Banking and Finance Law Daily Wrap Up, PRIVACY—Community banks should be ‘integral part’ of cyber incident response, ICBA says, (Feb 19, 2025)

By Thomas G. Wolfe, J.D.

While ICBA commends the Cybersecurity and Infrastructure Security Agency’s efforts to “create a better framework for responding to significant cyber incidents,” the organization emphasizes that “community banks need to be an integral part of a coordinated cyber defense plan.”

The Independent Community Bankers of America (ICBA) has transmitted a comment letter to the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, commending the federal agency’s “efforts to create a better framework for responding to significant cyber incidents.” At the same time, ICBA underscores that “community banks need to be an integral part of a coordinated cyber defense plan.”

Anjelica Dortch, Vice President of Operational Risk & Cybersecurity Policy at ICBA, responded to the Cybersecurity and Infrastructure Security Agency’s request for comments on its “National Cyber Incident Response Plan (NCIRP)” update.

NCIRP update. In its Feb. 14, 2025, comment letter, ICBA observes that the NCIRP serves as “the federal government’s blueprint for responding to significant cybersecurity incidents” and that the currently proposed update to NCIRP “is intended to refine and enhance the plan by incorporating feedback from stakeholders across critical infrastructure sectors, including financial institutions.” In addition, the NCIRP update aims to ensure that “incident response coordination, regulatory consistency, and information sharing mechanisms are effective, equitable, and inclusive of all impacted entities.”

Additional letter highlights. Against this backdrop, ICBA notes in its comment letter that:

• because cybersecurity threats are becoming increasingly sophisticated, it is crucial that community banks, “which play a vital role” in the financial system, “have a voice in shaping the NCIRP’s policies and strategies;”

• it is crucial that community banks are included as partners in the pertinent “communication channels and coordination efforts outlined in the NCIRP;”

• the NCIRP update should “explicitly include community banks as key stakeholders in information-sharing efforts and incident response coordination;”

• because the CISA’s Joint Cyber Defense Collaborative (JCDC) has been “instrumental in fostering public-private partnerships to enhance the nation’s cybersecurity posture,” CISA should expand access to the JCDC to include community banks;

• because community banks “are already subject to extensive cybersecurity regulations and reporting requirements,” CISA should “harmonize the NCIRP’s provisions” with existing requirements from the federal banking and finance regulators; and

• the recommended harmonization of these NCIRP provisions with the federal regulators’ rules and regulations would: (i) “reduce compliance costs and administrative burden for community banks;” (ii) “streamline incident reporting and response efforts;” and (iii) ensure “consistent and efficient application of cybersecurity policies across the financial services sector.”

Companies: Independent Community Bankers of America

RegulatoryActivity: BankingOperations CommunityDevelopment CyberPrivacyFeed DataPrivacy DataSecurity FinancialStability FinTech Privacy PrudentialRegulation