View Rule

The Board of Governors of the Federal Reserve System (Board), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC) (collectively, the Agencies) are inviting comment on an advance notice of proposed rulemaking (ANPRM) regarding adapting their supervisory practices and establishing enhanced cyber risk management standards (standards) for large and interconnected entities under their supervision and for, as well as certain services that such entities receive from third parties. The Agencies are considering establishing standards to increase the entities’ operational resilience, lower the probability of their failure or inability to serve as financial intermediaries, and reduce their impact on the financial system and the broader economy in the event of a failure or material weakness associated with a cyber event. The Agencies are inviting comment on five categories of the standards: cyber risk governance; cyber risk management; internal dependency management; external dependency management; and incident response, cyber resilience, and situational awareness.