Cyber Alert: The Fundamentals of Cyber Hygiene for Financial Institutions

Media Contact: media@dob.texas.gov INDUSTRY NOTICE 2026-02 Date: March 9, 2026 The Fundamentals of Cyber Hygiene for Financial Institutions Today’s cyber threats evolve rapidly, requiring constant attention to protect your institution and its customers from potentially devastating consequences. Recent geopolitical events continue to elevate the risk of cybersecurity threats, and the expanding use of artificial intelligence (AI) also increases the risk of new cybersecurity attacks, including AI-enhanced malware attacks. Despite these changing threats, we find that fundamental cyber hygiene practices are the single most important measure for protecting institutions. Focusing on the fundamentals, to get them implemented as correctly as possible, is critical. The Department of Banking (Department) is sharing the following guide prepared by the Conference of State Bank Supervisors (CSBS) that provides a single, all-in-one resource on cybersecurity fundamentals. The Cyber Hygiene Fundamentals for Financial Institutions Guide contains ten cyber hygiene fact sheets and board questions documents previously distributed by CSBS. The guide provides a fundamental overview of how each of these controls and practices are critical to protecting institutions against existing and emerging cyber threats. This resource supplements the two notices the Department released in 2025, provided along with other Information Technology Resources available on the Department's website. The guide highlights six critical threats to be aware of, including cyber threats such as: • Ransomware • Denial-of-service attacks (Dos/DDoS) • Third-party risks • Geopolitical and hacktivist activities • Social engineering and phishing • Corporate account takeover The guide is not intended to introduce new guidance but rather to spotlight and amplify key controls from existing regulatory guidance and other authoritative sources, as well as encourage increased oversight by senior management and the Board on these controls. CEOs and senior management staff should also share the information with CISOs and IT security personnel.

IN 2026-02 March 9, 2026 2 2601 N. Lamar Blvd., Austin, Texas 78705 www.dob.texas.gov Board of Director Resources The Department recognizes the value of providing resources to Board members as well. CSBS has developed the following Cyber Hygiene Fundamentals for Financial Institutions – Fact Sheets and Board Questions, which contains additional documents for Cybersecurity Awareness Training, Data Backup Programs, Incident Response Programs, IT Asset Management, Threat Intelligence Programs, and Third-Party Risk Management. The document can be utilized to help keep a focus on each practice being appropriately implemented. We strongly encourage these documents to be shared with the appropriate staff and the Board of Directors.