Cybersecurity Supervision Work Program Overview

The Cybersecurity Supervision Work Program (CSW) is a component of the Office of the Comptroller of the Currency’s (OCC) risk-based bank information technology (BIT) supervision process. The CSW provides high-level examination objectives and procedures that are aligned with existing supervisory guidance and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

View the Cybersecurity Supervision
Work Program References

The CSW is structured to align with the six NIST CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond, and Recover—and the related categories and subcategories. This alignment provides examiners with a common framework and terminology for discussions with bank management.

Examiners apply risk-based supervision principles when using the CSW and may refer to the following during their assessments:

Comptroller’s Handbook booklet: Community Bank Supervision
Comptroller’s Handbook booklet: Large Bank Supervision
Federal Financial Institution Examination Council (FFIEC) Information Technology (IT) Examination Handbook booklets
Other related supervisory guidance

The OCC continues to encourage use of standardized approaches to assess and improve cybersecurity preparedness. National banks and federal savings associations may choose from a variety of standardized tools and frameworks available. The CSW sets no new regulatory expectations, and national banks and federal savings associations are not expected to use this work program to assess cybersecurity preparedness.