U.S. banking regulators this week unveiled a proposal to enhancecybersecurity risk-management and resilience standards for thelargest banks and their interconnected entities.

The proposed joint standards by the Federal ReserveBoard, the Federal Deposit Insurance Corp. and the Office of theComptroller of the Currency would apply to depository institutionsand depository institution holding companies with assets of $50billion or more, U.S. operations of foreign banking organizationswith U.S. assets of $50 billion or more, and financial marketinfrastructure companies and nonbank financial companies supervisedby the Federal Reserve.

The enhanced standards would not apply to community banks.Comments are due Jan. 17, 2017.

The proposed rule addresses five categories of cyber standards:cyber risk governance; cyber risk management; internal dependencymanagement; external dependency management; and incident response,cyber resilience and situational awareness.

The agencies said they are considering the implementation of theenhanced standards in a “tiered manner, imposing more stringentstandards on the systems of those entities that are critical to thefunctioning of the financial sector.”

Financial institutions and consumers, the agencies said, “havebecome increasingly dependent on technology to facilitate financialtransactions,” just as the largest, most complex financialinstitutions “rely heavily on technology to engage in national andinternational banking activities and to provide critical servicesto the financial sector and the U.S. economy.”

“As technology dependence in the financial sector continues togrow, so do opportunities for high-impact technology failures andcyber-attacks. Due to the interconnectedness of the U.S. financialsystem, a cyber incident or failure at one interconnected entitymay not only impact the safety and soundness of the entity, butalso other financial entities with potentially systemicconsequences,” the banking regulators said.

Recovery strategies, the regulators said, should include theestablishment of recovery time objectives. The agencies said theyare considering a requirement that covered entities under the ruleset up a recovery time of two hours for their sector-criticalsystems, validated by testing, to recover from a disruptive,corruptive, or destructive cyber event.

The test programs, the agencies said, “would include a range ofscenarios, including severe but plausible scenarios, and wouldchallenge matters such as communications protocols, governancearrangements, and resumption and recovery practices.”

The regulators are issuing the proposed rule before developing amore detailed proposal for consideration, and are seeking commentson potential methodologies that could be used to quantify cyberrisk and to compare cyber risk at entities across the financialsector.