Financial Regulators Update Examiner Guidance

The Federal Financial Institutions Examination Council (FFIEC) has released a new booklet to help examiners evaluate information technology practices.

Titled "Development, Acquisition, and Maintenance," this booklet outlines the key expectations for how entities should approach development and acquisition planning, governance, risk management, and the maintenance of their systems. It also covers the connections between an entity's own processes and those of its third-party service providers, offering guidance to examiners on how to ensure management is effectively addressing risks and staying compliant with relevant laws and regulations.

The updated booklet takes into account the evolving tech landscape and the growing importance of security and resilience. It emphasizes the need for examiners to have up-to-date information on safety, consumer protection, and the delivery of secure, reliable services. This booklet replaces the previous "Development and Acquisition" booklet from April 2004.

You can access the full FFIEC Information Technology Examination Handbook at https://ithandbook.ffiec.gov/(Opens new window).