the FFIEC released a Cybersecurity Assessment Tool to help institutions identifytheir risks and assess cybersecurity preparedness. Appendicesmapping the assessment's baseline maturity statements were added tothe IT handbook.

CU Times and ERM Security released an NCUA IT Audit Survival Guide in September that addressesFFIEC and other regulatory requirements for credit unions. That guide, available for free to CU Times readers, can bedownloaded here.