The Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency have issued a joint statement outlining a coordinated approach for handling highly sensitive information during bank examinations. This approach aims to balance the need for effective examination with the requirement to minimize the risk of exposure of sensitive data. The agencies recognize the sensitivity of supervised banks' data and are committed to protecting it in accordance with applicable confidentiality laws and regulations, as well as data security standards.
The joint statement identifies categories of data and documents that are considered highly sensitive, including technology and network diagrams, detailed penetration test results, technical details of specific information technology control weaknesses, and succession planning. To handle such information, the agencies will rely on bank management to identify data and documents that should be considered highly sensitive. The agencies will then evaluate whether additional protocols should be invoked to protect this information during examinations.
For highly sensitive information, the agencies will consider options such as on-site review, direct digital review from the supervised bank's systems, redacted or summarized versions of documents, and additional measures related to transmission and access. Banks with concerns about highly sensitive information should discuss these with their examiners or primary agency contact. The agencies will provide written guidance and training to their examiners on this approach and will notify supervised banks of the processes for escalating concerns regarding the handling of highly sensitive information.
The agencies are committed to notifying affected banks of any potential or confirmed material compromise of confidential supervisory information as soon as practicable, and within 72 hours, unless legal considerations apply. This coordinated approach is intended to enhance the security of highly sensitive information during bank examinations while ensuring that the agencies have access to necessary information.