WASHINGTON — NCUA and the other Federal Financial InstitutionsExamination Council regulators have distributed revised guidancefor examiners and financial institutions for identifying securityrisks, evaluating controls, and applicable risk managementpractices.

The updated booklet provides an overhaul of the 2002 version,addressing advances in technology, risk assessments, mitigationstrategies, and regulatory guidance. Additionally, the riskassessment portion has been expanded to reflect the maturation ofthat process related to information security. New or revisedmaterial covering authentication, monitoring programs, and softwaretrustworthiness is also included. Other topics including malware,wireless, remote access, and trust services have also beenincorporated or revised.

“The security of financial institutions' systems and informationis essential to maintaining the privacy of customer information andsafe and sound operations,” the agencies said in a joint release.“The Information Security Booklet describes how an institutionshould protect and secure the systems and facilities that processand maintain information. The booklet calls for financialinstitutions and technology service providers (TSPs) to maintaineffective security programs tailored to the complexity of theiroperations.”