Cybersecurity Policy Report, OIG urges Fed to overhaul community bank cybersecurity supervision, (Jun 3, 2025)

By Lauren Bikoff, MLS

The report issued five recommendations aimed at modernizing oversight, strengthening examiner training, and standardizing documentation practices.

The Office of Inspector General (OIG) for the Federal Reserve Board has issued a report, outlining five recommendations designed to enhance the Fed’s approach to its cybersecurity supervision of community banking organizations (CBOs). The May 28, 2025, report, “The Board Can Enhance Its Approach to the Cybersecurity Supervision of Community Banking Organizations,” found that the Fed’s current information technology (IT) examination procedures are outdated and fail to reflect the evolving cyber-risk landscape. It also highlighted inconsistent examiner training and documentation practices across Reserve Banks.

Background. The OIG noted that cyber threats are continually evolving, and, therefore, up-to-date cybersecurity practices are essential to maintaining the ability to provide secure financial services to customers. The Board and the Reserve Banks assess CBOs’ cybersecurity as part of their IT supervisory activities. For the report, the OIG reviewed the IT and cybersecurity supervision activities of three Reserve Banks—the Federal Reserve Banks of Chicago, Kansas City, and St. Louis—which are overseen by the Board’s Division of Supervision and Regulation.

Recommendations. In enhancing its approach to CBO cybersecurity supervision, the OIG found that the Fed’s Information Technology Risk Examination (InTREx) work programs are not up to date and do not reflect the evolving IT and cybersecurity risk environment. The OIG recommends assessing the InTREx work programs used, and based on this assessment, providing supplemental guidance and customizing the work programs for examinations as needed. A process to periodically assess the work programs used by Reserve Bank examiners, and to update them as needed, also should be established. The Board plans to implement these two recommendations by Sept. 30, 2026.

The second finding centers around strengthening Reserve Bank examiner training. The OIG recommends developing IT and cybersecurity training guidance that describes expectations for generalist examiners conducting CBO IT examinations, including expectations for on-the-job training and expectations following the completion of the examination of the CBO. The Fed stated it will implement these recommendations by Dec. 31, 2026.

Finally, the OIG found that the Reserve Banks had varying practices for completing and retaining IT Profile (ITP) documents, which examiners use to assess the technology risk of institutions and scope CBO IT examinations. The OIG recommends that examiners complete ITPs in a consistent manner and retain records of completed ITPs. The Fed’s 2019 internal guidance does not indicate how to update or whether to retain ITPs. The OIG recommends revising the guidance to address updating and retaining ITPs, and this would promote a more thorough and consistent approach to scoping CBO IT examinations. The Fed said it will implement this recommendation by Sept. 30, 2026.

MainStory: TopStory BankingOperations CommunityDevelopment CyberPrivacyFeed DataPrivacy DataSecurity FederalReserveSystem OversightInvestigations Privacy PrudentialRegulation