← Return to Blog

11 Jan, 2022

2021 Regulatory Year in Review

Cybersecurity remains a Top Concern for Regulators

Last year, an increase in cybersecurity risks spurred the government to issue multiple regulatory releases regarding information technology. And since the trend doesn’t seem to be slowing, expect to see more releases from regulators about technology issues in 2022.

Let’s review the highlights published in 2021:

The year started with the an emphasis on the importance of implementing and maintaining effective cybersecurity controls. This led regulators to issue a guidance update announcement. Can you imagine what how technology changes have happened has changed in the 17 years since the Operations booklet was first published?

  • January 2021 Joint Statement on Heightened Cybersecurity Risk 1
  • June 2021 Updated FFIEC IT Examination Handbook – Architecture, Infrastructure, and Operations Booklet 2

Regulators are also placing more focus on third-party vendors along with the risk management and due diligence that goes into that partnership.

  • July 2021 Proposed Interagency Guidance on Third-Party Relationships: Risk Management 3
  • August 2021 Conducting Due Diligence on Financial Technology Companies 4

The number of remote connections rose exponentially in 2020, leading to published guidance on authentication and access in 2021. This is referencing the need for, and use of, Multifactor Authentication (MFA) across different platforms for institutions and customers alike.

  • August 2021 Authentication and Access to Financial Institution Services and Systems 5

The year is rounded up with advisories published by both OFAC and FinCEN addressing the risks of facilitating ransomware payments. This is due to the rise in popularity in virtual currencies.

  • November 2021 FinCEN Advisory on Ransomware and the Use of the Financial System to Facilitate Ransom Payments 6

Lastly, the FDIC has presented a firm timeline on when institutions are to notify their regulators of a computer security incident: No more than 36 hours after the incident is detected. Also, the institution’s vendor(s) are to notify the institution as soon as possible of a confirmed event. This may be addressed in contract or other official documentation.

  • November 2021 Computer-Security Incident Notification 7

Looking ahead: In 2022, keep an eye out for a continued and increased focus on business continuity testing and documenting Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Also, expect increased focus on vendor relationships. Is it only the third party or are there hidden fourth- and possibly fifth-party vendors to consider? In any instance, you should work to implement sound cybersecurity procedures and mitigate cybersecurity threats.


1 https://www.fdic.gov/news/financial-institution-letters/2020/fil20003a.pdf
2 https://ithandbook.ffiec.gov/media/402799/ffiec_itbooklet_aio.pdf
3 https://www.fdic.gov/news/financial-institution-letters/2021/fil21050.html
4 https://www.fdic.gov/news/press-releases/2021/pr21075a.pdf
5 https://www.fdic.gov/news/financial-institution-letters/2021/fil21055a.pdf
6 https://www.fincen.gov/sites/default/files/2021-11/FinCEN%20Ransomware%20Advisory_FINAL_508_.pdf
7 https://www.fdic.gov/news/financial-institution-letters/2021/fil21074.html

← Return to Blog


This publication attempts to provide timely and accurate information concerning the subjects discussed. It is furnished with the understanding that it does not provide legal or other professional services. If legal or other expert assistance is required, the services of a qualified professional should be obtained.

Related Posts

Information Security Brief - January 2024

New Year. New Speed. New Risk. As technology continues to advance in our personal and work lives, technology plays an in...

Read more

Information Security Brief - December 2023

Holiday Tips: Keeping Digital Shopping Merry and Bright As we head into the busy shopping season for our loved ones, bel...

Read more

CEO Update - Q4 2023

Most financial institution CEOs do not believe their institution uses Artificial Intelligence. Their employees know diff...

Read more