RegAlert2026-09-21
Added
Cybersecurity: Cybersecurity Supervision Work Program
The Office of the Comptroller of the Currency updated the structure and references of the Cybersecurity Supervision Work Program (CSW) to align with the updated National Institute of Standards and Technology Cybersecurity Framework categories and subcategories. This update rescinds OCC Bulletin 2023-22 and maintains existing examination procedures without adding new requirements or changing existing ones. The CSW serves as a tool for examiners to scope risk-based examinations of national banks, federal savings associations, and federal branches and agencies, but does not establish new regulatory expectations for banks.
OCC published 15 documents in the last 30 days — get each new one by email the day it lands.
OCC Bulletin 2026-48
|
September 21, 2026
Share This Page:
To
Chief Executive Officers of All National Banks, Federal Savings Associations, and Federal Branches and Agencies; Department and Division Heads; All Examining Personnel; and Other Interested Parties
Summary
The Office of the Comptroller of the Currency (OCC) recently updated the structure and references of the OCC Cybersecurity Supervision Work Program (CSW) used by examiners. As cyberattacks evolve and as banks1 adopt various standardized tools and frameworks to assess cybersecurity preparedness, the OCC continues to update its approach to assessing cybersecurity risk as part of risk-based supervision. The CSW provides high-level examination objectives and procedures that are aligned with existing supervisory guidance and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). The OCC did not add any new procedures in the update to CSW, nor did it change any of the procedures. This update maintains alignment between the CSW structure and the evolving NIST CSF.
The CSW does not establish new regulatory expectations, and banks are not expected to use this work program to assess cybersecurity preparedness. The OCC continues to encourage, but does not require, the use of a standardized approach to assess and improve cybersecurity preparedness, and banks may choose from a variety of tools and frameworks available. 2
Rescissions
This bulletin rescinds OCC Bulletin 2023-22, “Cybersecurity: Cybersecurity Supervision Work Program,” issued on June 26, 2023.
Note for Community Banks
The CSW continues to enable risk-based examination scoping and is scalable for banks of different sizes and complexity. Examiners may use the CSW’s examination procedures during examinations of a community bank’s cybersecurity preparedness.
Highlights
The CSW
- procedures remain unchanged and no new procedures were added.
- structure was updated to align with the updated NIST CSF categories and subcategories.
- addresses evolving risks and supports risk-based bank information technology examinations.
- maps to the Federal Financial Institutions Examination Council (FFIEC) Information Technology (IT) Examination Handbook and common cybersecurity frameworks.
- focuses on cybersecurity preparedness and supplements the OCC’s bank information technology examination procedures contained in the “Community Bank Supervision,” “Large Bank Supervision,” and “Federal Branches and Agencies Supervision” booklets of the Comptroller’s Handbook and the FFIEC IT Examination Handbook booklets.
The CSW Overview page on www.occ.gov links to the CSW References page, which provides cross-references that map the CSW procedures to existing supervisory guidance, examiner guidance, and industry cybersecurity frameworks. For example, cross-references include the OCC Comptroller’s Handbooks, FFIEC IT Examination Handbook, the Center for Internet Security Critical Security Controls, and the Cyber Risk Institute Profile. Future changes to the CSW References page will be made available through www.occ.gov.
Further Information
Please contact Debra Brown, Acting Director of Bank Information Technology Policy, at (202) 649-6550.
James M. Gallagher
Senior Deputy Comptroller and Chief National Bank Examiner
Related Links
1 “Banks” refers collectively to national banks, federal savings associations, and federal branches and agencies of foreign banking organizations.
2 Refer to the Federal Financial Institutions Examination Council press release titled “FFIEC Encourages Standardized Approach to Assessing Cybersecurity Preparedness,” August 28, 2019.
Topic(s):
Sign in to read the rest — it's free
Source: Office of the Comptroller of the Currency — original document · Summary generated with machine assistance and reviewed before publication; the authoritative text is the regulator's original document. How RegAlert works
2026-09-18
Corporate Decision 1391 — Conditional Approval for Bastion Platforms Trust Company to Convert to a National Trust Bank
2026-09-18
Corporate Decision 1393 — Application to charter Agora National Trust Bank, New York, NY
2026-09-18
Corporate Decision 1392 — Application to charter Catena Trust Bank, N.A., New York, NY
2026-09-11
Interagency Statement: Risk-Based Supervision of Certain Services Provided by Core Providers to Community Banking Organizations
2026-09-11
Third-Party Risk Management: Proposed Guidance and Request for Comment
2026-09-10
Expanded Examination Cycle for Certain Small Insured Depository Institutions and U.S. Branches and Agencies of Foreign Banks
2026-09-08
Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule
2026-09-02
Corporate Decision 1389: Application to Charter OpenReserve Bank, National Association, Salt Lake City, Utah
More like this from OCC
OCC published 15 documents in the last 30 days. We email you each new one the day it's published.