Board Report: 2025-SR-B-008 May 28, 2025
Effective IT risk management is critical to the safety and soundness of financial institutions, including more than 600 community banking organizations supervised by the Board and Reserve Banks.
However, procedures for IT examinations of CBOs are not up to date and do not reflect the evolving IT and cybersecurity risk environment. In addition, Reserve Banks have varying approaches to training examiners who conduct CBO IT examinations and completing and retaining documents used to scope such examinations.
We are making five recommendations to ensure that the approach to IT and cybersecurity supervision addresses evolving risks, that training for examiners is more structured, and that the documentation of examination scopes is more consistent.
