A small bank should not be described as subject to a new enhanced cybersecurity mandate simply because federal agencies discussed stronger financial-sector protection. In their October 19, 2016 joint announcement, the Federal Reserve, FDIC and Office of the Comptroller of the Currency expressly said the proposed enhanced standards would not apply to community banks. That boundary matters for fair communication with customers. [fed-cyber-release]

The agencies contemplated depository institutions and holding companies with total consolidated assets of $50 billion or more, foreign banking organizations' U.S. operations with at least $50 billion in U.S. assets, and certain Board-supervised infrastructure and nonbank financial companies. The threshold was therefore not a shorthand for every financial business worldwide, nor a universal test of whether an institution was trustworthy. [fed-cyber-release]

The advance notice published October 26 explained a different distinction: systems critical to the financial sector could face more stringent standards within a tiered approach. Its stated purpose was greater operational resilience and less financial-system disruption from a cyber event. Treating different institutions or systems differently was part of the contemplated design, not evidence that customers of excluded banks mattered less. [2016-25871]

The ethical communication task is modest but important: say what the proposal covers without turning regulatory scope into a moral ranking or a safety guarantee. The agencies sought comments by January 17, 2017; they had not adopted these enhanced standards. The release and notice are parts of one consultation, not independent assessments of bank security. They leave individual institutions' actual protection and performance unproven. [2016-25871][fed-cyber-release]

Source documents

  1. Enhanced Cyber Risk Management Standardshttps://www.govinfo.gov/content/pkg/FR-2016-10-26/html/2016-25871.htm
  2. Agencies issue advance notice of proposed rulemaking on enhanced cyber risk management standardshttps://www.federalreserve.gov/newsevents/pressreleases/bcreg20161019a.htm