# FDIC FIL-52-2023: Information Technology Risk Examination (InTREx) Procedures

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/FDIC_FIL23052

## Section

- **Citation:** FDIC FIL-52-2023
- **Heading:** Information Technology Risk Examination (InTREx) Procedures
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** FDIC Financial Institution Letters / Information Technology Risk Examination (InTREx) Procedures

## Text

Information Technology Profile
1
Information
Technology
Risk
Examination
Purpose
To provide information about the institution’s Information Technology (IT) and operations to ensure appropriate
resources are assigned to the examination.
Instructions for Completing the Information Technology Profile (ITP)
The ITP contains questions covering significant areas of an institution’s IT and operations functions. Accurate and
timely completion of the ITP will improve the examination process.
Please enter the name of the individual completing the ITP and the executive officer attesting to its accuracy, their
titles, the institution name and location, and the date the ITP was completed.
Preparer Name and Title:
Click here to enter name
Click here to enter title
Institution Name and Location:
Click here to enter a location
Executive Officer’s Name and Title:
Click here to enter title
Date Completed:
Click here to select a date

Information Technology Profile
2
Information
Technology
Risk
Examination
Core Processing
1. Indicate whether core applications are outsourced or hosted in-house (systems hosted by affiliated
organizations are outsourced). Check all that apply. Leave blank if not applicable.
Outsourced
In-House
General Ledger


Loans


Deposits


Investments


Trust


Click here to enter comment
Network
2. Does the institution utilize any of the following types of cloud services? Check all that apply.
 Software as a Service (SaaS) 
 Infrastructure as a Service (IaaS) 
 Platform as a Service (PaaS) 
 N/A
3. Who has remote access capability to network resources? Check all that apply.
 No one
 Vendors
 Employees or Board Members (Bank-owned device)
 Employees or Board Members (Personal device)
4. Does the institution have a wireless network? Check all that apply.
 No
 Stand-alone guest network
 Production internal network
5
a Service (IaaS) 
 Platform as a Service (PaaS) 
 N/A
3. Who has remote access capability to network resources? Check all that apply.
 No one
 Vendors
 Employees or Board Members (Bank-owned device)
 Employees or Board Members (Personal device)
4. Does the institution have a wireless network? Check all that apply.
 No
 Stand-alone guest network
 Production internal network
5. Indicate whether network monitoring (e.g., performance, intrusion detection, web filtering) and
network operations are managed in-house or outsourced? Check all that apply.
Outsourced In-House
Network monitoring



Information Technology Profile
3
Information
Technology
Risk
Examination
Outsourced In-House
Network operations


Payments and Internet Banking
6. Indicate whether online banking services are outsourced or hosted in-house. Check all that apply.
Leave blank if not applicable.
Outsourced In-House
Consumer
Internet Banking
Mobile Banking
Mobile Deposit





3

Commercial
Internet Banking
Mobile Banking
Remote Deposit Capture






7. What type of ACH origination transactions are processed? Check all that apply.
 None
 Standard ACH
 Same day ACH
 Third Party Payment Processor
Development and Acquisition
8. Has the institution engaged in merger or acquisition activity since the previous exam, or plans to do
so in the next 6 months?
 Yes
 No

Information Technology Profile
4
Information
Technology
Risk
Examination
9. Does your institution provide IT services to other institutions (including affiliates)? Check all that
apply.
 No
 Network support and applications
 Core processing
 Other
10. Does the institution support any custom software or engage in any custom software development?
Check all that apply.
Outsourced
In-House
No software development


Non-critical software or


Critical systems (e.g., custom coded core systems)


API


Other


Click here to enter comment
Cybersecurity
11
 Network support and applications
 Core processing
 Other
10. Does the institution support any custom software or engage in any custom software development?
Check all that apply.
Outsourced
In-House
No software development


Non-critical software or


Critical systems (e.g., custom coded core systems)


API


Other


Click here to enter comment
Cybersecurity
11. Has the institution assessed its cybersecurity risk and preparedness in the last 12 months using FFIEC
CAT, Cyber Risk Institute ("CRI") Profile (formerly the FSSCC Profile), NIST or any other assessment tool?
 Not assessed
 Assessed

Information Technology Profile

5

Information
Technology
Risk
Examination
12. Has your institution or any of your service providers experienced a cyber attack, significant security
event, or operational interruption since the previous examination? Check all that apply.
 No
 Institution
 Service Provider

Other
13. Have there been any significant changes in technology or services since the previous examination, or
are any changes expected in the next 6 months? Check all that apply.

 No change
 Core system
 Significant network
 Significant application
 Key IT management or personnel
 Other new technology or services (e.g. artificial intelligence, blockchain, P2P payments)
Click here to enter comment

InTREx Core Modules – Audit
September 2023

Page 1 of 7

Audit
Institution Name: Click here to enter Institution Name
Cert/RSSD#:
Preparer:
Exam Start Date: Click or tap to enter a date
Core Analysis Decision Factors

Complete the following procedures at each examination. The resources listed below are not intended to
be all-inclusive, and additional guidance may exist
x Core Modules – Audit
September 2023

Page 1 of 7

Audit
Institution Name: Click here to enter Institution Name
Cert/RSSD#:
Preparer:
Exam Start Date: Click or tap to enter a date
Core Analysis Decision Factors

Complete the following procedures at each examination. The resources listed below are not intended to
be all-inclusive, and additional guidance may exist.
Resources
 FFIEC IT Examination Handbook – Audit

Interagency Policy Statement on the Internal Audit Function and its Outsourcing

Interagency Policy Statement on External Auditing Programs of Banks and Savings Associations

Interagency Guidelines Establishing Standards for Safety and Soundness

Interagency Guidelines Establishing Information Security Standards
 FDIC Risk Management Manual of Examination Policies - Section 4.2 Internal Routine and
Controls
Preliminary Review
Review items relating to internal or external IT audit, such as:
 Examination reports and workpapers
 Pre-examination memoranda and file correspondence
 IT audit charter and policy
 IT audit schedule
 IT audit risk assessment
 Cybersecurity self-assessments
 Internal and external IT audit reports
 Board/Committee minutes related to IT audits
 Organization chart reflecting the audit reporting structure
 Actions taken by management to address IT audit and examination deficiencies
Note: Refer to the FFIEC IT Examination Handbook – Audit if additional analysis is necessary to
complete this module.
Information
Technology
Risk
Examination
ternal and external IT audit reports
 Board/Committee minutes related to IT audits
 Organization chart reflecting the audit reporting structure
 Actions taken by management to address IT audit and examination deficiencies
Note: Refer to the FFIEC IT Examination Handbook – Audit if additional analysis is necessary to
complete this module.
Information
Technology
Risk
Examination

InTREx Core Modules – Audit
September 2023

Page 2 of 7

Audit Summary
1-Strong ❒ 2-Satisfactory ❒ 3-Less Than Satisfactory ❒ 4-Deficient ❒ 5-Critically Deficient ❒

Decision Factor 1 – Board and Management Oversight
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The level of independence maintained by audit and the quality of the oversight and support provided
by the Board of Directors and management.

Procedure 1 – Audit Independence
Evaluate the independence of the IT audit function and the degree to which it identifies and
reports weaknesses and risks to the Board of Directors or designated Audit Committee in a
thorough and timely manner. Consider the following:
 IT auditor reports directly to the Board or the Audit Committee
 IT auditor has no conflicting duties
 External IT audit firms do not have conflicts of interest (e.g., IT consulting)
Click here to enter comments

Control Test
Review the organization chart, the auditor job description, and Audit Committee minutes to
verify the reporting structure and independence of the audit function.
Click here to enter control test comments

Procedure 2 – Board and Management Support
Evaluate the quality of oversight and support provided by the Board of Directors and
management
g)
Click here to enter comments

Control Test
Review the organization chart, the auditor job description, and Audit Committee minutes to
verify the reporting structure and independence of the audit function.
Click here to enter control test comments

Procedure 2 – Board and Management Support
Evaluate the quality of oversight and support provided by the Board of Directors and
management. Consider the following:
 The audit policy or charter outlines the overall authority, scope, and responsibilities of the
IT audit function
 The Board or the Audit Committee review all written audit reports
 Deviations from planned audit schedules are approved by the Board or Audit Committee

InTREx Core Modules – Audit
September 2023

Page 3 of 7

Decision Factor 2 – Audit Planning
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The adequacy of IT coverage in the overall audit plan and the adequacy of the underlying risk analysis
methodology used to formulate that plan.

Procedure 4 – Risk Assessment Process
Evaluate the IT audit risk assessment process. Consider the following:
 Identification of a comprehensive IT audit universe
 Utilization of a risk scoring/ranking system to prioritize audit resources
 Establishment of Board-approved audit plans and schedules based on risk

Procedure 5 – IT Risk Exposure
Determine whether audit plans or audit risk assessments adequately addresses IT risk exposure
throughout the institution and its service providers. Areas to consider include, but are not
limited to, the following:
 Information security, including compliance with the Interagency Guidelines Establishing
Information Security Standards
 Incident response
 Cybersecurity

Procedure 3 – Audit Outsourcing
If IT audit is outsourced, review and evaluate outsourcing contracts, audit engagement letters,
and policies
its service providers. Areas to consider include, but are not
limited to, the following:
 Information security, including compliance with the Interagency Guidelines Establishing
Information Security Standards
 Incident response
 Cybersecurity

Procedure 3 – Audit Outsourcing
If IT audit is outsourced, review and evaluate outsourcing contracts, audit engagement letters,
and policies. Determine whether the documents include the following:
 Expectations and responsibilities for both parties
 The scope, timeframes, and cost of work to be performed by the outside auditor
 Institution access to audit workpapers

Click here to enter comments

Control Test
Review the engagement letters for any current outsourced IT audits. Refer to the Interagency
Policy Statement on the Internal Audit Function and its Outsourcing for provisions typically
included in engagement letters.

InTREx Core Modules – Audit
September 2023

Page 4 of 7

 Network architecture, including firewalls and intrusion detection/prevention systems
 Security monitoring, including logging practices
 Change management
 Patch management
 Third-party outsourcing
 Social engineering
 Funds transfer
 Online banking
 Business continuity management

Baseline Cybersecurity Statements
Check if not met (x)
❒ Independent audit or review evaluates policies, procedures, and controls across the
institution for significant risks and control issues associated with the institution's operations,
including risks in new products, emerging technologies, and information systems.
❒ Logging practices are independently reviewed periodically to ensure appropriate log
management (e.g., access controls, retention, and maintenance).
❒ The independent audit function validates controls related to the storage or transmission of
confidential data.

Control Test
Validate that IT audits have been performed according to the approved audit plan
nologies, and information systems.
❒ Logging practices are independently reviewed periodically to ensure appropriate log
management (e.g., access controls, retention, and maintenance).
❒ The independent audit function validates controls related to the storage or transmission of
confidential data.

Control Test
Validate that IT audits have been performed according to the approved audit plan.

Decision Factor 3 – Audit Reporting and Activities
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The scope, frequency, accuracy, and timeliness of internal and external audit reports and the
effectiveness of audit activities in assessing and testing IT controls.

Procedure 6 – Audit Frequency
Determine whether the frequency of IT audits aligns with the risk assessment results and whether
the scope of IT audits is appropriate for the complexity of operations.
Click here to enter comments

InTREx Core Modules – Audit
September 2023

Page 5 of 7

Procedure 7 – Audit Reports
Review IT audit reports issued since the previous examination. Evaluate whether the reports
adequately:
 Describe the scope and objectives
 Describe the level and extent of control testing
 Describe deficiencies
 Note management’s response, including commitments for corrective action and timelines for
completion
 Detail follow-up/correction of prior IT audit or regulatory examination exceptions

Procedure 8 – Control Evaluation
Evaluate the ability of the IT audit function to accurately assess, test, and report the effectiveness
of controls. Consider the following:
 IT examination and Audit findings
 Audit risk assessment
 Cyber incidents
 Other significant IT events
 Assessment of potential impact of control deficiencies on other areas of operations

Click here to enter comments

Control Test
Sample the audit workpapers for adequacy and completeness
accurately assess, test, and report the effectiveness
of controls. Consider the following:
 IT examination and Audit findings
 Audit risk assessment
 Cyber incidents
 Other significant IT events
 Assessment of potential impact of control deficiencies on other areas of operations

Click here to enter comments

Control Test
Sample the audit workpapers for adequacy and completeness.
Click here to enter control test comments

Decision Factor 4 – Auditor Qualifications
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The qualifications of the auditor, staff succession, and continued development through training.
Click here to enter comments

Procedure 9 – Auditor Expertise and Training
Determine whether auditor expertise and training are sufficient for the complexity of the IT
function in relation to the technology and overall risk at the institution. Consider the following:
 Education

InTREx Core Modules – Audit
September 2023

Page 6 of 7

 Experience
 On-going training for both internal and external personnel as appropriate

Decision Factor 5 – Audit Finding Resolution
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The existence of timely and formal follow-up and reporting on management's resolution of identified
problems or weaknesses.
Click here to enter comments

Procedure 10 – Audit Monitoring and Resolution
Evaluate the audit department’s process for monitoring audit and regulatory findings until
resolved
Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
The existence of timely and formal follow-up and reporting on management's resolution of identified
problems or weaknesses.
Click here to enter comments

Procedure 10 – Audit Monitoring and Resolution
Evaluate the audit department’s process for monitoring audit and regulatory findings until
resolved. Consider the following:

A formal tracking system that assigns priority, responsibility, and target date for
resolution

Timely and formal status reporting

Tracking and reporting of changes on target dates or proposed corrective actions to the
Board or Audit Committee

Process to ensure findings are resolved in a timely manner

Independent validation to assess the effectiveness of corrective measures

Baseline Cybersecurity Statements
Check if not met (x)
❒ Issues and corrective actions from internal audits and independent testing/assessments are
formally tracked to ensure procedures and control lapses are resolved in a timely manner.

Decision Factor 6 - Supplemental Risk Factors and Procedures
Strong ❒ Satisfactory ❒ Less Than Satisfactory ❒ Deficient ❒ Critically Deficient ❒
If applicable, include a summary comment below for any additional risk factors reviewed or
examination procedures performed that may not be directly referenced in the Decision Factors above.
(These risk factors and procedures could include, but are not limited to, Supplemental workprograms,

InTREx Core Modules – Audit
September 2023

Page 7 of 7

End of Audit Core Analysis.
FFIEC workprograms, agency-specific workprograms, and/or new guidance not addressed in the
modules.)
Click here to enter comments
may not be directly referenced in the Decision Factors above.
(These risk factors and procedures could include, but are not limited to, Supplemental workprograms,

InTREx Core Modules – Audit
September 2023

Page 7 of 7

End of Audit Core Analysis.
FFIEC workprograms, agency-specific workprograms, and/or new guidance not addressed in the
modules.)
Click here to enter comments

InTREx Core Modules – Development & Acquisition
September 2023

Page 1 of 8

Institution Name:
Cert#
Development and Acquisition
Preparer:
Start Date:
Core Analysis Decision Factors

Note: refer to the FFIEC IT Examination Handbook - Development and Acquisition if additional analysis is
necessary to complete this module.
Decision Factors – Development and Acquisition
DA.1.
The level and quality of oversight and support of systems development and acquisition activities by
senior management and the Board of Directors.
▼ Procedures #1-4

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.2.
The quality of project management programs and practices.
▼ Procedure #5

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.3.
The adequacy of controls over program changes.
▼ Procedure #6

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.4.
The development of information technology solutions that meet the needs of end users.
▼ Procedure #7

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.5
If applicable, evaluate the adequacy of source code and programming controls.
▼ Procedures #8-9

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.6

If applicable, include a summary comment below for any additional risk factors reviewed or
examination procedures performed that may not be directly referenced in the Decision Factors
above
.5
If applicable, evaluate the adequacy of source code and programming controls.
▼ Procedures #8-9

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
DA.6

If applicable, include a summary comment below for any additional risk factors reviewed or
examination procedures performed that may not be directly referenced in the Decision Factors
above. (These risk factors and procedures could include, but are not limited to, Supplemental
Workprograms, FFIEC workprograms, agency-specific workprograms, and/or new guidance not
addressed in the modules.)

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
Information
Technology
Risk
Examination

InTREx Core Modules – Development & Acquisition
September 2023

Page 2 of 8

Development and Acquisition Summary

URSIT Development and Acquisition Rating:

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 3 of 8

Complete the following procedures at each examination. The resources listed below are not intended to be all-
inclusive, and additional guidance may exist.
Resources

FFIEC IT Examination Handbook – Development and Acquisition

Interagency Guidelines Establishing Standards for Safety and Soundness

Interagency Guidelines Establishing Information Security Standards

Bank Service Company Act
Preliminary Review
Review items relating to Development and Acquisition, such as:

Change management policy and procedures

Project management policy and procedures

Vendor management policy and procedures (as related to acquisition)

Products and Services Template

Board and IT-related committee minutes

IT-related contracts and license agreements

IT-related audits
1. Assess the level and quality of oversight and support of acquisition activities by senior management and the
Board of Directors
s

Project management policy and procedures

Vendor management policy and procedures (as related to acquisition)

Products and Services Template

Board and IT-related committee minutes

IT-related contracts and license agreements

IT-related audits
1. Assess the level and quality of oversight and support of acquisition activities by senior management and the
Board of Directors. Consider the following:

Alignment of business and technology objectives

Establishment of project, technology committee, and Board reporting requirements

Commitment of the Board and senior management to promote new products

Level and quality of Board-approved project standards and procedures

Assignment of personnel to address information security, audit, and testing for technology-related
projects

Establishment of segregation of duties or compensating controls

Identification and replacement of systems nearing or at end-of-life
Decision Factor 1 ▲

Vendor Management - Acquisition (See also Management Module – Procedure #13 for Vendor
Management – Ongoing Monitoring
2. Evaluate the due diligence process in selecting key vendors. The reviews should focus on an entity’s
financial condition, relevant experience, knowledge of applicable laws and regulations (e.g., transactions with
affiliates), reputation, scope of operations, and effectiveness of controls. Consider management’s review of
the following:

Financial statements (e.g., annual reports and SEC filings)
e the due diligence process in selecting key vendors. The reviews should focus on an entity’s
financial condition, relevant experience, knowledge of applicable laws and regulations (e.g., transactions with
affiliates), reputation, scope of operations, and effectiveness of controls. Consider management’s review of
the following:

Financial statements (e.g., annual reports and SEC filings)

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 4 of 8

Experience and ability to implement and monitor the proposed activity

Business reputation, status in the industry, and sustainability

Qualifications, training, and experience of the company’s principals and staff

Strategies and goals, including service philosophies, quality initiatives, efficiency improvements, and
employment policies

Existence of significant complaints, litigation, or regulatory actions against the company

Ability to perform proposed functions using current systems or the need to make additional investments

Use of other parties or subcontractors by the third party

Scope of internal controls, information security, privacy protections, and audit coverage

Business resumption strategies and contingency plans

Knowledge of relevant consumer protection regulations

Adequacy of management information systems

Insurance coverage

Eligibility to perform as a service provider given the existence of any outstanding enforcement actions
against the third party, and the requirements of Section 19 of the FDI Act that may apply to institution-
affiliated parties

Record retention and maintenance practices

Identification of potential conflicts of interest

Impact of proposed contracts on the third-party’s operations and financial condition
Decision Factor 1 ▲

Oversee Service Provider Arrangements
g enforcement actions
against the third party, and the requirements of Section 19 of the FDI Act that may apply to institution-
affiliated parties

Record retention and maintenance practices

Identification of potential conflicts of interest

Impact of proposed contracts on the third-party’s operations and financial condition
Decision Factor 1 ▲

Oversee Service Provider Arrangements. Each bank shall:

Exercise appropriate due diligence in selecting its service providers

Risk-based due diligence is performed on prospective third parties before contracts are signed,
including reviews of their background, reputation, financial condition, stability, and security controls.

Control Test
Review due diligence documentation for any vendors or service providers added or renewed since the
prior examination to ensure the depth of the due diligence aligns with the criticality of the services to be
provided.

3. Determine whether the following topics are considered when contracts are being structured. The applicability
of each topic is dependent upon the nature and significance of the third-party relationship. Contracts should
clearly set forth the rights and responsibilities of each party, including the following:

Timeframe covered by the contract

Frequency, format, and specifications of the service or product to be provided

Other services to be provided by the third party, such as software support and maintenance, training of
employees, distribution of required disclosures to institution’s customers, and customer service

Adequate and measureable service level agreements (SLAs)

Requirement that the third party comply with all applicable laws, regulations, and regulatory guidance

Authorization for the institution and appropriate Federal and State regulators to have access to the records
of the third party as necessary to evaluate compliance with laws, rules, and regulations
, and customer service

Adequate and measureable service level agreements (SLAs)

Requirement that the third party comply with all applicable laws, regulations, and regulatory guidance

Authorization for the institution and appropriate Federal and State regulators to have access to the records
of the third party as necessary to evaluate compliance with laws, rules, and regulations

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 5 of 8

Identification of which party will be responsible for delivering any required customer disclosures

Insurance coverage to be maintained by the third party

Terms relating to any use of premises, equipment, or employees

Permissibility/prohibition of the third party to subcontract or use another party to meet its obligations

Authorization for the institution to monitor and periodically review the third party for compliance with its
agreement

Independent validation of security controls

Indemnification or other compensation for contract violations

Confidentiality and security of information

Notification of any information security or business continuity incident in a timely manner

Exit/Deconversion costs and responsibilities
Decision Factor 1 ▲

Oversee Service Provider Arrangements. Each bank shall:

Require its service providers by contract to implement appropriate measures designed to meet the
objectives of these Guidelines.

Formal contracts that address relevant security and privacy requirements are in place for all third
parties that process, store, or transmit confidential data or provide critical services.
Contracts acknowledge that the third party is responsible for the security of the institution’s confidential
data that it possesses, stores, processes, or transmits.
Contracts stipulate that the third-party security controls are regularly reviewed and validated by an
independent party
place for all third
parties that process, store, or transmit confidential data or provide critical services.
Contracts acknowledge that the third party is responsible for the security of the institution’s confidential
data that it possesses, stores, processes, or transmits.
Contracts stipulate that the third-party security controls are regularly reviewed and validated by an
independent party.
Contracts identify the recourse available to the institution should the third party fail to meet defined
security requirements.
Contracts establish responsibilities for responding to security incidents.

Control Test
Review a sample of critical vendor contracts entered into since the previous examination to determine
whether they meet the criteria above.

4. Evaluate the process for identifying, documenting, and reporting service provider relationships (both
domestic and foreign-based) to primary Federal and State regulators.
Decision Factor 1 ▲

Control Test
Obtain documentation verifying that regulators were notified of new service provider relationships
entered into since the prior examination. Refer to the Bank Service Company Act.

Project and Change Management

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 6 of 8
5. Evaluate the institution’s program for managing significant projects (e.g., system conversions, product
enhancements, infrastructure upgrades, system maintenance)
nce the prior examination. Refer to the Bank Service Company Act.

Project and Change Management

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 6 of 8
5. Evaluate the institution’s program for managing significant projects (e.g., system conversions, product
enhancements, infrastructure upgrades, system maintenance). Consider the following:

Specifications and requirements

Risk assessments

Feasibility studies

Cost/benefit analyses

Vendor reviews

Contract reviews

End-user involvement

Project plans

Project status reports

Test plans

Test results

Post-implementation reviews
Decision Factor 2 ▲

Control Test
Review a sample of documentation for significant technology projects, including the following:

Initial budgets and projected timelines versus actual results

Project management and technology committee reports

Test documentation, including plans, scripts, results, and error rates

Post-conversion reports

Suspense accounts for outstanding items

6. Evaluate change management procedures (e.g., software updates, vendor releases, and emergency program
changes) for all critical systems and applications. Consider the following:

Request and approval

Testing

Implementation

Backup and backout

Documentation

User notification and training

If all software updates and vendor releases have not been installed, review management’s documentation
supporting the delay.
Decision Factor 3 ▲

A change management process is in place to request and approve changes to systems configurations,
hardware, software, applications, and security tools.

Control Test
Review a sample of change management documentation for software updates and/or emergency
program changes.
releases have not been installed, review management’s documentation
supporting the delay.
Decision Factor 3 ▲

A change management process is in place to request and approve changes to systems configurations,
hardware, software, applications, and security tools.

Control Test
Review a sample of change management documentation for software updates and/or emergency
program changes.

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 7 of 8

7. Assess the ability of information technology solutions to meet the needs of the end users. Consider the
following:

Satisfaction of end users

Quality of reporting tools used by management

Issues noted in meeting minutes
Decision Factor 4 ▲

If applicable, answer the following questions relating to source code and programming controls.
8. If critical vendor software is used in-house, determine whether the software contract or license agreement
addresses the following:

Possession of current source code or provision that the code is held in escrow

The right to obtain, use, and modify the software in the event the software vendor is unable or unwilling
to properly maintain the program(s)
Decision Factor 5 ▲

Intellectual property and production code are held in escrow.

Control Test
Verify the institution has obtained confirmation from the escrow agent that the current version of the
source code is held in escrow.

9
scrow

The right to obtain, use, and modify the software in the event the software vendor is unable or unwilling
to properly maintain the program(s)
Decision Factor 5 ▲

Intellectual property and production code are held in escrow.

Control Test
Verify the institution has obtained confirmation from the escrow agent that the current version of the
source code is held in escrow.

9. If the institution is using or supporting custom software, engaging in custom software development or
programming, or contracting with third parties for the development of custom software (e.g., report
development/queries, bridging/middleware/interfaces, ancillary applications), evaluate the following systems
development life cycle (SDLC) processes and procedures:

Segregation of duties and other security concerns

Software documentation

Version control

Quality assurance and user-acceptance testing

Emergency software fixes, including having a timely independent review of the fix and updating
documentation

Restrictions on developer access, with no access to the quality control or production environment

Masking of customer data to protect sensitive customer information in the development environment

Independent reviews of software before migration into the production environment to ensure there are no
security or integrity issues

Development and Acquisition
Procedures

InTREx Core Modules – Development & Acquisition
September 2023

Page 8 of 8

For institutions with significant in-house programming, this core procedure may not be sufficient in and of itself. Examiners
should utilize the FFIEC IT Examination Handbook – Development & Acquisition for more in-depth examination procedures
at institutions with significant in-house programming. Overall findings and conclusions should be pulled forward from that
workprogram into the comment box below
utions with significant in-house programming, this core procedure may not be sufficient in and of itself. Examiners
should utilize the FFIEC IT Examination Handbook – Development & Acquisition for more in-depth examination procedures
at institutions with significant in-house programming. Overall findings and conclusions should be pulled forward from that
workprogram into the comment box below.
Decision Factor 5 ▲

Developers working for the institution follow secure program coding practices, as part of a system
development life cycle (SDLC), that meet industry standards.
The security controls of internally developed software are periodically reviewed and tested.
The security controls in internally developed software code are independently reviewed before
migrating the code to production.
Production and non-production environments are segregated to prevent unauthorized access or
changes to information assets.

Control Test
Review periodic tests of the security controls over internally developed software and independent
reviews of software integrity prior to placing into production.

End of Development and Acquisition Core Analysis.

InTREx Core Modules – Management

September 2023
Page 1 of 14

Institution Name:
Cert#
Management
Preparer:
Start Date:
Core Analysis Decision Factors

Note: refer to the applicable FFIEC IT Examination Handbooks if additional analysis is necessary to
complete this module.
Decision Factors – Management
M.1.
The level and quality of oversight and support of IT activities by the Board of Directors and
management.
▼ Procedures #1-3

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.2.
The ability of management to provide information reports necessary for informed planning and decision
making in an effective and efficient manner.
▼ Procedure #4

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.3
anagement.
▼ Procedures #1-3

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.2.
The ability of management to provide information reports necessary for informed planning and decision
making in an effective and efficient manner.
▼ Procedure #4

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.3.
The adequacy of, and conformance with, internal policies and controls addressing IT operations and risks
of significant business activities.
▼ Procedure #5-6

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.4.
The level of awareness of and compliance with laws and regulations.
▼ Procedures #7-11

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.5.
The level of planning for management succession.
▼ Procedure #12

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.6.
The adequacy of contracts and management's ability to monitor relationships with third-party servicers.
▼ Procedure #13

Information
Technology
Risk
Examination

InTREx Core Modules – Management

September 2023
Page 2 of 14
Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.7.
The adequacy of risk assessment processes to identify, measure, monitor, and control risks.

▼ Procedures #14-16

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.8.
If applicable, include a summary comment below for any additional risk factors reviewed or examination
procedures performed that may not be directly referenced in the Decision Factors above
acy of risk assessment processes to identify, measure, monitor, and control risks.

▼ Procedures #14-16

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐
M.8.
If applicable, include a summary comment below for any additional risk factors reviewed or examination
procedures performed that may not be directly referenced in the Decision Factors above. (These risk
factors and procedures could include, but are not limited to, Supplemental Workprograms, FFIEC
workprograms, agency-specific workprograms, and/or new guidance not addressed in the modules.)

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☐
Critically deficient ☐

Management Summary

URSIT Management Rating:

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 3 of 14

Complete the following procedures at each examination. The resources listed below are not intended to be all
inclusive, and additional guidance may exist.
Resources

FFIEC IT Examination Handbook – Management

FFIEC IT Examination Handbook – Outsourcing Technology Services

Interagency Guidelines Establishing Standards for Safety and Soundness

Interagency Guidelines Establishing Information Security Standards

Interagency Guidelines on Identity Theft Detection, Prevention, and Mitigation

Examination Documentation (ED) Module – Third-Party Risk

Foreign-Based Third-Party Service Providers Guidance on Managing Risk in These Outsourcing
Relationships

SR 13-19 Guidance on Managing Outsourcing Risk
Preliminary Review
Review items relating to Management, such as:

The committees, names, and titles of the individual(s) responsible for managing IT and information security

Board and IT-related committee minutes

IT-related policies

IT-related risk assessments, including cybersecurity

Business and IT organization charts

IT job descriptions

Qualifications of key IT employees

IT-related audits

Insurance policies
nt, such as:

The committees, names, and titles of the individual(s) responsible for managing IT and information security

Board and IT-related committee minutes

IT-related policies

IT-related risk assessments, including cybersecurity

Business and IT organization charts

IT job descriptions

Qualifications of key IT employees

IT-related audits

Insurance policies

Strategic plans

Succession plans

IT budgets
1. Evaluate the quality of Board and management oversight of the IT function. Consider the following:

Adequacy of the process for developing and approving IT policies

Scope and frequency of IT-related meetings

Existence of a Board-approved comprehensive information security program

Designation of an individual or committee to oversee the information security program, including
cybersecurity

Composition of IT-related committees (e.g., Board, senior management, business lines, audit, and IT
personnel)

Effectiveness of IT organizational structure, including:

Direct reporting line from IT management to senior level management

Appropriate segregation of duties between business functions and IT functions

Appropriate segregation of duties within the IT function

Adequacy of resources (e.g., staffing, system capacity)

Qualifications of IT staff, including:

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 4 of 14

Training

Certifications

Experience

Technology support for business lines

Generation and review of appropriate IT monitoring reports

Adequacy of employee training
Decision Factor 1 ▲

The Board of Directors or an appropriate committee of the Board of each bank shall:

Approve the bank's written information security program.

Oversee the development, implementation, and maintenance of the bank's information security
program, including assigning specific responsibility for its implementation and reviewing reports from
management
employee training
Decision Factor 1 ▲

The Board of Directors or an appropriate committee of the Board of each bank shall:

Approve the bank's written information security program.

Oversee the development, implementation, and maintenance of the bank's information security
program, including assigning specific responsibility for its implementation and reviewing reports from
management.

Designated members of management are held accountable by the Board or an appropriate Board
committee for implementing and managing the information security and business continuity programs.
Management assigns accountability for maintaining an inventory of organizational assets.
Processes are in place to identify additional expertise needed to improve information security defenses.
Information security roles and responsibilities have been identified.
Information security risks are discussed in management meetings when prompted by highly visible cyber
events or regulatory alerts.
Employee access to systems and confidential data provides for separation of duties.

2. Evaluate the quality of IT reporting to the Board of Directors. Consider reports such as:

IT risk assessments

IT standards and policies

Resource allocation (e.g., major hardware/software acquisitions and project priorities)

Status of major projects

Corrective actions on significant audit and examination deficiencies

Information security program, including cybersecurity
Decision Factor 1 ▲

Report to the Board. Each bank shall report to its Board or an appropriate committee of the Board at least
annually. This report should describe the overall status of the information security program and the bank's
compliance with these Guidelines
rrective actions on significant audit and examination deficiencies

Information security program, including cybersecurity
Decision Factor 1 ▲

Report to the Board. Each bank shall report to its Board or an appropriate committee of the Board at least
annually. This report should describe the overall status of the information security program and the bank's
compliance with these Guidelines. The report, which will vary depending upon the complexity of each
bank's program should discuss material matters related to its program, addressing issues such as: risk
assessment; risk management and control decisions; service provider arrangements; results of testing;
security breaches or violations, and management's responses; and recommendations for changes in the
information security program.

Management provides a written report on the overall status of the information security and business
continuity programs to the Board or an appropriate Board committee at least annually.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 5 of 14
The institution prepares an annual report of security incidents or violations for the Board or an
appropriate Board committee.

Control Test
Review the most recent annual information security program report to the Board and ensure it covers the
minimum required elements outlined in the Information Security Standards.

3. Evaluate the adequacy of the short- and long-term IT strategic planning and budgeting process. Consider the
following:

Involvement of appropriate parties

Identification of significant planned changes

Alignment of business and technology objectives

Ability to promptly incorporate new or updated technologies to adapt to changing business needs

Coverage of any controls, compliance, or regulatory issues which may arise or need to be considered
Decision Factor 1 ▲

The budgeting process includes information security related expenses and tools.

4
of significant planned changes

Alignment of business and technology objectives

Ability to promptly incorporate new or updated technologies to adapt to changing business needs

Coverage of any controls, compliance, or regulatory issues which may arise or need to be considered
Decision Factor 1 ▲

The budgeting process includes information security related expenses and tools.

4. Evaluate the adequacy of management information system (MIS) reports (e.g., lending, concentrations, interest
rate risk) and the reliability management can place upon those reports in the business decision-making process.
Consider the following elements of an effective MIS report:

Timeliness

Accuracy

Consistency

Completeness

Relevance
Decision Factor 2 ▲

Control Test
Obtain feedback from risk management and compliance examiners regarding the quality and usefulness of
reports provided for management decisions.

5. Evaluate management’s ability and willingness to take timely and comprehensive corrective action for known
problems and findings noted in previous IT examination reports, audits, service provider/vendor reviews, and
internal reviews (e.g., disaster recovery, incident response, cybersecurity tests).
Decision Factor 3 ▲

Issues identified in assessments are prioritized and resolved based on criticality and within the time frames
established in the response to the assessment report.
known
problems and findings noted in previous IT examination reports, audits, service provider/vendor reviews, and
internal reviews (e.g., disaster recovery, incident response, cybersecurity tests).
Decision Factor 3 ▲

Issues identified in assessments are prioritized and resolved based on criticality and within the time frames
established in the response to the assessment report.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 6 of 14

Control Test
Review the audit tracking report to ensure management is resolving issues in a timely manner.

6. Evaluate whether written policies, control procedures, and standards are thorough and properly reflect the
complexity of the IT environment. Also, evaluate whether these policies, control procedures, and standards
have been formally adopted, communicated, and enforced. Consider the following:

Information security, including cybersecurity

Network security, including intrusion detection

Incident response, including Suspicious Activity Reports

Business continuity

Acceptable use

Access rights

Electronic funds transfer

Vendor management/Third-party risk

Remote access

Bring Your Own Device (BYOD)

Institution-issued mobile devices

Anti-virus/Anti-malware

Patch management

Unauthorized/Unlicensed software
Decision Factor 3 ▲

The institution has policies commensurate with its risk and complexity that address the concepts of
information technology risk management, threat information sharing, and information security.
An information security and business continuity risk management function(s) exists within the institution.
The institution has policies commensurate with its risk and complexity that address the concepts of information
technology risk management.

Control Test
Review procedures for communicating policies to staff.
Review internal audit testing of policy adherence.

7
rmation security.
An information security and business continuity risk management function(s) exists within the institution.
The institution has policies commensurate with its risk and complexity that address the concepts of information
technology risk management.

Control Test
Review procedures for communicating policies to staff.
Review internal audit testing of policy adherence.

7. Evaluate the written information security program and ensure that it includes administrative, technical, and
physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its
activities. Consider the following:

Access controls on customer information systems

Access restrictions at physical locations containing customer information

Encryption of electronic customer information, including while in transit or in storage on networks or
systems

Procedures designed to ensure that customer information system modifications are consistent with the
institution's information security program

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 7 of 14

Dual control procedures, segregation of duties, and employee background checks for employees with
responsibilities for or access to customer information

Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer
information systems

Incident response programs that specify actions to be taken when the institution suspects or detects that
unauthorized individuals have gained access to customer information systems, including appropriate reports
to regulatory and law enforcement agencies

Measures to protect against destruction, loss, or damage of customer information due to potential
environmental hazards, such as fire and water damage or technological failures

Measures for properly disposing of sensitive customer/consumer data containing personally identifiable
information
Decision Factor 4 ▲

A bank's
opriate reports
to regulatory and law enforcement agencies

Measures to protect against destruction, loss, or damage of customer information due to potential
environmental hazards, such as fire and water damage or technological failures

Measures for properly disposing of sensitive customer/consumer data containing personally identifiable
information
Decision Factor 4 ▲

A bank's information security program shall be designed to:

Ensure the security and confidentiality of customer information;

Protect against any anticipated threats or hazards to the security or integrity of such information;

Protect against unauthorized access to or use of such information that could result in substantial harm
or inconvenience to any customer; and

Ensure the proper disposal of customer information and consumer information.

Measures to protect against destruction, loss, or damage of customer information due to potential
environmental hazards, such as fire and water damage or technological failures.

Develop, implement, and maintain appropriate measures to properly dispose of customer information and
consumer information.

Manage and Control Risk. Each bank shall design its information security program to control the
identified risks, commensurate with the sensitivity of the information as well as the complexity and scope of
the bank's activities.

Adjust the Program. Each bank shall monitor, evaluate, and adjust, as appropriate, the information
security program in light of any relevant changes in technology, the sensitivity of its customer information,
internal or external threats to information, and the bank's own changing business arrangements, such as
mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to
customer information systems.

All elements of the information security program are coordinated enterprise-wide.
Management holds employees accountable for complying with the information security program
or external threats to information, and the bank's own changing business arrangements, such as
mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to
customer information systems.

All elements of the information security program are coordinated enterprise-wide.
Management holds employees accountable for complying with the information security program.
Threat information is used to enhance internal risk management and controls.
The institution has an information security strategy that integrates technology, policies, procedures, and
training to mitigate risk.

Control Test
Select a sample of controls or safeguards from the information security program and map the controls back
to the threats identified in the risk assessment.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 8 of 14

8. Evaluate the information security training program, including cybersecurity. Consider the following:

Periodic training of all staff, including the Board

Specialized training for employees in critical positions (i.e., system administrators, information security
officer)

Distribution of latest regulatory and cybersecurity alerts

Communication of acceptable use expectations

Customer awareness program
Decision Factor 4 ▲

Train staff to implement the bank's information security program.

Annual information security training is provided.
Annual information security training includes incident response, current cyber threats (e.g., phishing,
spear phishing, social engineering, and mobile security), and emerging issues.
Situational awareness materials are made available to employees when prompted by highly visible cyber
events or by regulatory alerts.
Customer awareness materials are readily available (e.g., DHS’ Cybersecurity Awareness Month
materials).
Information security threats are gathered and shared with applicable internal employees
hing, social engineering, and mobile security), and emerging issues.
Situational awareness materials are made available to employees when prompted by highly visible cyber
events or by regulatory alerts.
Customer awareness materials are readily available (e.g., DHS’ Cybersecurity Awareness Month
materials).
Information security threats are gathered and shared with applicable internal employees.

Control Test
Review documentation of employee security awareness training.

9. Evaluate the adequacy of the Identity Theft Prevention / Red Flags Program, including the Program’s
compliance with regulatory requirements. Verify that the financial institution:


Periodically identifies covered accounts it offers or maintains. (Covered accounts include accounts for
personal, family and household purposes that permit multiple payments or transactions.)

Periodically conducts a risk assessment to identify any other accounts that pose a reasonably foreseeable
risk of identity theft, taking into consideration the methods used to open and access accounts and the
institution's previous experiences with identity theft.

Has developed and implemented a Board-approved, comprehensive written Program designed to detect,
prevent, and mitigate identity theft in connection with the opening of a covered account or any existing
covered account. The Program should:

Be appropriate to the size and complexity of the financial institution and the nature and scope of its
activities.

Have reasonable policies, procedures and controls (manual or automated) to effectively identify and
detect relevant Red Flags and to respond appropriately to prevent and mitigate identity theft.
a covered account or any existing
covered account. The Program should:

Be appropriate to the size and complexity of the financial institution and the nature and scope of its
activities.

Have reasonable policies, procedures and controls (manual or automated) to effectively identify and
detect relevant Red Flags and to respond appropriately to prevent and mitigate identity theft.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 9 of 14

Be updated periodically to reflect changes in the risks to customers and the safety and soundness of
the financial institution from identity theft.

Involves the Board, or a designated committee or senior management employee, in the oversight,
development, implementation, and administration of the program.

Reports to the Board, or a designated committee or senior management employee, at least annually on
compliance with regulatory requirements. The report should address such items as:

The effectiveness of policies and procedures in addressing the risk of identity theft.

Service provider arrangements.

Significant incidents involving identity theft and management’s response.

Recommendations for material changes to the program.

Trains appropriate staff to effectively implement and administer the Program.
Exercises appropriate and effective oversight of service providers that perform activities related to covered
accounts.
Decision Factor 4 ▲

Customer transactions generating anomalous activity alerts are monitored and reviewed.
Customer service (e.g., the call center) utilizes formal procedures to authenticate customers
commensurate with the risk of the transaction or request.

10. Evaluate the process to address changes to, or new issuance of, laws/regulations and regulatory guidelines.

Decision Factor 4 ▲

11
ctor 4 ▲

Customer transactions generating anomalous activity alerts are monitored and reviewed.
Customer service (e.g., the call center) utilizes formal procedures to authenticate customers
commensurate with the risk of the transaction or request.

10. Evaluate the process to address changes to, or new issuance of, laws/regulations and regulatory guidelines.

Decision Factor 4 ▲

11. Determine whether management files Suspicious Activity Reports (SARs) for IT or cybersecurity incidents
when required and notifies its primary Federal regulator of incidents that meet the threshold of the Computer-
Security Incident Notification rule.

Decision Factor 4 ▲

Responsibilities for monitoring and reporting suspicious systems activity have been assigned.

Control Test
Discuss with Risk/BSA examiners to determine whether any IT-related SARs or Computer-Security Incident
Notifications have been filed within designated timeframes.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 10 of 14
12. Evaluate management succession and cross training. Consider the following:

Existence and appropriateness of job descriptions

Adequacy and training of back-up individuals

Existence of plans in the event of loss of a key manager or employee
Decision Factor 5 ▲

Control Test
Review the management succession plan to ensure it meets the needs of the institution.

Vendor Management – Ongoing Monitoring
(See also Development and Acquisition Module – Procedures #2-4 for Vendor Management – Acquisition)
13. Evaluate whether a risk-based vendor management program has been implemented to monitor service provider
and vendor relationships (both domestic and foreign-based)
Review the management succession plan to ensure it meets the needs of the institution.

Vendor Management – Ongoing Monitoring
(See also Development and Acquisition Module – Procedures #2-4 for Vendor Management – Acquisition)
13. Evaluate whether a risk-based vendor management program has been implemented to monitor service provider
and vendor relationships (both domestic and foreign-based). Consider the following:

Coverage of service providers and vendors, including affiliates, in the risk assessment process

Foreign-based risks, as applicable

Ongoing monitoring, which may include the following:

Financial statements

Controls assessments, such as SSAE 16 SOC Reports (Statement on Standards for Attestation
Engagement Service Organization Control Reports)

Information security program

Cybersecurity preparedness and resilience

Incident response

Internal/external audit reports

Regulatory reports

Affiliate relationships (e.g., Federal Reserve Regulation W)

Consumer compliance

Onsite reviews

Participation in user groups

Business continuity program, including integrated testing with the institution’s plan

Service level agreement compliance

Vendor awareness of emerging technologies

Report to Board of Directors

If available, read the report(s) of examination of any examined service provider(s) to the bank rated
composite 3, 4, or 5 (Uniform Rating System for Information Technology) at the most recent examination,
and evaluate the quality of the bank’s vendor management relative to that rating.
Decision Factor 6 ▲

Oversee Service Provider Arrangements. Each bank shall:

Where indicated by the bank's risk assessment, monitor its service providers to confirm that they have
satisfied their obligations. As part of this monitoring, a bank should review audits, summaries of test
results, or other equivalent evaluations of its service providers.
agement relative to that rating.
Decision Factor 6 ▲

Oversee Service Provider Arrangements. Each bank shall:

Where indicated by the bank's risk assessment, monitor its service providers to confirm that they have
satisfied their obligations. As part of this monitoring, a bank should review audits, summaries of test
results, or other equivalent evaluations of its service providers.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 11 of 14

The institution has policies commensurate with its risk and complexity that address the concepts of external
dependency or third-party management.
A list of third-party service providers is maintained.
A risk assessment is conducted to identify criticality of service providers.
The third-party risk assessment is updated regularly.
Audits, assessments, and operational performance reports are obtained and reviewed regularly validating
security controls for critical third parties.
Ongoing monitoring practices include reviewing critical third-parties’ resilience plans.

Control Test
Review a sample of documentation for ongoing monitoring of critical service providers to ensure sufficient
monitoring is occurring.

14. Evaluate the institution’s IT risk assessment process. Consider the following:

Identification of all information assets and systems, including cloud-based, virtualized, and paper-based
systems

Identification of critical service providers

Gathering of threat intelligence (e.g., FS-ISAC, US-CERT, InfraGard)

Determination of threats, including likelihood and impact

Identification of inherent risk levels

Documentation of controls to reduce threat impact

Determination of the quality of controls (i.e., testing)

Identification and evaluation of residual risk levels

Remediation program for unacceptable residual risk levels

Updating of the risk assessment promptly for new or emerging risks
Decision Factor 7 ▲

Specific to the customer information security program,
t risk levels

Documentation of controls to reduce threat impact

Determination of the quality of controls (i.e., testing)

Identification and evaluation of residual risk levels

Remediation program for unacceptable residual risk levels

Updating of the risk assessment promptly for new or emerging risks
Decision Factor 7 ▲

Specific to the customer information security program, each bank shall:

Identify reasonably foreseeable internal and external threats that could result in unauthorized
disclosure, misuse, alteration, or destruction of customer information or customer information
systems.

Assess the likelihood and potential damage of these threats, taking into consideration the
sensitivity of customer information.

Assess the sufficiency of policies, procedures, customer information systems, and other
arrangements in place to control risks.

Regularly test the key controls, systems, and procedures of the information security program. The
frequency and nature of such tests should be determined by the bank's risk assessment. Tests should be
conducted or reviewed by independent third parties or staff independent of those that develop or maintain
the security programs.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 12 of 14

A risk assessment focused on safeguarding customer information identifies reasonable and foreseeable
internal and external threats, the likelihood and potential damage of threats, and the sufficiency of policies,
procedures, and customer information systems.
The risk assessment identifies internet-based systems and high-risk transactions that warrant additional
authentication controls.
The institution belongs or subscribes to a threat and vulnerability information-sharing source(s) that
provides information on threats (e.g., FS-ISAC, US-CERT).
Threat information is used to monitor threats and vulnerabilities
res, and customer information systems.
The risk assessment identifies internet-based systems and high-risk transactions that warrant additional
authentication controls.
The institution belongs or subscribes to a threat and vulnerability information-sharing source(s) that
provides information on threats (e.g., FS-ISAC, US-CERT).
Threat information is used to monitor threats and vulnerabilities.
The critical business processes that are dependent on external connectivity have been identified.
Data flow diagrams are in place and document information flow to external parties.
An inventory of organizational assets (e.g., hardware, software, data, and systems hosted externally) is
maintained.
Organizational assets (e.g., hardware, systems, data, and applications) are prioritized for protection based
on the data classification and business value.
Management considers the risks posed by other critical infrastructures (e.g., telecommunications, energy) to
the institution.
The risk assessment is updated to address new technologies, products, services, and connections before
deployment.

15. Evaluate the risk monitoring reports provided to the Board and/or senior management. Consider the following:

Major IT projects

Security incidents, including cyber incidents

System availability and capacity

Network security, including firewalls and intrusion detection/prevention

Patch management
Decision Factor 7 ▲

Control Test
Review a sample of risk monitoring reports to ensure comprehensive and timely reporting.
Board and/or senior management. Consider the following:

Major IT projects

Security incidents, including cyber incidents

System availability and capacity

Network security, including firewalls and intrusion detection/prevention

Patch management
Decision Factor 7 ▲

Control Test
Review a sample of risk monitoring reports to ensure comprehensive and timely reporting.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 13 of 14
16. Evaluate management’s process for determining the adequacy of IT insurance policies. Consider the following:

Employee fidelity

IT equipment and facilities

Media reconstruction

Online and mobile banking

Electronic funds transfer

Business interruptions

Errors and omissions

Extra expenses, including backup site expenses
Decision Factor 7 ▲

Control Test
Review insurance policies to ensure coverage of IT activities.

Supplemental Workprograms (as applicable)
Outsourcing / Vendor Management / Third-Party Risk

Note: Basic outsourcing concepts are addressed in the Management, Support and Delivery, and Development and
Acquisition Modules. If expanded examination procedures are warranted, refer to the Expanded Management
Module.

Also available are the Third-Party Risk Examination Documentation (ED) Module and the FFIEC IT Examination
Handbook - Outsourcing Technology Services. Coordinate with examination efforts in the areas of risk
management, BSA, and consumer protection.

If additional procedures are used, enter a summary of findings below.

Credit Card Related Merchant Activities

Note: This type of activity relates to credit card payment transactions for merchants. Refer to the Credit Card
Related Merchant Activities Examination Documentation (ED) Module and the FFIEC IT Examination Handbook -
Retail Payment Systems.

If additional procedures are used, enter a summary of findings below.

End of Management Core Analysis
.

Credit Card Related Merchant Activities

Note: This type of activity relates to credit card payment transactions for merchants. Refer to the Credit Card
Related Merchant Activities Examination Documentation (ED) Module and the FFIEC IT Examination Handbook -
Retail Payment Systems.

If additional procedures are used, enter a summary of findings below.

End of Management Core Analysis. If applicable, and as needed based on the extent of the institution’s
involvement in the following areas, continue to the Expanded Analysis.

Management
Procedures

InTREx Core Modules – Management

September 2023
Page 14 of 14


Cloud Computing

User Groups

Vendor Information Security Programs

Managed Security Service Providers

Foreign-Based Technology Service Providers

Vendor Incentive Agreements

InTREx Core Modules - Support and Delivery
September 2023

Page 1 of 18

Support and Delivery
Institution Name:
Cert# Click here to enter Cert/RSSD #
Preparer:
Exam Start Date:
2.0Core Analysis Decision Factors

Complete the following procedures at each examination. The resources listed below are not intended to
be all-inclusive, and additional guidance may exist.
Resources
 FFIEC IT Examination Handbook – Architecture, Infrastructure, and Operations (AIO),
Information Security, and Business Continuity Management booklets
 Interagency Guidelines Establishing Standards for Safety and Soundness
 Interagency Guidelines Establishing Information Security Standards
 Interagency Statement on Pandemic Planning
 FFIEC Guidance on Authentication and Access to Financial Institution Services and Systems
 Computer-Security Incident Notification Requirements for Banking Organizations and Their
Bank Service Providers
Preliminary Review
Review items relating to support and delivery issues, such as:

Prior examination reports and workpapers

Pre-examination memoranda and file correspondence

Operations-related policies

Network topology

Cy
nancial Institution Services and Systems
 Computer-Security Incident Notification Requirements for Banking Organizations and Their
Bank Service Providers
Preliminary Review
Review items relating to support and delivery issues, such as:

Prior examination reports and workpapers

Pre-examination memoranda and file correspondence

Operations-related policies

Network topology

Cybersecurity self-assessments

Reports of any significant cyber-attacks, security events, or operational interruptions

Internal and external IT audit reports

Board and committee minutes related to IT

Information Technology Profile

Business continuity management plan

Network vulnerability assessments/penetration tests

Regulatory reports
If available, read the report(s) of examination of any examined service provider(s) to the bank rated
composite 3, 4, or 5 (Uniform Rating System for Information Technology) at the most recent
examination.
Note: Refer to the applicable booklets within the FFIEC IT Examination Handbook if additional
analysis is necessary to complete this module.

Information
Technology
Risk
Examination

InTREx Core Modules - Support and Delivery
September 2023

Page 2 of 18

Support and Delivery Summary
1-Strong ☐ 2-Satisfactory ☐ 3-Less than satisfactory ☐ 4-Deficient ☐ 5-Critically deficient ☐

Decision Factor 1 – Performance and Data Controls
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐

Evaluate the quality of processes or programs that monitor capacity and performance; the
adequacy of data controls over preparation, input, processing, and output; and the quality of
assistance provided to users, including the ability to handle problems.

Click here to enter comments

Procedure 1 – Operational Controls
Determine whether there are adequate controls to manage operations-related risks
the quality of processes or programs that monitor capacity and performance; the
adequacy of data controls over preparation, input, processing, and output; and the quality of
assistance provided to users, including the ability to handle problems.

Click here to enter comments

Procedure 1 – Operational Controls
Determine whether there are adequate controls to manage operations-related risks. Consider
whether appropriate daily operational controls and processes have been implemented, such as:

Monitoring tools to detect and preempt system problems or capacity issues

Daily processing issue resolution and appropriate escalation procedures

Secure handling, distribution, and disposal of equipment, media, and output (electronic
and physical)

Independent review of master file input and file maintenance changes (e.g., new loan and
deposit accounts, address changes, due dates)

Independent review of global parameter changes (e.g., interest rate indices for loans and
deposits, fee structure, service charges)

Baseline Cybersecurity Statements
Check if not met (x)
 Data is disposed of or destroyed according to documented requirements and within
expected time frame.

Control Test
Review sample documentation for each of the above-mentioned controls.

Procedure 2 – Imaging
Evaluate the adequacy of controls for item processing functions, including check imaging.
Consider the following:

Controls over teller/branch imaging
not met (x)
 Data is disposed of or destroyed according to documented requirements and within
expected time frame.

Control Test
Review sample documentation for each of the above-mentioned controls.

Procedure 2 – Imaging
Evaluate the adequacy of controls for item processing functions, including check imaging.
Consider the following:

Controls over teller/branch imaging

InTREx Core Modules - Support and Delivery
September 2023

Page 3 of 18


Security over the capture, storage, and transmission of images (e.g. back office
conversion, accounts receivable conversion, mobile banking)

Control Test
Verify that scanned items are destroyed in a manner and within the timeframe outlined in
institution policy.
Enter Control Test notes here, if performed

Decision Factor 2 - Business Continuity Management (BCM)
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
The adequacy of resilience, continuity, and response capabilities to safeguard personnel,
customers, and products and services.

Procedure 3 – BCM Governance
Determine whether the board and senior management periodically review and approve the
following:
 BCM responsibility and accountability
 BCM resource allocation
 Alignment of business strategy and risk appetite
 Business continuity risks and adopting policies and plans to manage events
 Business continuity exercise/test strategy
 Business continuity training strategy
 Business continuity operating/performance results, including exercise/test results

Resolution plan(s) for identified weaknesses

Baseline Cybersecurity Statements
Check if not met (x)
 A formal backup and recovery plan exists for all critical business lines
licies and plans to manage events
 Business continuity exercise/test strategy
 Business continuity training strategy
 Business continuity operating/performance results, including exercise/test results

Resolution plan(s) for identified weaknesses

Baseline Cybersecurity Statements
Check if not met (x)
 A formal backup and recovery plan exists for all critical business lines

InTREx Core Modules - Support and Delivery
September 2023

Page 4 of 18

Procedure 4 – Business Impact Analysis
Determine whether adequate business impact analyses for all business functions and risk
assessments have been completed. Consider the following:

Input from all integral groups (e.g., business line management, risk management, IT,
facilities management, and audit) and comprehensiveness of management’s review

Identification of critical business functions and interdependencies across business units
prioritization of processes, systems, and applications for recovery
 Analysis of reasonably foreseeable disruptive events, including:
 natural events (e.g., fires, floods, severe weather)
 technical events (e.g., communication or power failure)
 malicious events (e.g., fraud, theft, cyber-attacks)
 international events (e.g., political instability, economic disruptions), and
 low likelihood/high impact events (e.g., terrorist acts, pandemics)

Reasonableness of key recovery metrics, such as allowable downtime for critical business
functions, acceptable levels of data loss and backlogged transactions, recovery time
objectives (RTOs), recovery point objectives (RPOs), and costs associated with
downtime

Inclusion of IT services provided by third-party service providers and vendors in the
business impact analyses/risk assessments

Control Test
Review a sample of business impact analyses and risk assessments
usiness
functions, acceptable levels of data loss and backlogged transactions, recovery time
objectives (RTOs), recovery point objectives (RPOs), and costs associated with
downtime

Inclusion of IT services provided by third-party service providers and vendors in the
business impact analyses/risk assessments

Control Test
Review a sample of business impact analyses and risk assessments.
Enter Control Test notes here, if performed

Procedure 5 – Business Continuity Plan (BCP)
Evaluate the adequacy of the business continuity plan. Consider the following:
 Authorities, responsibilities, and relocation strategies
 Communication protocols, event management, and business continuity
 Incident response, disaster recovery, and crisis (emergency) management
 Liquidity concerns before and after an adverse event

Alternatives for payment systems, facilities and infrastructure, data center(s), and branch
relocation during a disaster

Procedure 6 – Backup Recovery
Determine whether the business continuity process includes appropriate recovery operations at
the backup location. Consider the following:
 Remote access connectivity
 Geographic diversity between the backup site and the primary location
 Adequacy of backup site hardware, including capacity and compatibility
 Sufficient processing time for the anticipated workload based on emergency priorities

InTREx Core Modules - Support and Delivery
September 2023

Page 5 of 18

Procedure 7 – Business Continuity Strategies
Determine whether management can effectively respond to wide-scale disruptions in order to
meet resilience and recovery objectives
ware, including capacity and compatibility
 Sufficient processing time for the anticipated workload based on emergency priorities

InTREx Core Modules - Support and Delivery
September 2023

Page 5 of 18

Procedure 7 – Business Continuity Strategies
Determine whether management can effectively respond to wide-scale disruptions in order to
meet resilience and recovery objectives. Do the strategies:
 Address personnel, processes, technology, and facility issues
 Address critical business risks in the operating environment
 Outline a combination of backup, replication and storage methods for data protection
 Integrate with disaster recovery services to protect against data destruction
 Provide for high redundancy levels in the data/telecommunications infrastructure,
including connections with critical third-party service providers
 Utilize a consistent change management process
 Include alternatives for proprietary systems/applications

Designate emergency personnel, including critical business process-level employees

Baseline Cybersecurity Statements
Check if not met (x)
 The institution plans to use business continuity, disaster recovery, and data back-up
programs to recover operations following an incident

Procedure 8 – BCM Testing and Exercises
Determine whether the business continuity exercise/test program is sufficient to demonstrate the
ability to achieve the continuity objectives
ployees

Baseline Cybersecurity Statements
Check if not met (x)
 The institution plans to use business continuity, disaster recovery, and data back-up
programs to recover operations following an incident

Procedure 8 – BCM Testing and Exercises
Determine whether the business continuity exercise/test program is sufficient to demonstrate the
ability to achieve the continuity objectives. Consider the following:

Provisions for exercises and tests occurring at appropriate intervals and when significant
changes affect the entity’s operating environment

Comprehensive program objectives and plans of exercises and tests to validate the ability
to restore critical business functions in a timely manner

An exercise and test process that provides assurance for the continuity and resilience of
critical business functions, without compromising production environments

Authorities and control over exercises and tests

Exercise and test policies, expectations, and strategies that demonstrate the entity’s ability
to utilize alternate facilities

Exercise and test objectives for resilience, system monitoring, and the recovery of
business processes and critical system components

Exercise and test scenarios, including exercise and test assumptions, objectives,
expectations, and assessment metrics

Types of exercises (e.g., full scale, limited scale, tabletop) and tests

Exercises and tests related to interaction with third parties, industry-wide testing, and
core and significant firms

Documentation of issues identified through exercises and tests, and action plans and
target dates for resolution
ercise and test assumptions, objectives,
expectations, and assessment metrics

Types of exercises (e.g., full scale, limited scale, tabletop) and tests

Exercises and tests related to interaction with third parties, industry-wide testing, and
core and significant firms

Documentation of issues identified through exercises and tests, and action plans and
target dates for resolution

InTREx Core Modules - Support and Delivery
September 2023

Page 6 of 18

Baseline Cybersecurity Statements
Check if not met (x)
 Scenarios are used to improve incident detection and response
 Business continuity testing involves collaboration with critical third parties
 Systems, applications, and data recovery are tested at least annually

Control Test
Review BCP testing documentation to determine adequacy.
Enter Control Test notes here, if performed

Procedure 9 – BCM Training
Evaluate the adequacy of the business continuity training program for all stakeholders. Consider
the following:

Alignment of training with strategies

Training objectives

Training format

The extent to which various stakeholders (e.g., the board, business continuity program
staff, incident response team, general personnel) are trained

Process for reviewing/updating the training program

Decision Factor 3 – Network Architectures
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
The adequacy of network architectures and the security of connections with public networks.

Procedure 10 – Network Architecture and Configurations
Review the network architecture and configurations with management
ting the training program

Decision Factor 3 – Network Architectures
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
The adequacy of network architectures and the security of connections with public networks.

Procedure 10 – Network Architecture and Configurations
Review the network architecture and configurations with management. Consider the following:

Critical systems and components (e.g., servers, firewall, routers, switches, IDS/IPS)

Connection points

Network segmentation (e.g., demilitarized zone [DMZ], virtual local area network
[VLAN], wireless)

Documentation of network topology

Control Test
Review network topology and other documentation. Determine whether the documentation is
accurate and current.
Enter Control Test notes here, if performed

InTREx Core Modules - Support and Delivery
September 2023

Page 7 of 18

Procedure 11 – Remote Access
Assess remote access practices used to authenticate, monitor, and control vendor/employee
remote access. Consider the following:

Disabling remote communications if no business need exists

Controlling access through management approvals and subsequent audits

Implementing robust control over configurations at both ends of the remote connection
to prevent potential malicious use

Logging and monitoring remote access activities, particularly for vendors and privileged
users

Using strong authentication and encryption to secure communications
•
Enabling vendor remote access accounts only when necessary

Baseline Cybersecurity Statements
Check if not met (x)
 Remote access to critical systems by employees, contractors, and third parties uses
encrypted connections and multifactor authentication
 The institution is able to detect anomalous activities through monitoring across the
environment
 Access to critical systems by third parties is monitored for unauthorized or unusual activity

Decision Factor 4 –
s
Check if not met (x)
 Remote access to critical systems by employees, contractors, and third parties uses
encrypted connections and multifactor authentication
 The institution is able to detect anomalous activities through monitoring across the
environment
 Access to critical systems by third parties is monitored for unauthorized or unusual activity

Decision Factor 4 – Physical and Logical Security
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient 
The quality of physical and logical security, including the privacy of data.

Procedure 12 – Security Monitoring and Malware Protection
Determine the adequacy of security monitoring for the network, critical systems and
applications. Also determine whether sufficient controls are in place to protect against
malware. Consider the following:

Existence of systems to detect or prevent unauthorized network access (e.g., intrusion
detection/prevention)

Virus/malware detection practices (e.g., frequency and scope of scans)

Ability to detect and prevent the unauthorized removal of data from the network (e.g.
data loss prevention)

Ability to detect and respond to anomalous activity

Ability to prevent or detect unauthorized devices or software

InTREx Core Modules - Support and Delivery
September 2023

Page 8 of 18


Knowledge and expertise of security personnel

Adequacy and frequency of network vulnerability assessments and penetration tests

Adequacy of processes for managing network security devices (e.g., firewall, IDS,
VPN)

Adequacy of log monitoring program

Adequacy of automated tools (if being used) to support security monitoring, policy
enforcement, and reporting

Appropriateness of wireless configuration and monitoring

Baseline Cybersecurity Statements
Check if not met (x)
 Network perimeter defense tools (e.g., border router and firewall) are used
 Systems that are accessed from the Internet or by external parties
g program

Adequacy of automated tools (if being used) to support security monitoring, policy
enforcement, and reporting

Appropriateness of wireless configuration and monitoring

Baseline Cybersecurity Statements
Check if not met (x)
 Network perimeter defense tools (e.g., border router and firewall) are used
 Systems that are accessed from the Internet or by external parties are protected by
firewalls or other similar devices
 Controls are in place to restrict the use of removable media to authorized personnel
 All ports are monitored
 Independent testing (including penetration testing and vulnerability scanning) is conducted
according to the risk assessment for external-facing systems and the internal network
 A normal network activity baseline is established
 Processes are in place to monitor for the presence of unauthorized users, devices,
connections, and software
 Audit log records and other security event logs are reviewed and retained in a secure manner
 Firewall rules are audited or verified periodically
 Up-to-date anti-virus and anti-malware tools are used
 Anti-virus and anti-malware tools are used to detect attacks
 E-mail protection mechanisms are used to filter for common cyber threats (e.g., attached
malware or malicious links)

Control Test
Verify that management obtains reviews, and acts upon alerts from intrusion
detection/prevention systems and other security systems.
Verify that management tracks and remediates findings from vulnerability assessments and
penetration tests.
Verify that management obtains and reviews security logs/monitoring reports for operating
systems, application systems, and networks.
Enter Control Test notes here, if performed

Procedure 13 – Incident Response
Evaluate the incident response plan. Consider whether the plan:
s.
Verify that management tracks and remediates findings from vulnerability assessments and
penetration tests.
Verify that management obtains and reviews security logs/monitoring reports for operating
systems, application systems, and networks.
Enter Control Test notes here, if performed

Procedure 13 – Incident Response
Evaluate the incident response plan. Consider whether the plan:

InTREx Core Modules - Support and Delivery
September 2023

Page 9 of 18


Includes senior leadership

Includes representatives from various areas (e.g., management, IT, public relations,
business units, legal)

Defines responsibilities and duties

Defines communication paths for employees and customers to report information
security events

Establishes alert parameters that prompt mitigating actions

Includes processes and resources to contain incidents and remediate resulting effects

Outlines internal escalation procedures, including when to notify senior management
and the Board

Details when to notify law enforcement, regulators, and customers. Consider the
Computer-Security Incident Notification rule.

Contains procedures for filing Suspicious Activity Reports (SARs), if necessary

Includes recovery strategies for critical systems, applications, and data
• Addresses response to and recovery from a cybersecurity event

Identifies third parties who can provide mitigation strategies

Includes a process to classify, log, and track incidents

Addresses incidents at third-party service providers
•
Requires periodic testing
ctivity Reports (SARs), if necessary

Includes recovery strategies for critical systems, applications, and data
• Addresses response to and recovery from a cybersecurity event

Identifies third parties who can provide mitigation strategies

Includes a process to classify, log, and track incidents

Addresses incidents at third-party service providers
•
Requires periodic testing

InTREx Core Modules - Support and Delivery
September 2023

Page 10 of 18

GLBA (Information Security Standards Response Program)
Consistent with the Information Security Standards and GLBA, an institution’s response
program should contain procedures for the following:
Assessing the nature and scope of an incident, and identifying what customer information
systems and types of customer information have been accessed or misused.
Notifying its primary Federal regulator as soon as possible when the institution becomes
aware of an incident involving unauthorized access to or use of sensitive customer information.
Consistent with the Agencies' Suspicious Activity Report ("SAR") regulations, notifying
appropriate law enforcement authorities, in addition to filing a timely SAR in situations
involving Federal criminal violations requiring immediate attention, such as when a reportable
violation is ongoing.
Taking appropriate steps to contain and control the incident to prevent further unauthorized
access to or use of customer information, for example, by monitoring, freezing, or closing
affected accounts, while preserving records and other evidence.
Notifying customers when warranted.
Where an incident of unauthorized access to customer information involves customer
information systems maintained by an institution's service providers, it is the responsibility of
the financial institution to notify the institution's customers and regulator. However, an
institution may authorize or contract with its service provider to notify the institutions'
customers or regulator on its behalf
an incident of unauthorized access to customer information involves customer
information systems maintained by an institution's service providers, it is the responsibility of
the financial institution to notify the institution's customers and regulator. However, an
institution may authorize or contract with its service provider to notify the institutions'
customers or regulator on its behalf.
NOTE: For additional information related to the Interagency Guidelines Establishing
Information Security Standards, refer to Interagency Guidance on Response Programs for
Unauthorized Access to Customer Information and Customer Notice.

InTREx Core Modules - Support and Delivery
September 2023

Page 11 of 18

Baseline Cybersecurity Statements
Check if not met (x)
 Roles and responsibilities for incident response team members are defined
 The response team includes individuals with a wide range of backgrounds and expertise,
from many different areas within the institution. (e.g., management, legal, public relations,
as well as information technology)
 Logs of physical and/or logical access are reviewed following events
 Tools and processes are in place to detect, alert, and trigger the incident response
program
 Mechanisms (e.g., anti-virus alerts, log event alerts) are in place to alert management to
potential attacks
 Alert parameters are set for detecting information security incidents that prompt mitigating
action
 System performance reports contain information that can be used as a risk indicator to
detect information security incidents
 Appropriate steps are taken to contain and control an incident to prevent further
unauthorized access to or use of customer information
 Communication channels exist to provide employees a means for reporting information
security events in a timely manner
 A process exists to contact personnel who are responsible for analyzing and responding to
an incident
 Procedures exist to notify customers, regulators, an
to contain and control an incident to prevent further
unauthorized access to or use of customer information
 Communication channels exist to provide employees a means for reporting information
security events in a timely manner
 A process exists to contact personnel who are responsible for analyzing and responding to
an incident
 Procedures exist to notify customers, regulators, and law enforcement as required or
necessary when the institution becomes aware of an incident involving the unauthorized
access to or use of sensitive customer information
 Incidents are classified, logged, and tracked
 The institution has documented how it will react and respond to cyber incidents

Control Test
Review documentation of security incidents to determine whether required procedures were
followed.
Review incident response testing documentation to ensure the tests adequately cover all
aspects of the plan.
Enter Control Test notes here, if performed

Procedure 14 – User Access Rights
Evaluate the effectiveness of administering user access rights. Consider the following:
 The process to add, delete, and change access rights for core banking systems, network
access, and other systems
 Removal/restrictions when users permanently leave employment or are absent for an
extended period of time (i.e., immediate notification from the Human Resources
Department to delete/disable a user ID)
ctiveness of administering user access rights. Consider the following:
 The process to add, delete, and change access rights for core banking systems, network
access, and other systems
 Removal/restrictions when users permanently leave employment or are absent for an
extended period of time (i.e., immediate notification from the Human Resources
Department to delete/disable a user ID)

InTREx Core Modules - Support and Delivery
September 2023

Page 12 of 18

 Periodic reviews and re-approvals of employee access levels on all IT systems,
including the network, core banking systems, and any other critical applications
 Assignment of unique user IDs to provide employee-specific audit trails (i.e., no
sharing of generic IDs for employees with input or change capabilities)

Assignment of user rights based upon job requirements

Baseline Cybersecurity Statements
Check if not met (x)
 Changes to physical and logical user access, including those that result from voluntary
and involuntary terminations, are submitted to and approved by appropriate personnel
 Administrative, physical, or technical controls are in place to prevent users without
administrative responsibilities from installing unauthorized software
 Employee access is granted to systems and confidential data based on job responsibilities
and the principles of least privilege
 User access reviews are performed periodically for all systems and applications based on
the risk to the application or system
 Identification and authentication are required and managed for access to systems,
applications, and hardware

Procedure 15 – Privileged User and Accounts
Evaluate the controls over privileged users and accounts (e.g., database, network, system
administrators, and hypervisors/virtual hosts)
med periodically for all systems and applications based on
the risk to the application or system
 Identification and authentication are required and managed for access to systems,
applications, and hardware

Procedure 15 – Privileged User and Accounts
Evaluate the controls over privileged users and accounts (e.g., database, network, system
administrators, and hypervisors/virtual hosts). Consider the following:
 Limiting access based upon the principles of least privilege
 Establishing a unique user ID separate from the ID used for normal business
 Prohibiting shared privileged access by multiple users
 Maintaining a level of authentication commensurate with privileged users’ risk profiles
 Logging and auditing the use of privileged access

Reviewing privileged user access rights regularly

Baseline Cybersecurity Statements
Check if not met (x)
 Access to make changes to systems configurations (including virtual machines and
hypervisors) is controlled and monitored
 Elevated privileges are monitored
 Elevated privileges (e.g., administrator privileges) are limited and tightly controlled (e.g.,
assigned to individuals, not shared, and require stronger password controls)

InTREx Core Modules - Support and Delivery
September 2023

Page 13 of 18

Control Test
Review privileged user access reports to determine whether access rights are commensurate
with job responsibilities/business needs.
Verify that management obtains and reviews activity logs/monitoring reports of privileged
users.
Enter Control Test notes here, if performed

Procedure 16 – Authentication Controls
Determine whether authentication controls are adequate and whether configuration parameters
meet institution policy and current industry standards for all critical IT systems
job responsibilities/business needs.
Verify that management obtains and reviews activity logs/monitoring reports of privileged
users.
Enter Control Test notes here, if performed

Procedure 16 – Authentication Controls
Determine whether authentication controls are adequate and whether configuration parameters
meet institution policy and current industry standards for all critical IT systems. Consider the
following:
 Configurations based upon industry standards/vendor recommendations, including
virtual machines and hypervisors
 Configurations standards approved and settings audited
 Unnecessary ports and services disabled
 Adequacy of automated tools (if being used) to enforce secure configurations
 Default passwords and accounts changed/disabled
 Password controls (expiration period, re-use and history, reset procedures, complexity)
 Failed login settings (number of attempts and lockout period)
 Automatic timeouts
 Use of tokens
 Biometric solutions

Time-of-day and day-of-week restrictions

Baseline Cybersecurity Statements
Check if not met (x)
 Systems configurations (for servers, desktops, routers, etc.) follow industry standards and
are enforced
 Ports, functions, protocols, and services are prohibited if no longer needed for business
purposes
 All default passwords and unnecessary default accounts are changed before system
implementation
 Programs that can override system, object, network, virtual machine, and application
controls are restricted
 Controls are in place to restrict the use of removable media to authorized personnel
 System sessions are locked after a pre-defined period of inactivity and are terminated after
pre-defined conditions are met
 Access controls include password complexity and limits to password attempts and reuse
tem, object, network, virtual machine, and application
controls are restricted
 Controls are in place to restrict the use of removable media to authorized personnel
 System sessions are locked after a pre-defined period of inactivity and are terminated after
pre-defined conditions are met
 Access controls include password complexity and limits to password attempts and reuse

InTREx Core Modules - Support and Delivery
September 2023

Page 14 of 18

Control Test
Review management’s documentation comparing actual configuration settings to documented
and approved standards.
Enter Control Test notes here, if performed

Procedure 17 – Patch Management
Determine whether sufficient patch management policies and procedures are in place to protect
computer systems against software vulnerabilities. Consider the following:
 Assignment of responsibilities for patch management
 Documentation of reasons for any missing or excluded patches
 Tests of patches prior to implementation
 Installation of vendor supplied patches for:
 Operating systems
 Firewalls
 Routers
 Switches
 Intrusion detection/prevention systems (IDS/IPS)
 Applications
 Workstation products (e.g., Adobe, Microsoft Office, Java)
 Other critical systems
 Validation that system security configurations remain within standards after patch
installation
 Documented reviews of vendor-provided patch reports, if patch management is
outsourced
 Adequacy of automated tools (if being used) to implement patches, to audit for missing
patches, and to validate secure configurations after patching

Adequacy of the vulnerability management program in validating the effectiveness of
patch management

Baseline Cybersecurity Statements
Check if not met (x)
 A patch management program is implemented and ensures that software and firmware
patches are applied in a timely manner
 Patches are tested before being applied to systems and/or software
 Patch management reports are reviewed and
of the vulnerability management program in validating the effectiveness of
patch management

Baseline Cybersecurity Statements
Check if not met (x)
 A patch management program is implemented and ensures that software and firmware
patches are applied in a timely manner
 Patches are tested before being applied to systems and/or software
 Patch management reports are reviewed and reflect missing security patches

Control Test
Review and discuss the patch exception report with management. If the patch reports are
unavailable, select a sample of servers/workstations/network devices and review patch status.
Enter Control Test notes here, if performed

InTREx Core Modules - Support and Delivery
September 2023

Page 15 of 18

Procedure 18 – Encryption
Evaluate the institution’s use of encryption for sensitive institution and customer data at rest
and in transit. Consider the following:
 Databases
 Mobile devices
 Email
 Back-up media and storage devices
 Transmissions with third parties

Password databases

Baseline Cybersecurity Statements
Check if not met (x)
 All passwords are encrypted in storage and in transit
 Confidential data are encrypted when transmitted across public or untrusted networks (e.g.,
Internet)
 Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store
confidential data
 Wireless network environments require security settings with strong encryption for
authentication and transmission

Procedure 19 – Physical Controls
Determine whether adequate physical and environmental monitoring and controls exist
or untrusted networks (e.g.,
Internet)
 Mobile devices (e.g., laptops, tablets, and removable media) are encrypted if used to store
confidential data
 Wireless network environments require security settings with strong encryption for
authentication and transmission

Procedure 19 – Physical Controls
Determine whether adequate physical and environmental monitoring and controls exist.
Consider the following:
 Access to equipment rooms (including telecommunication closets) limited to authorized
personnel
 Adequate HVAC
 Alarms to detect fire, heat, smoke, and unauthorized physical access
 Computer/server rooms uncluttered and hazard free
 Sufficient uninterrupted power supplies (i.e., UPS)
 Presence of adequate fire suppression
 Protection of equipment from water damage
 Environmental sensors where needed (e.g., temperature, humidity, water)

Security cameras

Baseline Cybersecurity Statements
Check if not met (x)
 The physical environment is monitored to detect potential unauthorized access
 Physical security controls are used to prevent unauthorized access to information systems
and telecommunication systems

InTREx Core Modules - Support and Delivery
September 2023

Page 16 of 18

Control Test
Perform a site/premise inspection to determine the existence of physical protection and
detection controls.
Enter Control Test notes here, if performed

Decision Factor 5 – Electronic Funds Transfer (EFT)
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
The adequacy of controls over electronic funds transfers and electronic banking activities.

Procedure 20 – Electronic Funds Transfer
Evaluate the adequacy of EFT oversight and controls
Test notes here, if performed

Decision Factor 5 – Electronic Funds Transfer (EFT)
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
The adequacy of controls over electronic funds transfers and electronic banking activities.

Procedure 20 – Electronic Funds Transfer
Evaluate the adequacy of EFT oversight and controls. Consider the following:
 Adequacy of policies and procedures
 Appropriateness of risk limits and tolerances
 Segregation of duties
 Adequacy of physical and logical security over EFT systems and applications
 Adequacy of logging, reporting, and reconciling processes
 Ability to prevent, detect, and respond to anomalous or fraudulent activity
 Inclusion of EFT in BCP/Disaster Recovery plans
 Scope and frequency of EFT audit coverage
Examiners should document the conclusions of the evaluation of the EFT oversight and controls
here and elsewhere as applicable within the workpapers. Examiners are reminded that EFT
activity can have an impact on other examination areas including, but not limited to, Anti-
Money Laundering/Countering the Financing of Terrorism (AML/CFT), Asset Quality,
Liquidity, and Sensitivity to Market Risk. Examiners reviewing EFT may observe suspicious
activity, loan participation activity, borrowing activity, brokered deposits, and other inflows
and outflows. When observed, examiners should share appropriate information with other
examiners reviewing those respective areas.
For institutions with significant or complex EFT activity, this core procedure may need to be
augmented with additional procedures that address more complex risks. Examiners should
utilize the Electronic Funds Transfer Risk Assessment ED Module and the FFIEC IT
Examination Handbook – Retail Payment Systems as resources at institutions with high volume
or complex EFT activities. Significant findings and conclusions should be pulled forward from
those workprograms into the comment box below
nted with additional procedures that address more complex risks. Examiners should
utilize the Electronic Funds Transfer Risk Assessment ED Module and the FFIEC IT
Examination Handbook – Retail Payment Systems as resources at institutions with high volume
or complex EFT activities. Significant findings and conclusions should be pulled forward from
those workprograms into the comment box below.

InTREx Core Modules - Support and Delivery
September 2023

Page 17 of 18

Decision Factor 6 – Additional Information
Strong ☐ Satisfactory ☐ Less than satisfactory ☐ Deficient ☐ Critically deficient ☐
If applicable, include a summary comment below for any additional risk factors reviewed or
examination procedures performed that may not be directly referenced in the Decision Factors
above. (These risk factors and procedures could include, but are not limited to, Supplemental
Workprograms, FFIEC workprograms, agency-specific workprograms, and/or new guidance not
addressed in the modules.)

Supplemental Workprogram
(as applicable)
E-Banking
Note: After completion of the core electronic banking procedure, if additional examination work is
needed, refer to available resources such as the FFIEC IT Examination Handbook, FFIEC Guidance
on Authentication and Access to Financial Institution Services and Systems, and other outstanding
guidance.

If additional procedures are used, enter a summary of findings below.

Mobile Banking
Note: After completion of the core mobile banking procedure, if additional examination work is needed,
refer to available resources such as the FFIEC IT Examination Handbook, and other outstanding
guidance.

If additional procedures are used, enter a summary of findings below.

Remote Deposit Capture
Note: This type of activity refers to a deposit transaction delivery system that allows customers to
deposit items electronically from remote locations
if additional examination work is needed,
refer to available resources such as the FFIEC IT Examination Handbook, and other outstanding
guidance.

If additional procedures are used, enter a summary of findings below.

Remote Deposit Capture
Note: This type of activity refers to a deposit transaction delivery system that allows customers to
deposit items electronically from remote locations. Refer to available resources such as the FFIEC IT
Examination Handbook, remote deposit capture workprograms, and other outstanding guidance.

If additional procedures are used, enter a summary of findings below.

InTREx Core Modules - Support and Delivery
September 2023

Page 18 of 18

End of Support & Delivery Core Analysis. If applicable, and as needed based on the extent of
the institution’s involvement in the following areas, continue to the Expanded Analysis.


Wireless

Virtualization

Voice over Internet Protocol (VoIP)

ATM Operations

Customer-Facing Call Center

Internal IT Help Desk

Servicing Provided to Others

InTREx – Information Security Standards
September 2023

Page 1 of 3

Institution Name:
Cert#
Information Security Standards
Preparer:
Start Date:
Workpaper

INTERAGENCY GUIDELINES ESTABLISHING INFORMATION SECURITY STANDARDS

The Interagency Guidelines Establishing Information Security Standards (Information Security Standards) set
forth standards pursuant to section 501(b) of the Gramm-Leach-Bliley Act (GLBA). These Information Security
Standards address developing and implementing administrative, technical, and physical safeguards to protect the
security, confidentiality, and integrity of customer information. They also address the proper disposal of
consumer information pursuant to sections 621 and 628 of the Fair Credit Reporting Act
rsuant to section 501(b) of the Gramm-Leach-Bliley Act (GLBA). These Information Security
Standards address developing and implementing administrative, technical, and physical safeguards to protect the
security, confidentiality, and integrity of customer information. They also address the proper disposal of
consumer information pursuant to sections 621 and 628 of the Fair Credit Reporting Act. The Information
Security Standards are set forth in:

FDIC - Rules & Regulations Part 364, Appendix B
Federal Reserve - Regulation H, Appendix D-2

Information security principles and standards, contained within the Information Security Standards,
are interspersed throughout all areas of the information technology examination modules.
Examination procedures that are applicable to the Information Security Standards are marked with
this GLBA icon.

The Information Security Standards compliance comment contained in this workpaper should be a concise
summary of the findings noted during the evaluation of the GLBA-related factors and procedures contained in
the Core Modules.

Note: Each requirement contained in the Information Security Standards is tied to the examination procedure
most applicable to that requirement. However, examiners should recognize that additional procedures may also
tie to each Guideline requirement.
Summary Comment – GLBA Information Security Standards
(Comment should be included in the Report of Examination)
IS.1.
After completing the GLBA-related examination procedures contained in the Core Modules, summarize
the institution’s compliance with the Interagency Guidelines Establishing Information Security Standards.

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☒
Critically deficient ☐

Information
Technology
Risk
Examination
be included in the Report of Examination)
IS.1.
After completing the GLBA-related examination procedures contained in the Core Modules, summarize
the institution’s compliance with the Interagency Guidelines Establishing Information Security Standards.

Strong ☐
Satisfactory ☐
Less than satisfactory ☐
Deficient ☒
Critically deficient ☐

Information
Technology
Risk
Examination

InTREx – Information Security Standards
September 2023

Page 2 of 3
Background

The following information is a summary of the Information Security Standards and is intended to serve as an
examination resource.

Assessing the Institution’s Compliance with the Information Security Standards

The Information Security Standards require each institution to establish a formal information security program
that meets the following objectives:

Ensures the security and confidentiality of customer information

Protects against any anticipated threats or hazards to the security or integrity of customer information

Protects against unauthorized access to or use of customer information that could result in substantial
harm or inconvenience to any customer

Ensures the proper disposal of customer information and consumer information

Implements appropriate response programs for unauthorized access

In reviewing the institution’s program, examiners should consider the following:

Comprehensiveness of the written information security program

Involvement of the Board (or an appropriate committee thereof)

Assignment of specific responsibility for implementing the program

Reasonableness and sufficiency of the risk assessment process

Ability of the program to control and mitigate the risks

Awareness and training of staff

Testing of controls via audit or independent staff

Proper disposal of consumer information

Oversight of service providers

Ability to adjust the program in response to relevant changes

Adequacy of required annual reports to the Board or designated
ency of the risk assessment process

Ability of the program to control and mitigate the risks

Awareness and training of staff

Testing of controls via audit or independent staff

Proper disposal of consumer information

Oversight of service providers

Ability to adjust the program in response to relevant changes

Adequacy of required annual reports to the Board or designated committee on material matters

Appropriateness of incident response programs

The information security program represents the standards, policies, procedures, and guidelines defining the
institution’s security requirements. These security requirements are direct reflections of an institution’s risk
assessment and risk management practices.

A risk assessment is a multi-step process of identifying and assessing risks to information and infrastructure
assets. One of the primary goals of a risk assessment is to identify feasible risk-reduction solutions. These
solutions, often in the form of logical and physical controls, are the key defenses in protecting the confidentiality,
integrity, and availability of information assets. The institution should continuously gather and analyze
information regarding new threats and vulnerabilities, actual attacks, and the effectiveness of the existing security
controls. Management should use this threat intelligence information to update the risk assessment, strategy, and
controls. Regardless of the method used, the risk assessment provides the critical input for the controls, which
become part of an institution’s information security program.

The institution should provide an independent framework for assessing, testing, and reporting the effectiveness of
controls. A reliable testing program provides reasonable assurances that management’s information security
program is effective and being followed. Without some form of testing and assessment, management will not be
able to determine the adequacy and effectiveness of the information security program
ld provide an independent framework for assessing, testing, and reporting the effectiveness of
controls. A reliable testing program provides reasonable assurances that management’s information security
program is effective and being followed. Without some form of testing and assessment, management will not be
able to determine the adequacy and effectiveness of the information security program.

Management should establish and maintain a formal vendor management program that defines the framework for
controlling the external dependency risks associated with key vendors and servic

[Text truncated at 120,000 characters. The full text is on the page linked above.]

## Nearby sections

- [FDIC FIL-1-2002 FOREIGN ASSETS CONTROL ACT](https://www.frixlaw.com/law-library/statutes/FDIC_FIL02001.md)
- [FDIC FIL-1-2010 Employee Compensation Advance Notice of Proposed Rulemaking](https://www.frixlaw.com/law-library/statutes/FDIC_FIL10001.md)
- [FDIC FIL-1-2024 Consolidated Reports of Condition and Income for Fourth Quarter 2023](https://www.frixlaw.com/law-library/statutes/FDIC_FIL24001.md)
- [FDIC FIL-2-2004 Foreign Assets Control Act](https://www.frixlaw.com/law-library/statutes/FDIC_FIL04002.md)
- [FDIC FIL-2-2020 Consolidated Reports of Condition and Income for Fourth Quarter 2019](https://www.frixlaw.com/law-library/statutes/FDIC_FIL20002.md)
- [FDIC FIL-3-2003 FILING PROCEDURES](https://www.frixlaw.com/law-library/statutes/FDIC_FIL03003.md)
- [FDIC FIL-4-2006 Commercial Real Estate Lending Proposed Interagency Guidance](https://www.frixlaw.com/law-library/statutes/FDIC_FIL06004.md)
- [FDIC FIL-4-2021 Revised Guidelines for Appeals of Material Supervisory Determinations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21004.md)
- [FDIC FIL-4-2023 Guidance to Help Financial Institutions and Facilitate Recovery in Areas of California Affected by Severe Winter Storms, Flooding, Landslides and Mudslides](https://www.frixlaw.com/law-library/statutes/FDIC_FIL23004.md)
- [FDIC FIL-4-2025 FDIC Statement of Policy on Bank Merger Transactions](https://www.frixlaw.com/law-library/statutes/FDIC_FIL25004.md)
- [FDIC FIL-5-2000 Consumer Credit Reporting Practices](https://www.frixlaw.com/law-library/statutes/FDIC_FIL00005.md)
- [FDIC FIL-5-2003 LETTER TO STAKEHOLDERS](https://www.frixlaw.com/law-library/statutes/FDIC_FIL03005.md)
- [FDIC FIL-5-2021 Frequently Asked Questions Regarding Suspicious Activity Reporting and Other Anti-Money Laundering (AML) Considerations](https://www.frixlaw.com/law-library/statutes/FDIC_FIL21005.md)
- [FDIC FIL-6-2000 Special Alert](https://www.frixlaw.com/law-library/statutes/FDIC_FIL00006.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FDIC_FIL23052. Check the current official text before relying on it. Not legal advice.