OCC BULLETIN 2018-8
Subject: Cyber Insurance
Date: April 11, 2018
To: Chief Executive Officers of All National Banks, Federal Branches and Agencies, and Federal Savings Associations; Technology Service Providers; Department and Division Heads; All Examining Personnel; and Other Interested Parties
Description: FFIEC Joint Statement on Cyber Insurance and Its Potential Role in Risk Management Programs
The Federal Financial Institutions Examination Council (FFIEC), on behalf of its members,1 has issued a joint statement that discusses considerations for financial institutions contemplating the purchase of cyber insurance as a component of their risk management programs.
Note for Community Banks
The joint statement applies to all institutions supervised by the Office of the Comptroller of the Currency.
Although the FFIEC members do not require financial institutions to maintain cyber insurance, the evolving cyber insurance market and the shifting cyber threat landscape may prompt institutions to consider whether cyber insurance would be an effective part of their overall risk management programs. The joint statement notes that
For further information on overall insurance management expectations, institutions can refer to the “Corporate and Risk Governance” booklet of the Comptroller’s Handbook, in the section titled “Ensure an Appropriate Insurance Program.”
Please contact Kevin Greenfield, Director of Bank Information Technology, at (202) 649-6550.
Bethany A. Dugan