Coordinated Federal Banking Agency Approach for Handling Highly Sensitive Information During Examinations

1
Board of Governors of the Federal Reserve System Federal Deposit Insurance Corporation Office of the Comptroller of the Currency Statement regarding Coordinated Federal Banking Agency Approach for the Handling of Highly Sensitive Information During Examinations The Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency (collectively, “the federal banking agencies” (FBA)) are instituting a coordinated approach for the handling of highly sensitive information during examinations of supervised banks. This communication provides information to supervised banks on this coordinated approach, how it is being rolled out across the FBAs and their supervisory personnel, and the role that supervised banks may play in implementation. The FBAs recognize the sensitivity of supervised banks’ data handled during the examination process. The FBAs are committed to protecting and handling sensitive data in accordance with applicable confidentiality laws and regulations and data security standards. Additionally, the FBAs have committed to notify affected banks of a potential or confirmed material compromise of confidential supervisory information as soon as practicable and within no more than 72 hours, once the agency impacted has a reasonable basis to believe a compromise has occurred and determines the banks affected, subject to applicable legal considerations. The FBAs acknowledge that certain categories of data and documents have additional levels of sensitivity and heightened risks from disclosure (referenced as highly sensitive information). These may include, but are not limited to, documents and data that contain detailed information on

• technology/network diagrams and schematics;
• detailed penetration test results;
• technical details of specific information technology control weaknesses; and
• succession planning.
  The FBAs have used various methods for handling such highly sensitive information in a manner that balances the requirements of effective examination with the need to minimize the risk of exposure. This coordinated approach provides greater alignment of these practices across the FBAs and examination teams. Under this approach, the FBAs will rely on bank management to identify data and documents requested for an examination that they believe should be considered highly sensitive information. This will allow the FBAs to evaluate whether additional protocols should be invoked in the review of that information during examinations. For highly sensitive information, the FBAs will consider a range of potential options to minimize collection and storage by the FBAs, including on-site review, direct digital review from the systems of the supervised bank, redacted or summarized versions of documents, and additional