Cybersecurity Supervision Work Program References

The Cybersecurity Supervision Work Program (CSW) provides high-level examination procedures that are aligned with existing supervisory guidance and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Within the CSW Cross-References table on this page, users can filter and search for CSW procedures. The procedures are cross-referenced to common industry cybersecurity frameworks, OCC publications, and the FFIEC IT Examination Handbook. Learn more about the OCC’s cybersecurity supervision.

The CSW is a component of the OCC’s risk-based bank information technology supervision process. The CSW sets no new regulatory expectations, and national banks and federal savings associations are not expected to use this work program to assess cybersecurity preparedness.

CSW Cross-References

Use the filters below to see a table of CSW procedures and the cross-references or click search without applying filters to view all data. Learn more about CSW Cross-References.

Function	Function / Category / Unique ID	Procedure	OCC Resources	FFIEC IT Examination Handbook InfoBase	Industry Frameworks	Procedure Short Text	Category	Unique ID
Identify	Identify / IT Asset Management / ID.AM-3.NB	Network Baseline: Evaluate the effectiveness of the process for establishing and managing baseline network activity and normal internal and external data flows for users and systems, including those with third parties	OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4	Architecture, Infrastructure, and Operations Booklet III.C V VI.B.7 Appendix A (5-1; 5-2c; 13-3c-d,h,k) Information Security Booklet II.C.6, II.C.9, II.C.15a, II.C.22 Appendix A (6-10b; 6-7a-e; 6-10b; 6-21b; 6-35)	Center for Internet Security (CIS) 3.8 13.6 Cyber Risk Institute (CRI) PR.IR-04.01 NIST SP 800-53 r5 SI-4 (13)	Network Baseline	IT Asset Management	ID.AM-3.NB
Identify	Identify / IT Asset Management / ID.AM-8.ST	Shadow IT: Evaluate the adequacy of processes and the effectiveness of detection tools to identify and monitor for shadow IT	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 7, Procedures 1-3	Architecture, Infrastructure, and Operations Booklet III.B.3 Appendix A (4-5) Information Security Booklet II.C.12, II.C.13(e) Appendix A (6-18g)	Center for Internet Security (CIS) 2 1.3 1.5 Cyber Risk Institute (CRI) DE.CM-09.03 NIST SP 800-53 r5 CM-7 (4) CM-8 (3)	Shadow IT	IT Asset Management	ID.AM-8.ST
Identify	Identify / Risk Assessment/ ID.RA-1.VS	Vulnerability Scanning: Evaluate the adequacy of the scope, frequency, and effectiveness of the vulnerability scanning process	OCC Bulletin 2020-5 Attachment	Information Security Booklet II.A.2, IV.A.2(c) Appendix A (4-4; 6-27g; 8-1c-d; 10-1a; 10-2a,e,f)	Center for Internet Security (CIS) 7 7.1 7.5 7.6 Cyber Risk Institute (CRI) ID.RA-01.03 ID.IM-02.01 NIST SP 800-53 r5 RA-5 CA-2 (2) RA-5 (3)	Vulnerability Scanning	Risk Assessment	ID.RA-1.VS
Identify	Identify / Improvement / ID.IM-2.ET	Event Detection Testing and Improvement: Assess the adequacy of detection process testing.	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 3. Information Technology, Objective 5, Procedures 3.	Information Security Booklet IV, IV.A Appendix A (6-5a-c; 8-1g-h; 10-3a-c)	Center for Internet Security (CIS) 7 17.7 17.8 17.9 Cyber Risk Institute (CRI) ID.IM-02.03 ID.IM-03.02 NIST SP 800-53 r5 IR-3 (3) CA-2 (2)	Event Detection Testing and Improvement	Improvement	ID.IM-2.ET
Identify	Identify / IT Asset Management / ID.AM-1.AI	IT Asset Inventory: Evaluate the effectiveness of processes implemented to identify and maintain the asset inventory of all on-site and off-site system devices, hardware, and other system components	OCC Bulletin 2020-46 Attachment, page 5 OCC Bulletin 2020-94 Attachment, Appendix A, page 10 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 3.	Information Security Booklet II.C.5 Appendix A (6-6a,e) Architecture, Infrastructure, and Operations Booklet III.B, III.B.1 Appendix A (4-1; 4-2a,e: 4-3a)	Center for Internet Security (CIS) 1.1 Cyber Risk Institute (CRI) ID.AM-01.01 ID.AM-02.01 ID.AM-03.01 ID.AM-04.01 NIST SP 800-53 r5 CM-8 CM-8 (4) PM-05	IT Asset Inventory	IT Asset Management	ID.AM-1.AI
Identify	Identify / IT Asset Management / ID.AM-2.SI	Software Inventory: Evaluate the effectiveness of software inventory management processes to include end of support and end of life situations	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 3. Information Technology, Objective 6, Procedure 6.	Architecture, Infrastructure, and Operations Booklet III.B.2 Appendix A (4-3b, 4-4a,d,e)	Center for Internet Security (CIS) 2.1 NIST SP 800-53 r5 CM-8 CM-8 (4) PM-05	Software Inventory	IT Asset Management	ID.AM-2.SI
Identify	Identify / IT Asset Management / ID.AM-2.DF	Data Flow: Evaluate the effectiveness of the processes for developing, maintaining, and securing data flow diagrams	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 4 Information Technology, Objective 6, Procedure 4 Information Technology, Objective 6, Procedure 5	Information Security Booklet II.C.6, II.C.9 Appendix A (1-3b; 6-10b) Architecture, Infrastructure, and Operations Booklet III.C.2 Appendix A (5-1)	Center for Internet Security (CIS) 3.8 Cyber Risk Institute (CRI) GV.OC-04.01 ID.AM-03.01 NIST SP 800-53 r5 AC-4 PL-8	Data Flow	IT Asset Management	ID.AM-2.DF
Identify	Identify / IT Asset Management / ID.AM-3.EC	External Connections: Assess the processes for identifying and maintaining an inventory of all external connections	OCC Bulletin 2020-46 Attachment, page 5 OCC Bulletin 2020-94 Attachment, page 10 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 5 Information Technology, Objective 2, Procedure 6 Information Technology, Objective 4, Procedure 3	Architecture, Infrastructure, and Operations Booklet III.B, III.B.1(a), III.I Appendix A (4-3a; 11-1a; 14-2a-e) Business Continuity Management Booklet III.A.1 Appendix A (5-3) Information Security Booklet II.C.5 Appendix A (6-6)	Center for Internet Security (CIS) 12.4 Cyber Risk Institute (CRI) ID.AM-03.01 NIST SP 800-53 r5 AC-20 SA-9	External Connections	IT Asset Management	ID.AM-3.EC
Identify	Identify / IT Asset Management / ID.AM-7.DI	Data Classification: Assess the adequacy of the data classification methodology to determine if data criticality and sensitivity are identified and maintained	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 6 Information Technology, Objective 4, Procedure 2 Information Technology, Objective 5, Procedure 4	Information Security Booklet II.C.5 Appendix A (6-6a-e) Architecture, Infrastructure, and Operations Booklet III.A.1, III.B.1(a), III.B.1(b) Appendix A (3-3; 3-5)	Center for Internet Security (CIS) 3.7 Cyber Risk Institute (CRI) ID.AM-05.02 ID.AM-08.03 NIST SP 800-53 r5 RA-9 RA-2	Data Classification	IT Asset Management	ID.AM-7.DI
Identify	Identify / IT Asset Management / ID.AM-8.DM	Data Management: Evaluate the effectiveness of the data management life cycle to include identification, analysis, storage, and disposal	OCC Bulletin 2020-94 Attachment, Appendix A, page 10 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3	Architecture, Infrastructure, and Operations Booklet III.A, III.A.1 Appendix A (3-1; 3-2; 3-3; 3-4)	Center for Internet Security (CIS) 3.2 3.5 Cyber Risk Institute (CRI) ID.AM-07.01 ID.AM-08.05 NIST SP 800-53 r5 SI-12 SI-12(3) CM-13	Data Management	IT Asset Management	ID.AM-8.DM
Identify	Identify / Improvement / ID.IM-2.AS	Assurance: Review and evaluate assurance and testing processes to determine whether cybersecurity controls are in place and working effectively to mitigate identified security risks	OCC Bulletin 2020-5 Attachment, pages 2,3, 5 OCC Bulletin 2020-94 Attachment, page 3 OCC Bulletin 2015-40 Attachment, page 2 OCC Bulletin 2015-20 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 4.	Information Security Booklet IV.A Appendix A (6-4a-c; 6-5a-c; 10-1; 10-2; 10-3; 10-4; 10-5; 10-6) Management Booklet I.B.7(b) Appendix A (13-5) Architecture, Infrastructure, and Operations Booklet II.D Appendix A (2-4a)	Cyber Risk Institute (CRI) GV.AU-01.02 GV.AU-01.03 GV.AU-03.01 GV.IR-01.01 NIST SP 800-53 r5 CA-2 CA-2(2)	Assurance	Improvement	ID.IM-2.AS
Identify	Identify / Improvement / ID.IM-2.PT	Penetration testing: Assess the adequacy of scope, frequency, and effectiveness of penetration testing	OCC Bulletin 2020-5 Attachment, page 5 OCC Bulletin 2023-17 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4	Information Security Booklet IV.A.2(b) Appendix A (10-1a) Development, Acquisition, and Maintenance Booklet VII.B Appendix A (13-1o-r)	Center for Internet Security (CIS) 16.13 18 18.1 18.5 Cyber Risk Institute (CRI) ID.IM-02.01 D3.DC.Th.A.2 D3.DC.Th.B.1 D3.DC.Th.E.5 NIST SP 800-53 r5 CA-8	Penetration testing	Improvement	ID.IM-2.PT
Identify	Identify / Risk Assessment / ID.RA-2.CT	Threat Intelligence: Evaluate the effectiveness of threat intelligence collection from external sources	OCC Bulletin 2015-40 Attachment, page 2 OCC Bulletin 2020-5 Attachment, page 5 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 4.	Information Security Booklet II.C III.A, III.B Appendix A (4-2a-b; 4-3; 4-4; 8-3a-b,d,f)	Center for Internet Security (CIS) 7 Cyber Risk Institute (CRI) ID.RA-02.01 ID.RA-03.02 NIST SP 800-53 r5 SI-5 PM-15 PM-16 RA-03(2)	Threat Intelligence	Risk Assessment	ID.RA-2.CT
Identify	Identify / Risk Assessment / ID.RA-5.CR	Risk Assessment: Evaluate the cybersecurity risk assessment process to assess whether threats, vulnerabilities, likelihoods, and impacts are used to determine business impacts and overall risk	OCC Bulletin 2020-94 Attachment, page 4 OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3. Information Technology, Objective 5, Procedure 4.	Management Booklet III.B Appendix A (7-1; 7-4a-f) Information Security Booklet II.B III.A Appendix A (4-3; 4-4)	Center for Internet Security (CIS) 7 Cyber Risk Institute (CRI) ID.RA-04.01 ID.RA-05.01 NIST SP 800-53 r5 RA-1 RA-3 RA-3(3)	Risk Assessment	Risk Assessment	ID.RA-5.CR
Identify	Identify / Risk Assessment / ID.RA-6.RR	Risk Response: Assess the effectiveness of management's prioritization and response to identified risks to include consideration of cybersecurity insurance	OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure Information Technology, Objective 6, Procedure 7.	Management Booklet III.B, III.C.7 Appendix A (13) Information Security Booklet III.A Appendix A (3-3b; 6-1; 6-2; 6-3; 6-4a-c)	Cyber Risk Institute (CRI) ID.RA-06.01 ID.RA-06.02 NIST SP 800-53 r5 PM-4 RA-7	Risk Response	Risk Assessment	ID.RA-6.RR
Identify	Identify / IT Asset Management / ID.AM-8.MP	Media Protection: Evaluate the effectiveness of processes to manage electronic media storage, transit, sanitization, and disposal.	OCC Bulletin 2020-5 Attachment, page 2-3 OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3. Information Technology, Objective 5, Procedure 7.	Information Security Booklet II.C.8, II.C.13, II.C.13(d) Appendix A (6-18a,f) Architecture, Infrastructure, and Operations Booklet VI.B.8 Appendix A (15-8a-f) Development, Acquisition, and Maintenance Booklet IV.O.1(e), IV.Q.1 VII.D Appendix A (13-3c-e)	Center for Internet Security (CIS) 3.1 3.5 Cyber Risk Institute (CRI) PR.DS-01.01 PR.DS-02.01 ID.AM-08.04 ID.AM-08.05 NIST SP 800-53 r5 MP-1 MP-4 MP-5 MP-6	Media Protection	IT Asset Management	ID.AM-8.MP
Identify	Identify / Improvement / ID.IM-2.TR	Test Response and Recovery Plans: Assess the adequacy of cybersecurity incident response and recovery plan testing.	OCC Bulletin 2020-5 Attachment, page 2-3 OCC Bulletin 2020-94 Attachment, page 3 OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4. Information Technology, Objective 2, Procedure 6.	Information Security Booklet III.D Appendix A (6-34d) Business Continuity Management Booklet VII Appendix A (10) Development, Acquisition, and Maintenance Booklet IV.O.1(c), IV.Q.1 Appendix A (14-7c-e)	Center for Internet Security (CIS) 17.7 11.1 Cyber Risk Institute (CRI) ID.IM-02.04 NIST SP 800-53 r5 IR-4 IR-3 IR-3(3)	Test Response and Recovery Plans	Improvement	ID.IM-2.TR
Identify	Identify / Improvement / ID.IM-4.RP	Response Plans: Assess the adequacy of governance and oversight of response plans supporting cybersecurity protection.	OCC Bulletin 2020-5 Attachment, page 2-3 OCC Bulletin 2020-94 Attachment, page 3 OCC Bulletin 2015-40 Attachment, page 2 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3.	Information Security Booklet III.D Appendix A (3-3a-f) Development, Acquisition, and Maintenance Booklet IV.I.2, IV.Q.1 VI.D Appendix A (9-2i,l,v)	Center for Internet Security (CIS) 17.1 17.2 Cyber Risk Institute (CRI) RS.MA-01.01 ID.IM-04.02 NIST SP 800-53 r5 IR-1 IR-3(3) IR-4(11)	Response Plans	Improvement	ID.IM-4.RP
Identify	Identify / IT Asset Management / ID.AM-8.MT	Maintenance Tools: Assess the adequacy of processes and tools to maintain IT assets	None	Architecture, Infrastructure, and Operations Booklet VI.B.1 Appendix A (14-1a-f; 15-1a-c,h-i) Development, Acquisition, and Maintenance Booklet II.A, II.B, II.B.5 VII Appendix A (2; 3; 4; 8; 9-2z; 13-1 – 13-4)	Center for Internet Security (CIS) 1.1 2.1 Cyber Risk Institute (CRI) PR.PS-03.01 NIST SP 800-53 r5 MA-2 MA-3 MA-5	Maintenance Tools	IT Asset Management	ID.AM-8.MT
Identify	Identify / IT Asset Management / ID.AM-8.DD	Data Disposal and Device Sanitization: Assess the adequacy of processes to manage data disposal and device sanitization	12 CFR 30 Appendix B (GLBA):II Standards for information security (B 4)	Information Security Booklet II.C.13(c) Appendix A (6-18d-f) Architecture, Infrastructure, and Operations Booklet VI.B.8 Appendix A (15-8a-f) Development, Acquisition, and Maintenance Booklet IV.O.1(e), IV.Q.1 VII.D Appendix A (7-6a-f; 9-2z; 13-3a-f)	Center for Internet Security (CIS) 3.1 3.5 Cyber Risk Institute (CRI) ID.AM-08.04 ID.AM-08.05 PR.DS-01.03 NIST SP 800-53 r5 MP-6 MP-7(2)	Data Disposal and Device Sanitization	IT Asset Management	ID.AM-8.DD
Identify	Identify / Improvement / ID.IM-4.RU	Recovery Plan Updates: Assess if recovery plans and tests are updated to include current threat intelligence, recognize lessons learned, and address issues identified during actual incidents or tests	OCC Bulletin 2020-5 Attachment, page 2-3 OCC Bulletin 2020-94 Attachment, page 3 OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.D Appendix A (7-1) Business Continuity Management Booklet VII.E VIII Appendix A (11-1e-f,j-k; 11-2a-e; 11-3) Development, Acquisition, and Maintenance Booklet IV.Q.1, IV.Q.2 V VII.B	Center for Internet Security (CIS) 17.4 17.7 17.8 Cyber Risk Institute (CRI) RC.IM-02.01 ID.RA-06.06 ID.IM-04.08 NIST SP 800-53 r5 CP-2 CP-3 IR-8	Recovery Plan Updates	Improvement	ID.IM-4.RU
Identify	Identify / Improvement / ID.IM-4.RX	Recovery Plan Execution: Evaluate the effectiveness of incident recovery plans and restoration processes, including recovery plan testing	OCC Bulletin 2020-5 Attachment, page 2, 3 and 4 OCC Bulletin 2020-94 Attachment, page 8, 6(a) OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.D Appendix A (8-6a-i) Business Continuity Management Booklet V.B, V.F.1 Appendix A (8-10; 10-10) Development, Acquisition, and Maintenance Booklet IV.O.1(d), IV.Q.1 Appendix A (9-2v, ab)	Center for Internet Security (CIS) 11.1 17.4 Cyber Risk Institute (CRI) RC.RP-01.01 NIST SP 800-53 r5 IR-8 CP-2	Recovery Plan Execution	Improvement	ID.IM-4.RX
Identify	Identify / Risk Assessment / ID.RA-8.VM	Vulnerability Management: Evaluate the effectiveness of processes that receive, analyze, and respond to vulnerabilities	OCC Bulletin 2020-94 Attachment, page 9 OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.A IV.A.2 Appendix A (4-4; 8-1c-d,h-I; 8-3a-f) Architecture, Infrastructure, and Operations Booklet VI.B.3(a) Appendix A (15-3a) Business Continuity Management Booklet V.F.1 Development, Acquisition, and Maintenance Booklet IV.A, IV.H, IV.I.2, IV.Q, IV.Q.1, IV.Q.2 V, V.D.2 VII, VII.B, VII.C Appendix A (9-2n,q,r,w; 11-1d-e; 13-1e,f,k,o-q)	Center for Internet Security (CIS) 7 16.2 Cyber Risk Institute (CRI) ID.RA-08.01 ID.RA-08.02 RS.MI-01.01 NIST SP 800-53 r5 IR-8 CP-2	Vulnerability Management	Risk Assessment	ID.RA-8.VM
Identify	Identify / Improvement / ID.IM-4.IR	Incident Response - Lessons Learned: Assess adequacy of processes that analyze and incorporate lessons learned to the Incident Response Plan.	OCC Bulletin 2005-13 Attachment OCC Bulletin 2020-94 Attachment, Appendix A OCC Bulletin 2015-40 Attachment, page 2 OCC Bulletin 2020-5 Attachment, page 2-3	Information Security Booklet III.D Appendix A (9-1b) Architecture, Infrastructure, and Operations Booklet III.F Appendix A (8-1) Development, Acquisition, and Maintenance Booklet IV.Q.1	Center for Internet Security (CIS) 17.8 Cyber Risk Institute (CRI) ID.IM-04.08 NIST SP 800-53 r5 IR-4	Incident Response - Lessons Learned	Improvement	ID.IM-4.IR
Recover	Recover / Incident Recovery Communications / RC.CO-3.RC	Recovery Communications: Evaluate the effectiveness of communication to internal and external stakeholders regarding recovery activities.	OCC Bulletin 2020-5 Attachment OCC Bulletin 2015-40 Attachment OCC Bulletin 2020-94 Attachment, page 4 OCC Bulletin 2021-55 Attachment, page 66427 OCC Bulletin 2021-36 Attachment OCC Bulletin 2023-17 Attachment OCC Bulletin 2022-8 Attachment OCC Bulletin 2005-13 Attachment, page 15735 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 5	Business Continuity Management Booklet IV.B V.F.1 Appendix A (7-1a-e; 8-12a-g;8-13a,d) Development, Acquisition, and Maintenance Booklet IV.Q.1 VI.E.4	Center for Internet Security (CIS) 17.2 17.6 Cyber Risk Institute (CRI) ID.IM-04.02 RS.CO-03.02 RS.CO-03.01 NIST SP 800-53 r5 IR-4 (15) IR-6	Recovery Communications	Incident Recovery Communications	RC.CO-3.RC
Recover	Recover / Incident Recovery Plan Execution / RC.RP-6.RE	Response Plan Execution: Assess effectiveness of processes related to execution of the cybersecurity incident response plan	OCC Bulletin 2005-13 Attachment, page 15735 OCC Bulletin 2020-94 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 4	Information Security Booklet III.D Appendix A (8-6a-b, d-f, h-i) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4a,b,f) Business Continuity Management Booklet V.A V.F.1 Appendix A (8-10a-c) Development, Acquisition, and Maintenance Booklet IV.Q.1 VII.B.4(c) Appendix A (9-2v; 14-7c)	Center for Internet Security (CIS) 17.1 17.3 17.8 Cyber Risk Institute (CRI) RS.MA-01.01 RS.MA-05.01 RS.CO-02.02 RS.CO-02.01 RS.CO-03.02 NIST SP 800-53 r5 IR-4 IR-5 IR-6 IR-8	Response Plan Execution	Incident Recovery Plan Execution	RC.RP-6.RE
Respond	Respond / Incident Management / RS.MA-3.II	Incident Impact: Evaluate the effectiveness of processes that analyze the impact of an incident.	OCC Bulletin 2005-13 Attachment, page 17572 OCC Bulletin 2020-94 Attachment, page 9 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 5	Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4b) Information Security Booklet II.C.20 III.C Appendix A (8-1b-i)	Center for Internet Security (CIS) 17.7 Cyber Risk Institute (CRI) RS.AN-03.01 ID.RA-05.04 NIST SP 800-53 r5 IR-4	Incident Impact	Incident Management	RS.MA-3.II
Respond	Respond / Incident Analysis / RS.AN-3.FI	Forensic Investigation: Assess the adequacy of forensic investigation processes, to include planning, scope, and timeliness.	OCC Bulletin 2005-13 Attachment, page 17572 OCC Bulletin 2020-5 Attachment	Information Security Booklet III.C III.D Appendix A (8-1a-k) Business Continuity Management Booklet V.F.1 Appendix A (8-10a)	Center for Internet Security (CIS) 8.5 Cyber Risk Institute (CRI) RS.AN-06.01 NIST SP 800-53 r5 IR-4 (11) IR-5 IR-7	Forensic Investigation	Incident Analysis	RS.AN-3.FI
Respond	Respond / Incident Management / RS.MA-3.IC	Incident Categorization: Assess the adequacy of criteria to categorize and prioritize incidents.	OCC Bulletin 2020-94 Attachment, Appendix A	Information Security Booklet III.C Appendix A (8-1j; 8-5a-c) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4a-b)	Center for Internet Security (CIS) 17.9 Cyber Risk Institute (CRI) RS.MA-03.01 NIST SP 800-53 r5 IR-6 (2)	Incident Categorization	Incident Management	RS.MA-3.IC
Respond	Respond / Incident Response Reporting and Communication / RS.CO-3.IS	Information Sharing: Assess the appropriateness of strategy and practices to share information with affected staff, industry groups (e.g., Financial Services Information Sharing and Analysis Center (FS-ISAC)), financial sector, regulators, and peers.	OCC Bulletin 2020-94 Attachment OCC Bulletin 2020-5 Attachment OCC Bulletin 2015-40 Attachment, page 2	Business Continuity Management Booklet III.B.1 Appendix A) (7-1a-e) Information Security Booklet III.C Appendix A (8-6d) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4b,e) Development, Acquisition, and Maintenance Booklet IV.Q.1 VII.B Appendix A (9-2q,v,y)	Center for Internet Security (CIS) 17.2 17.5 Cyber Risk Institute (CRI) RS.CO-03.02 NIST SP 800-53 r5 PM-16 IR-4 (4) IR-4 (11)	Information Sharing	Incident Response Reporting and Communication	RS.CO-3.IS
Respond	Respond / Incident Management / RS.MA-1.IC	Incident Coordination: Assess the adequacy of internal and external stakeholder coordination in accordance with the response plan.	OCC Bulletin 2020-94 Attachment, pages 4,9 OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.D Appendix A (6-25b, c; 8-6b,d,f,g) Business Continuity Management Booklet IV.B V.F.1 Appendix A (7-1a-e) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4a,b,e) Development, Acquisition, and Maintenance Booklet IV.Q.1 VI.D, VI.E.1, VI.E.4 Appendix A (9-2v; 14-6i,j)	Center for Internet Security (CIS) 17.1 17.5 Cyber Risk Institute (CRI) RS.CO-02.03 NIST SP 800-53 r5 IR-4 (10) IR-4 (8)	Incident Coordination	Incident Management	RS.MA-1.IC
Respond	Respond / Incident Response Reporting and Communication / RS.CO-3.II	Incident Information Sharing: Evaluate information sharing arrangements to assess the effectiveness of sharing threats and countermeasures with other external stakeholders in order to support sector-wide situational awareness and response to incidents.	OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.C, III.D Appendix A (4-3; 8-6b,f) Business Continuity Management Booklet III.B.1 Appendix A (7-1a-e) Development, Acquisition, and Maintenance Booklet IV.Q.1 V VII.B Appendix A (9-2q, r,v,w,y,cc; 10; 13-1o-q)	Center for Internet Security (CIS) None Cyber Risk Institute (CRI) RS.CO-03.02 ID.RA-02.02 NIST SP 800-53 r5 PM-15 IR-6 IR-4 (8)	Incident Information Sharing	Incident Response Reporting and Communication	RS.CO-3.II
Respond	Respond / Incident Mitigation / RS.MI-1.IC	Incident Containment: Assess the adequacy of incident containment processes to minimize damage from the effects of an incident.	OCC Bulletin 2020-94 Attachment, Appendix A OCC Bulletin 2005-13 Attachment, page 17572 OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet III.D Appendix A (8-6b,h,i) Development, Acquisition, and Maintenance Booklet VI.E.1 VII.B.3(c) Appendix A (9-2v)	Center for Internet Security (CIS) 17.2 17.4 Cyber Risk Institute (CRI) RS.MI-01.01 NIST SP 800-53 r5 IR-4 IR-4 (11)	Incident Containment	Incident Mitigation	RS.MI-1.IC
Respond	Respond / Incident Mitigation / RS.MI-2.IM	Incident Mitigation: Assess the adequacy of incident mitigation processes as defined in the response plan or evidenced during actual incidents.	OCC Bulletin 2005-13 Attachment, page 17572 OCC Bulletin 2015-40 Attachment, page 2 OCC Bulletin 2020-94 Attachment, Appendix A	Information Security Booklet III.D Appendix A (3-3e) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (8-1; 16-4a-b) Development, Acquisition, and Maintenance Booklet IV.Q.1 VI, VI.E.1 Appendix A (9-2r,v)	Center for Internet Security (CIS) 17 Cyber Risk Institute (CRI) RS.MI-01.01 NIST SP 800-53 r5 IR-4 IR-4 (11)	Incident Mitigation	Incident Mitigation	RS.MI-2.IM
Respond	Respond / Incident Analysis / RS.AN-3.VM	Vulnerability Mitigation: Assess the adequacy of processes to respond to additional vulnerabilities identified during mitigation.	OCC Bulletin 2020-94 Attachment, Appendix A OCC Bulletin 2005-13 Attachment, page 17572 OCC Bulletin 2015-40 Attachment, page 2	Information Security Booklet II.A.2 Appendix A (8-4a,d-f; 6-15h; 4-1; 4-4) Development, Acquisition, and Maintenance Booklet IV.Q.1 Appendix (9-2q-r; 13-1p-q) Architecture, Infrastructure, and Operations Booklet VI.B.3, VI.B.3(a) Appendix A (15-3)	Center for Internet Security (CIS) 7.3 7.4 Cyber Risk Institute (CRI) ID.RA-06.06 NIST SP 800-53 r5 IR-6 (2) RA-5 SI-2	Vulnerability Mitigation	Incident Analysis	RS.AN-3.VM
Detect	Detect / Continuous Monitoring / DE.CM-1.NA	Network Activity Monitoring: Assess the adequacy of processes that monitor network activities and identify and alert for anomalous activity and traffic patterns	OCC Bulletin 2015-20 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 6	Information Security Booklet II.C.15(a), II.C.22 III Appendix A (8-1h; 8-4d-e) Architecture, Infrastructure, and Operations Booklet V.B.1 Appendix A (13-3h)	Center for Internet Security (CIS) 13.1-13.3 13.6-13.8 Cyber Risk Institute (CRI) DE.AE-03.01 DE.AE-03.02 DE.CM-01.01 DE.CM-01.02 NIST SP 800-53 r5 SI-4 (13) SI-15 SI-4 (17)	Network Activity Monitoring	Continuous Monitoring	DE.CM-1.NA
Detect	Detect / Adverse Event Analysis / DE.AE-2.AP	Alert Parameters: Assess the adequacy of processes that define, manage, and adjust alert parameters for detecting and notifying management of events/incidents	OCC Bulletin 2015-20 Attachment, page 3 OCC Bulletin 2020-94 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4	Architecture, Infrastructure, and Operations Booklet VI.B.7 Appendix A (15-7a-e) Information Security Booklet II.C.15(a), II.C.15(b), II.C.16 Appendix A (6-21f; 6-22f; 6-25b; 6-35b)	Center for Internet Security (CIS) 13.1 13.11 Cyber Risk Institute (CRI) DE.AE-02.01 DE.AE-02.02 DE.AE-03.01 DE.AE-03.02 DE.CM-01.02 DE.CM-06.02 ID.IM-03.02 NIST SP 800-53 r5 SI-4 (5)	Alert Parameters	Adverse Event Analysis	DE.AE-2.AP
Detect	Detect / Adverse Event Analysis / DE.AE-2.EI	Event Identification and Analysis: Evaluate the effectiveness of processes that identify and analyze events	OCC Bulletin 2005-13 Attachment, page 15735 OCC Bulletin 2021-55 Attachment, page 66427 OCC Bulletin 2021-36 Attachment OCC Bulletin 2015-20 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 4.	Information Security Booklet III.C Appendix A (2-5c; 3-2b; 8-5a-c) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4b)	Center for Internet Security (CIS) 17.9 Cyber Risk Institute (CRI) PR.PS-04.01 PR.PS-04.03 DE.AE-03.01 NIST SP 800-53 r5 SI-4(5)	Event Identification and Analysis	Adverse Event Analysis	DE.AE-2.EI
Detect	Detect / Adverse Event Analysis / DE.AE-3.EA	Event Analysis and Reporting: Evaluate the effectiveness of log collection and log data aggregation processes to determine whether event data are relevant, accurate, and complete.	OCC Bulletin 2021-36 Attachment OCC Bulletin 2015-20 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 1	Architecture, Infrastructure, and Operations Booklet VI.B.7 Appendix A (15-7a-e) Information Security Booklet II.C.15(a), II.C.15(b), II.C.22 Appendix A (6-13; 6-35a, d)	Center for Internet Security (CIS) 8.1 8.5 8.11 8.12 Cyber Risk Institute (CRI) PR.PS-04.01 PR.PS-04.03 DE.AE-03.01 DE.CM-03.03 NIST SP 800-53 r5 AU-06	Event Analysis and Reporting	Adverse Event Analysis	DE.AE-3.EA
Detect	Detect / Adverse Event Analysis / DE.AE-7.TC	Threat Correlation: Evaluate the effectiveness of the processes for correlating threat intelligence with internal event data analysis	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 3, Procedures 1-4	Information Security Booklet II.A.1 III, III.A, III.C Appendix A (6-35d; 7-1; 8-3; 8-8l)	Center for Internet Security (CIS) 13.1 8.5 Cyber Risk Institute (CRI) DE.AE-03.02 NIST SP 800-53 r5 SA-4 (17) CA-7 (3) IR-4 (4)	Threat Correlation	Adverse Event Analysis	DE.AE-7.TC
Detect	Detect / Adverse Event Analysis / DE.AE-4.EI	Event Impact: Assess the adequacy of processes for analyzing the impact from active event(s).	OCC Bulletin 2015-20 Attachment OCC Bulletin 2020-46 Attachment OCC Bulletin 2021-55 Attachment, page 66427 OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedures 1-8	Information Security Booklet II.C.22 III.C Appendix A (7-4c) Architecture, Infrastructure, and Operations Booklet VI.D.4 Appendix A (16-4b)	Center for Internet Security (CIS) 13.2 13.3 Cyber Risk Institute (CRI) DE.AE-02.01 RS.AN-03.01 DE.AE-04.01 NIST SP 800-53 r5 None	Event Impact	Adverse Event Analysis	DE.AE-4.EI
Detect	Detect / Adverse Event Analysis / DE.AE-8.IT	Incident Thresholds: Evaluate the effectiveness of the process used to establish alert thresholds to determine when an event is designated as an incident	OCC Bulletin 2020-5 Attachment OCC Bulletin 2021-55 Attachment, page 66427	Information Security Booklet I.B III.C, III.D Appendix A (2-5e; 8-5h; 8-6f) Architecture, Infrastructure, and Operations Booklet VI.C.4 Appendix A (16-4a-b, e-f)	Center for Internet Security (CIS) 13.11 17.9 Cyber Risk Institute (CRI) DE.AE-02.02 NIST SP 800-53 r5 None	Incident Thresholds	Adverse Event Analysis	DE.AE-8.IT
Detect	Detect / Continuous Monitoring / DE.CM-1.NM	Network Monitoring: Assess the adequacy of processes to monitor the network for events (e.g., unauthorized personnel and third-party connections)	OCC Bulletin 2015-20 Attachment, page 3 OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 8	Information Security Booklet II.C.9 III Appendix A (8-1g-h; 4d-e) Architecture, Infrastructure, and Operations Booklet V.B.1 Appendix A (13-3h)	Center for Internet Security (CIS) 13.3 13.2 Cyber Risk Institute (CRI) DE.AE-02.01 DE.AE-03.02 NIST SP 800-53 r5 SI-4 SI-4 (1) SI-4 (3)	Network Monitoring	Continuous Monitoring	DE.CM-1.NM
Detect	Detect / Continuous Monitoring / DE.CM-1.NS	Network Monitoring Scope: Assess the effectiveness of the risk management processes that determine the scope and type of implemented monitoring solutions.	OCC Bulletin 2015-20 Attachment, page 3 OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 6 Information Technology, Objective 5, Procedure 1 Information Technology, Objective 5, Procedure 9	Architecture, Infrastructure, and Operations Booklet IV.B Appendix A (8-2c-d,f; 12-4c-d; 13-3h) Information Security Booklet II.C.9, II.C.9(a) Appendix A) (6-4a-c)	Center for Internet Security (CIS) 13.3 Cyber Risk Institute (CRI) DE.AE-02.01 GV.RM-01.04 NIST SP 800-53 r5 SI-4	Network Monitoring Scope	Continuous Monitoring	DE.CM-1.NS
Detect	Detect / Continuous Monitoring / DE.CM-2.PA	Physical Asset Controls: Assess effectiveness of controls over the physical facility and technology assets.	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 2 Information Technology, Objective 5, Procedure 8 Information Technology, Objective 5, Procedure 9	Information Security Booklet II.C.8 Appendix A (6-9) Architecture, Infrastructure, and Operations Booklet VI.A.1 Appendix A (13-9e)	Center for Internet Security (CIS) 1 Cyber Risk Institute (CRI) DE.CM-02.01 DE.AE-03.01 NIST SP 800-53 r5 PE-6 PE-6 (4) PE-22	Physical Asset Controls	Continuous Monitoring	DE.CM-2.PA
Detect	Detect / Continuous Monitoring / DE.CM-9.AA	Application Anomalous Activity: Evaluate the effectiveness of application-level controls that identify, measure, monitor, manage, and report anomalous activities	OCC Bulletin 2015-20 Attachment OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 1	Information Security Booklet II.C.17, II.C.12 Appendix A (6-27a-g; 6-17; 8-4a-e)	Center for Internet Security (CIS) 9.7 10 10.1 10.7 Cyber Risk Institute (CRI) PR.PS-05.01 PR.PS-05.03 NIST SP 800-53 r5 SI-3	Application Anomalous Activity	Continuous Monitoring	DE.CM-9.AA
Detect	Detect / Continuous Monitoring / DE.CM-9.UM	Unauthorized Mobile Code: Evaluate the effectiveness of processes and controls to detect unauthorized mobile code	OCC Bulletin 2020-5 Attachment OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 1 Information Technology, Objective 5, Procedure 9	Information Security Booklet II.C.12 Appendix A (6-17; 6-24b-c) Development, Acquisition, and Maintenance IV.Q.1 Appendix A (9-2p; 10-1b,d,e,f)	Center for Internet Security (CIS) 10 10.1 10.2 10.4 Cyber Risk Institute (CRI) PR.PS-05.02 NIST SP 800-53 r5 SC-18	Unauthorized Mobile Code	Continuous Monitoring	DE.CM-9.UM
Detect	Detect / Adverse Event Analysis / DE.AE-2.ED	Event Detection Processes: Assess the effectiveness of detection processes, including planning and implementation, personnel, and communication of event information	OCC Bulletin 2021-55 Attachment, page 66427	Information Security Booklet III.C Appendix A (8-1g-j; 8-4a; 4-1) Business Continuity Management Booklet V.A Appendix A (8-3a-c)	Center for Internet Security (CIS) 7 17.1 17.4 Cyber Risk Institute (CRI) DE.AE-03.01 NIST SP 800-53 r5 CA-7 IR-4 SI-4	Event Detection Processes	Adverse Event Analysis	DE.AE-2.ED
Detect	Detect / Continuous Monitoring / DE.CM-9.DL	Data Loss Prevention: Evaluate the effectiveness of processes to minimize or prevent the risk of data loss.	OCC Bulletin 2021-36 Attachment OCC Bulletin 2015-20 Attachment, page 3 OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 1 Information Technology, Objective 4, Procedure 4	Architecture, Infrastructure, and Operations Booklet III.B.3 IV.B Appendix A (4-5d) Information Security Booklet Glossary Development, Acquisition, and Maintenance Booklet IV.H IV.I.2 VII.B.2(c) Appendix A (4-6a-d; 4-9b; 13-3e)	Center for Internet Security (CIS) 3.13 Cyber Risk Institute (CRI) PR.DS-01.02 PR.DS-01.03 NIST SP 800-53 r5 SC-7 (10) AU-13 PE-19	Data Loss Prevention	Continuous Monitoring	DE.CM-9.DL
Detect	Detect / Continuous Monitoring / DE.CM-9.HI	Hardware Integrity: Assess the adequacy of processes that identify and manage hardware integrity.	OCC Bulletin 2020-5 Attachment	Architecture, Infrastructure, and Operations Booklet VI.B.2 Appendix A (13-3c-d; 15-3a) Information Security Booklet II.C.10(a) Appendix A (6-19c) Development, Acquisition, and Maintenance Booklet IV, IV.A, IV.O.1(d), IV.Q, IV.Q.1 Appendix A (4-5b-c; 4-12-c; 9-2k,)	Center for Internet Security (CIS) 4.6 Cyber Risk Institute (CRI) DE.CM-09.01 DE.CM-09.02 NIST SP 800-53 r5 SA-10 (03) PE-22 CM-3 (2) CM-7 (9)	Hardware Integrity:	Continuous Monitoring	DE.CM-9.HI
Detect	Detect / Adverse Event Analysis / DE.AE-8.NI	Notifications Investigated: Assess the adequacy of the processes to investigate event notifications	OCC Bulletin 2015-40 Attachment OCC Bulletin 2021-36 Attachment OCC Bulletin 2015-20 Attachment OCC Bulletin 2020-5 Attachment	Information Security Booklet II.C.22 III.C Appendix A (6-35d; 8-5a-d,h)	Center for Internet Security (CIS) 8.11 16.3 Cyber Risk Institute (CRI) RS.AN-03.01 NIST SP 800-53 r5 SI-4	Notifications Investigated	Adverse Event Analysis	DE.AE-8.NI
Govern	Govern / Cybersecurity Supply Chain Risk Management / GV.SC-2.SC	Supply Chain: Evaluate how management determines and communicates if the bank holds a critical or systemically important role in providing services to other entities in the financial sector.	None	Business Continuity Management Booklet I III VII.A Appendix A (3-4c; 4-4a; 10-25c)	Cyber Risk Institute (CRI) DM.BE-1.1 NIST SP 800-53 r5 SR-1 SR-2	Supply Chain	Cybersecurity Supply Chain Risk Management	GV.SC-2.SC
Govern	Govern / Organizational Context / GV.OC-1.FS	Critical Infrastructure: Evaluate how management determines and communicates the bank's role in the financial services sector of the US critical infrastructure	None	None	Cyber Risk Institute (CRI) GV.OC-02.03 GV.AU-02.02 NIST SP 800-53 r5 PM-8	Critical Infrastructure	Organizational Context	GV.OC-1.FS
Govern	Govern / Organizational Context / GV.OC-5.CR	Critical Dependencies: Evaluate the effectiveness of processes that identify and maintain critical dependencies, such as power, telecommunications, network connectivity, and other critical infrastructures	OCC Bulletin 2020-94 Attachment, page 7, (f) OCC Bulletin 2003-14 Attachment	Business Continuity Management Booklet IV.A.6, IV.A.7 Appendix A (4-3a-d; 6-6a-h; 10-25d) Information Security Booklet II.C.5, II.C.6 Appendix A (6-7a-f)	Cyber Risk Institute (CRI) RC.RP-02.02 ID.IM-04.06 NIST SP 800-53 r5 CP-8 PE-9 PE-11 PM-8	Critical Dependencies	Organizational Context	GV.OC-5.CR
Govern	Govern / Organizational Context / GV.OC-5.CR	Cybersecurity Resilience: Evaluate cybersecurity resilience planning and response capabilities to support delivery of critical services	OCC Bulletin 2020-94 Attachment, Appendix A OCC Bulletin 2003-14 Attachment	Business Continuity Management Booklet IV.A.2 Appendix A (6-3a-f; 6-5a-f) Information Security Booklet II.C.16 Appendix A (6-25a-c)	Cyber Risk Institute (CRI) RC.RP-02.02 GV.OC-04.03 NIST SP 800-53 r5 CP-2 CP-10	Cybersecurity Resilience	Organizational Context	GV.OC-4.RR
Govern	Govern / Roles, Responsibilities, and Authorities / GV.RR-2.CR	Cybersecurity Roles: Review management and staff roles and responsibilities to determine whether they address cybersecurity risk management processes and procedures	OCC Bulletin 2020-94 Attachment, Appendix A OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedures 1-2.	Information Security Booklet I, I.A, I.B Appendix A (2)	Cyber Risk Institute (CRI) GV.RR-02.01 GV.RR-01.04 NIST SP 800-53 r5 PM-1 PM-3 AT-3	Cybersecurity Roles	Roles, Responsibilities, and Authorities	GV.RR-2.CR
Govern	Govern / Organizational Context / GV.OC-3.LR	Regulatory Requirements: Evaluate the processes' effectiveness for maintaining continued compliance with applicable rules and regulations	OCC Bulletin 2021-55 Attachment OCC Bulletin 2020-94 Attachment OCC Bulletin 2013-39 Attachment, iV Risk Areas OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5.	Information Security Booklet II.A Appendix A (4-5a) Management Booklet III.C.3(a) Appendix A (12-3) Architecture, Infrastructure, and Operations Booklet II.A Appendix A (2-9b)	Cyber Risk Institute (CRI) GV.OC-03.01 GV.OC-03.02 NIST SP 800-53 r5 PM-1 AT-1 RA-1	Regulatory Requirements	Organizational Context	GV.OC-3.LR
Govern	Govern / Risk Management Strategy / GV.RM-3.CR	Cybersecurity Risk: Assess the effectiveness of cybersecurity risk management processes.	OCC Bulletin 2020-94 Attachment, 1. Governance (b), Appendix A - Table 1 OCC Bulletin 2015-20 Attachment OCC Bulletin 2015-40 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 6. Information Technology, Objective 5, Procedure 2.	Information Security Booklet II Appendix A (2-10; 3-1a-e)	Cyber Risk Institute (CRI) ID.RA-06.01 ID.RA-06.02 NIST SP 800-53 r5 PM-11 PM-7 SA-2	Cybersecurity Risk	Risk Management Strategy	GV.RM-3.CR
Govern	Govern / Oversight / GV.OV-1.RM	Risk Strategy: Evaluate, as part of cybersecurity risk management, the effectiveness of strategic decisions with regard to business constraints, business priorities, and risk tolerances	OCC Bulletin 2020-94 Attachment, 1. Governance OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 1. Information Technology, Objective 2, Procedure 3.	Management Booklet I.B.1 III Appendix A (2-1a-d; 2-6g-I; 2-8a-e)	Cyber Risk Institute (CRI) GV.OC-02.02 GV.OC-01.01 GV.RM-01.02 NIST SP 800-53 r5 PM-9	Risk Strategy	Oversight	GV.OV-1.RM
Govern	Govern / Risk Management Strategy / GV.RM-2.RT	Risk Appetite/Tolerance: Evaluate the effectiveness of processes used to determine risk appetite and risk tolerance for cybersecurity	OCC Bulletin 2020-94 Attachment, 1. Governance (a)(e) OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2. Information Technology, Objective 2, Procedure 3.	Management Booklet III Appendix A (2-1a-b; 7-3a-b)	Cyber Risk Institute (CRI) ID.RA-06.02 GV.RM-02.02 ID.IM-01.03 NIST SP 800-53 r5 PM-9	Risk Appetite/Tolerance	Risk Management Strategy	GV.RM-2.RT
Govern	Govern / Risk Management Strategy / GV.RM-2.CI	Critical Infrastructure Risk Tolerance: Determine whether management considers and incorporates the bank's role as part of critical infrastructure when establishing risk appetite or risk tolerances	OCC Bulletin 2020-94 Attachment, 7. Surveillance and Reporting (a) OCC Bulletin 2003-14 Attachment	Management Booklet III III.A Appendix A (7-3a-c; 11-1a-i)	Cyber Risk Institute (CRI) DM.BE-1.1 GV.RM-09.02 ID.IM-02.08 NIST SP 800-53 r5 PM-28 PM-8	Critical Infrastructure Risk Tolerance	Risk Management Strategy	GV.RM-2.CI
Govern	Govern / Cybersecurity Supply Chain Risk Management / GV.SC-1.TP	Third party Risk: Evaluate how management incorporates cybersecurity and supply chain risk assessment into their third-party risk management processes	OCC Bulletin 2023-17 Attachment OCC Bulletin 2021-40 Attachment OCC Bulletin 2017-43 OCC Bulletin 2017-7 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 3, Procedure 1.	Development, Acquisition, and Maintenance Booklet IV.Q.1 Appendix A (9-2a-e) Information Security Booklet II.C.14, II.C.20 Appendix A (6-19; 6-31) Outsourcing Technology Service Booklet Board and Management Responsibilities Ongoing Monitoring Appendix A Tier I (3-6) Architecture, Infrastructure, and Operations Booklet VI.DI.1 Appendix A (17-1d) Management Booklet III.C.8 Appendix A (1-2c; 12-14)	Center for Internet Security (CIS) 15 15.2 Cyber Risk Institute (CRI) GV.SC-01.01 PR.AA-05.04 GV.RM-05.02 NIST SP 800-53 r5 SR-1 SR-2	Third party Risk	Cybersecurity Supply Chain Risk Management	GV.SC-1.TP
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-5.AM	Access and Authentication Management Program: Evaluate the effectiveness of the access management processes to implement and administer logical and physical access controls. This includes assessing authentication controls and use of multifactor authentication or similarly strong controls.	OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3 Information Technology, Objective 5, Procedure 7	Information Security Booklet II.C.7, II.C.7(b), II.C.15 Appendix A (6-21e; 6-22a-f; 6-23a-b) Architecture, Infrastructure, and Operations Booklet VI.A.3 Appendix A (14-3a-d)	Center for Internet Security (CIS) 6 6.2 6.4 6.5 Cyber Risk Institute (CRI) PR.AA-01.02 PR.AA-01.01 PR.AA-06.01 PR.AA-05.01 NIST SP 800-53 r5 AC-2 AC-3	Access and Authentication Management Program	Identity Management, Authentication and Access Control	PR.AA-5.AM
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-5.RA	Remote Access: Evaluate the effectiveness of processes to manage remote access.	OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 6	Architecture, Infrastructure, and Operations Booklet III.G Appendix A (9-1a-c) Information Security Booklet II.C.15(c) Appendix A (6-21e; 6-23a-b) Development, Acquisition, and Maintenance Booklet IV.F Appendix A (13-1)	Center for Internet Security (CIS) 6.4 Cyber Risk Institute (CRI) PR.IR-01.05 PR.IR-01.05 NIST SP 800-53 r5 CM-6 AC-17 IA-2	Remote Access	Identity Management, Authentication and Access Control	PR.AA-5.RA
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-5.PA	Privileged Access: Evaluate the effectiveness of processes to manage accounts with privileged access.	OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Bulletin 2015-40 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 1 Information Technology, Objective 4, Procedure 6	Information Security Booklet II.C.15 Appendix A (6-20d) Development, Acquisition, and Maintenance Booklet IV.F Appendix A (9-2x,z)	Center for Internet Security (CIS) 6 6.5 Cyber Risk Institute (CRI) PR.AA-05.01 PR.AA-05.02 NIST SP 800-53 r5 SC-2 AC-6(5)	Privileged Access	Identity Management, Authentication and Access Control	PR.AA-5.PA
Protect	Protect / Technology Infrastructure Resilience / PR.IR-1.NS	Network Segmentation: Evaluate the effectiveness of processes governing network segmentation, including planning and implementation.	OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4	Information Security Booklet II.C.9 Appendix A (6-10a) Development, Acquisition, and Maintenance Booklet IV.H Appendix A (4-8)	Center for Internet Security (CIS) 12.2 13.4 Cyber Risk Institute (CRI) PR.IR-01.01 NIST SP 800-53 r5 SC-7(21) SC-7(22)	Network Segmentation	Technology Infrastructure Resilience	PR.IR-1.NS
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-2.UI	User Identity: Assess the adequacy of identity verification and management processes.	OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 1 Information Technology, Objective 4, Procedure 4	Information Security Booklet II.C.15 Appendix A (6-20a,d,e)	Center for Internet Security (CIS) 5.6 Cyber Risk Institute (CRI) PR.AA-01.02 NIST SP 800-53 r5 IA-2 IA-12	User Identity	Identity Management, Authentication and Access Control	PR.AA-2.UI
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-3.DS	Device and System Authentication: Evaluate the adequacy of processes to manage system to system authentication.	OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3	Information Security Booklet II.C.15, II.C.15(b) Appendix A (6-22a; 6-27f) Development, Acquisition, and Maintenance Booklet IV.F, IV.I.2, IV.Q.1 Appendix A (4-5f; 4-9e-f)	Center for Internet Security (CIS) 5.5 Cyber Risk Institute (CRI) PR.AA-05.03 NIST SP 800-53 r5 AC-6	Device and System Authentication	Identity Management, Authentication and Access Control	PR.AA-3.DS
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-3.UA	User Authentication: Evaluate the adequacy of processes to manage user authentication practices.	OCC Bulletin 2021-36 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 6 Information Technology, Objective 5, Procedure 3	Information Security Booklet II.C.16 Appendix A (6-22a; 6-27f) Development, Acquisition, and Maintenance Booklet IV.I.2 IV.Q.1 Appendix A (4-9h-I)	Center for Internet Security (CIS) 6 Cyber Risk Institute (CRI) PR.AA-01.02 PR.AA-01.01 NIST SP 800-53 r5 IA-2 IA-5	User Authentication	Identity Management, Authentication and Access Control	PR.AA-3.UA
Protect	Protect / Awareness and Training / PR.AT-1.TA	Training and Awareness: Evaluate the adequacy of information security training and awareness programs.	OCC Bulletin 2021-36 Attachment OCC Bulletin 2020-5 Attachment OCC Bulletin 2005-44 Attachment, page 12 OCC Bulletin 2015-19 Attachment, page 5 OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3 Information Technology, Objective 5, Procedure 8	Information Security Booklet I.B II.C.7(e) Appendix A (2-5l; 2-9c) Development, Acquisition, and Maintenance Booklet IV.Q.1 VII.B.3(b) Appendix A (10-1a; 15-5c-d)	Center for Internet Security (CIS) 14.1 14.2 14.4 14.5 Cyber Risk Institute (CRI) PR.AT-1.1 PR.AT-1.2 PR.AT-1.3 PR.AT-1.4 PR.AT-2.1 PR.AT-2.2 PR.AT-2.6 PR.AT-2.7 NIST SP 800-53 r5 AT-2 AT-3	Training and Awareness	Awareness and Training	PR.AT-1.TA
Protect	Protect / Data Security / PR.DS-1.EP	Encryption Practices: Assess the adequacy of processes to plan and implement effective encryption practices for data at rest and data in-transit.	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3 Information Technology, Objective 5, Procedure 5	Information Security Booklet II.C.19 Appendix A (6-30) Architecture, Infrastructure, and Operations Booklet III.A.2(a) Appendix A (3-7e) Development, Acquisition, and Maintenance Booklet IV.Q.1 Appendix A (6-2)	Center for Internet Security (CIS) 3.6 3.9 3.10 3.11 Cyber Risk Institute (CRI) PR.DS-1.1 PR.DS-2.1 NIST SP 800-53 r5 SC-13 SC-8 AC-19 (5)	Encryption Practices	Data Security	PR.DS-1.EP
Protect	Protect / Identity Management, Authentication and Access Control / PR.AA-1.KM	Cryptographic Key and Certificate Management: Assess the adequacy of cryptographic key and certificate management processes.	None.	Information Security Booklet II.C.19 Appendix A (6-30)	NIST SP 800-53 r5 SC-12 CM-3 (6)	Cryptographic Key and Certificate Management	Identity Management, Authentication and Access Control	PR.AA-1.KM
Protect	Protect / Data Security / PR.DS-1.MM	Mobile Device Management: Assess the adequacy of processes to manage mobile devices used for critical functions or contain confidential data.	None.	Architecture, Infrastructure, and Operations Booklet III.H Appendix A (10-1a-e) Information Security Booklet II.C.15(d) Appendix A (6-24a-c)	Center for Internet Security (CIS) 4.10 4.11 4.12 Cyber Risk Institute (CRI) PR.PS-1.8 NIST SP 800-53 r5 AC-19	Mobile Device Management	Data Security	PR.DS-1.MM
Protect	Protect / Technology Infrastructure Resilience / PR.IR-4.SC	System Capacity: Assess the adequacy of processes to manage system capacity.	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4 Information Technology, Objective 2, Procedure 6	Architecture, Infrastructure, and Operations Booklet VI.B.6 Appendix A (15-6a-j) Development, Acquisition, and Maintenance Booklet II.B.3, II.B.5 VI.D Appendix A (9-2j,l)	Cyber Risk Institute (CRI) PR.IR-4.2 NIST SP 800-53 r5 CP-2(2) SC-5(2) SC-6	System Capacity	Technology Infrastructure Resilience	PR.IR-4.SC
Protect	Protect / Platform Security / PR.PS-1.SB	Security Baselines: Assess the adequacy of processes to identify and manage security baselines.	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 4, Procedure 3 Information Technology, Objective 5, Procedure 3	Information Security Booklet II.C.10(b), II.C.10(c) Appendix A (6-12, 6-13) Development, Acquisition, and Maintenance Booklet IV.O.1(d), IV.Q.1 Appendix A (7-2d-e; 9-2b,g,h)	Center for Internet Security (CIS) 4.1 4.2 16.7 Cyber Risk Institute (CRI) GV.RR-04.01 PR.PS-01.03 NIST SP 800-53 r5 CM-2 CM-3 PL-10	Security Baselines	Platform Security	PR.PS-1.SB
Protect	Protect / Information Protection Processes and Procedures / PR.DS-11.DB	Data Backup: Assess the adequacy of backup strategies and processes to protect data from physical and cyber threats.	OCC Bulletin 2020-94 Attachment, page 3 OCC Bulletin 2020-5 Attachment OCC Bulletin 2015-40 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 3 Information Technology, Objective 6, Procedure 6	Business Continuity Management Booklet IV.A.3 Appendix A (6-3a-f) Architecture, Infrastructure, and Operations Booklet VI.B.4 Appendix A (15-4a-b) Development, Acquisition, and Maintenance Booklet VII.B.2(c) Appendix A (4-2f,g)	Center for Internet Security (CIS) 11.1 11.2 11.3 11.4 11.5 Cyber Risk Institute (CRI) ID.IM-02.06 PR.DS-11.01 ID.IM-04.01 NIST SP 800-53 r5 CP-9 CP-2 (6) CP-3 (1)	Data Backup	Information Protection Processes and Procedures	PR.DS-11.DB
Protect	Protect / Platform Security / PR.PS-4.LM	Log Management: Assess the adequacy of processes to manage audit and system logs.	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 2, Procedure 6 Information Technology, Objective 4, Procedure 2 Information Technology, Objective 5, Procedure 4	Information Security Booklet II.C.22 Appendix A (6-21b,f; 6-35a-d) Development, Acquisition, and Maintenance Booklet IV.H, IV.I.2 Appendix A (4-9h-j; 14-3d,k)	Center for Internet Security (CIS) 8.1 8.2 8.5 8.11 13.1 Cyber Risk Institute (CRI) PR.PS-04.01 DE.AE-03.01 PR.PS-04.03 NIST SP 800-53 r5 AU-12 SI-4	Log Management	Platform Security	PR.PS-4.LM
Protect	Protect / Data Security / PR.DS-1.RM	Removable Media: Evaluate the processes to manage removable media and portable devices.	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3	Information Security Booklet II.C.13(a), II.C.15(a) Appendix A (6-18a; 6-21d)	Center for Internet Security (CIS) 3.9 4.1 4.10 4.11 10.3 10.4 Cyber Risk Institute (CRI) PR.DS-01.03 NIST SP 800-53 r5 MP-7	Removable Media	Data Security	PR.DS-1.RM
Protect	Protect / Protective Technology / PR.PS-1.LF	Least Functionality: Assess the adequacy of processes for configuring systems and components based on the principle of least functionality.	OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 5, Procedure 3	Information Security Booklet II.C.10(b), II.C.10(c) Appendix A (6-13; 6-14)	Center for Internet Security (CIS) 4.8 12.2 16.10 Cyber Risk Institute (CRI) PR.PS-01.02 NIST SP 800-53 r5 CM-7 SA-8 (2)	Least Functionality	Protective Technology	PR.PS-1.LF
Protect	Protect / Technology Infrastructure Resilience / PR.IR-3.FS	Fail Secure: Assess the processes to implement fail secure controls.	None.	None.	Center for Internet Security (CIS) 4.10 Cyber Risk Institute (CRI) GV.OC-04.03 PR.IR-03.01 NIST SP 800-53 r5 SI-17	Fail Secure	Technology Infrastructure Resilience	PR.IR-3.FS
Protect	Protect / Technology Infrastructure Resilience / PR.IR-3.OR	Operational Resilience: Network and Communications Resilience: Assess the adequacy of network and communications resiliency.	OCC Bulletin 2020-94 Attachment OCC Bulletin 2003-14 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 6, Procedure 4 Information Technology, Objective 6, Procedure 6	Business Continuity Management Booklet IV.A.1, IV.A.6 Appendix A (6-2a-c; 6-6a-i)	Center for Internet Security (CIS) 12.2 12.4 18 Cyber Risk Institute (CRI) PR.IR-03.01 PR.IR-04.02 GV.OC-04.03 NIST SP 800-53 r5 CP-4	Operational Resilience	Technology Infrastructure Resilience	PR.IR-3.OR
Protect	Protect / Platform Security / PR.PS-6.CR	Code Review: Evaluate the effectiveness of processes to review code for vulnerabilities and security weaknesses prior to release. Consider the criticality or sensitivity of the data.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet IV.D Appendix A (4-5e)	Center for Internet Security (CIS) 16.1 16.12 Cyber Risk Institute (CRI) ID.RA-01.03 NIST SP 800-53 r5 SA-8 SA-11 SA-15 (2)	Code Review	Platform Security	PR.PS-6.CR
Protect	Protect / Platform Security / PR.PS-6.DG	Development Governance: Evaluate the effectiveness of processes governing in-house software development to ensure cybersecurity is considered at all phases.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet IV.O V.C.2 Appendix A (2-2; 11-2) Information Security Booklet II.C.17 Appendix A (6-27)	Center for Internet Security (CIS) 16.1 Cyber Risk Institute (CRI) PR.PS-06.01 NIST SP 800-53 r5 SA-3 SA-8 (30)	Development Governance	Platform Security	PR.PS-6.DG
Protect	Protect / Platform Security / PR.PS-6.EC	Emergency Change: Evaluate the effectiveness of processes associated with implementing emergency changes to ensure cybersecurity is considered.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet VII.B.3c Appendix A (14-6i) Architecture, Infrastructure, and Operations Booklet III.D.1 Appendix A (6-4a-g)	Cyber Risk Institute (CRI) ID.RA-07.01 NIST SP 800-53 r5 SI-2	Emergency Change	Platform Security	PR.PS-6.EC
Protect	Protect / Platform Security / PR.PS-6.MV	Manage Vulnerabilities in Code: Assess the adequacy of tools or practices to identify and remediate code vulnerabilities or code that is noncompliant with internal security standards.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet IV.D, IV.K Appendix A (11-1; 14-2) Information Security Booklet II.C.17 IV.A.1 Appendix A (6-19d; 6-28a-f)	Center for Internet Security (CIS) 16.1 Cyber Risk Institute (CRI) ID.RA-01.03 NIST SP 800-53 r5 SA-11	Manage Vulnerabilities in Code	Platform Security	PR.PS-6.MV
Protect	Protect / Platform Security / PR.PS-6.NP	NPPI: Evaluate the effectiveness of controls in place to protect nonpublic personal information in test environments.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet IV.E V.B Appendix A (4-6a-b; 11-1a-b) Architecture, Infrastructure, and Operations Booklet III.A.3 Appendix A (3-8b,d)	Cyber Risk Institute (CRI) PR.IR-01.06 NIST SP 800-53 r5 SA-3 (2)	NPPI	Platform Security	PR.PS-6.NP
Protect	Protect / Platform Security / PR.PS-6.SC	Secure Coding: Evaluate the effectiveness of processes and standards that enable secure coding practices.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet IV.D, IV.O Appendix A (5-5c; 10-1b) Information Security Booklet II.C.17 IV.A.1 Appendix A (6-27)	Center for Internet Security (CIS) 16.1 16.9 13.10 Cyber Risk Institute (CRI) PR.PS-06.10 NIST SP 800-53 r5 SA-3 SA-8 SA-11	Secure Coding	Platform Security	PR.PS-6.SC
Protect	Protect / Platform Security / PR.PS-6.SO	Source Code: Evaluate the effectiveness of processes in place to protect and restrict access to source code.	OCC Bulletin 2008-16	Development, Acquisition, and Maintenance Booklet VII.B.2c Appendix A (14-3k)	Center for Internet Security (CIS) 16.1 Cyber Risk Institute (CRI) PR.PS-06.05 NIST SP 800-53 r5 SA-10	Source Code	Platform Security	PR.PS-6.SO
Protect	Protect / Platform Security / PR.PS-1.BC	Baseline Configuration: Evaluate the effectiveness of processes used to manage system configuration baselines and to detect unauthorized changes from the baseline configuration.	OCC Bulletin 2020-5 Attachment OCC Comptroller’s Handbook: Community Bank Supervision Information Technology, Objective 1, Procedure 4 Information Technology, Objective 4, Procedure 3	Information Security Booklet II.C.10(a) Appendix A (6-12) Architecture, Infrastructure, and Operations Booklet V.B.1 Appendix A (13-3c-d)	Center for Internet Security (CIS) 4.1 4.2 16.7 Cyber Risk Institute (CRI) DE.CM-09.03 PR.PS-01.01 PR.PS-01.03 NIST SP 800-53 r5 CM-2 CM-3 (5)	Baseline Configuration	Platform Security	PR.PS-1.BC

More Information About CSW Cross-References

The CSW Cross-References table above offers several columns of information. Select the sections below to learn more about what is displayed under each column.

The CSW is structured to align with the NIST CSF functions and categories. The table below shows how NIST aligns the categories under each function.

Govern	Identify	Protect	Detect	Respond	Recover
Organizational Context Risk Management Strategy Roles, Responsibilities, and Authorities Oversight Cybersecurity Supply Chain Risk Management	Asset Management¹ Risk Assessment Improvement	Identity Management, Authentication, and Access Control Awareness and Training Data Security Platform Security Technology Infrastructure Resilience	Continuous Monitoring Adverse Event Analysis	Incident Management Incident Analysis Incident Response Reporting and Communication Incident Mitigation	Incident Recovery Plan Execution Incident Recovery Communication

The CSW does not include NIST CSF categories and/or subcategories that are addressed as part of other examination programs or that do not apply to the OCC bank information technology supervision process.

The unique ID identifies the procedure and its hierarchy. Unique IDs are structured using a hierarchy of NIST CSF functions, categories, and subcategories. The OCC added two characters at the end of the unique ID to designate the specific procedure. See the figure pictured below.

Unique ID

During supervisory activities, examiners use the procedures to guide their reviews and evaluation of cybersecurity preparedness.

OCC Resources, FFIEC IT Examination Handbook InfoBase, Industry Frameworks

The table provides cross-references that map CSW procedures to existing supervisory guidance, examiner guidance, and industry frameworks. The cross-references are provided for informational purposes only; inclusion of products, processes, services, manufacturers, or companies in the CSW is not indicative of an OCC endorsement.

OCC Resources
- OCC Bulletins
  - Each bulletin listed in the table will have a hyperlink to the applicable attachment or bulletin transmittal. If necessary, scroll to the page indicated or search for the applicable text.
- OCC Comptroller’s Handbook: Community Bank Supervision
  - To find the associated procedures in the “Community Bank Supervision” booklet of the Comptroller’s Handbook, navigate to Core Assessment > Information Technology > Other Assessment Objectives. Then search for the Objective and Procedure listed in the table.
FFIEC IT Examination Handbook InfoBase
- There may be multiple booklets listed. Each booklet listed will have bullets with hyperlinks, that address the booklet narrative and examination procedures.
  - Narrative: The linked text (e.g., II.C.5) refers to a section in the identified booklet’s table of contents. The hyperlink will lead to the specific section of the narrative.
  - Examination Procedures: The linked Appendix A connects to examination procedures for the corresponding booklet. The objective, procedure, and sub-procedure (e.g., Appendix A (6-10b) refers to Objective 6, Procedure 10, sub-procedure b) will be listed – click the link and scroll to the identified objective and procedure.
Industry Frameworks
- Center for Internet Security (CIS) Critical Cybersecurity Controls
  - CIS requires registration to access the controls. Once registered, the associated text can be found by searching for the identifier listed in the table.
- Cyber Risk Institute (CRI) Profile
  - CRI requires registration to access the Profile content. Once registered, the associated text can be found by searching for the identifier listed in the table.
NIST Special Publication 800-53, Revision 5
- The hyperlink goes to a PDF version of the controls catalog. The associated text can be found by searching for the identifier listed in the table.

¹ NIST CSF uses the term “Asset Management,” while the CSW uses the term “IT Asset Management” to differentiate it from financial asset management.

Cybersecurity Supervision Work Program References

CSW Cross-References

Select the Function of the scope of the cybersecurity activity:

Apply one or more filters to narrow your results: (Optional)

More Information About CSW Cross-References

OCC Resources, FFIEC IT Examination Handbook InfoBase, Industry Frameworks

Cybersecurity Supervision Work Program References

CSW Cross-References

Select the Function of the scope of the cybersecurity activity:

Apply one or more filters to narrow your results: (Optional)

More Information About CSW Cross-References

Function / Category / Unique ID Show

Procedure Show

Cross-References Show

OCC Resources, FFIEC IT Examination Handbook InfoBase, Industry Frameworks