Independent Banker - January 2025 - 35

it's extremely eff ective-is one way
to keep everyone on their toes.
After all, you'd rather have someone
inadvertently click on a phishing
email that was generated internally
versus one that was sent by a
cybercriminal, right?
Sending random phishing emails
is just good practice. It also helps
everyone understand and deal with
the potential threat (e.g., do we just
delete the message? Do we report it?
Do we mark it and have the system
quarantine it?). This serves as one
more training tool that ensures staff
members are properly following the
bank's policies and procedures.
Pack your cybersecurity toolkit
Banks should also be stress-testing
their systems regularly to help fortress
them against both existing and
emerging threats. The Cybersecurity
and Infrastructure Security Agency
(CISA) provides a free tool that
community banks can use to ensure
that their systems are up-to-date.
Being forever vigilant [about cybersecurity] is
essential and can't be overlooked. Vigilance must
become a part of your bank's culture.
QUICK STATS
$4.88M
$4.45M
+10%
Average cost of a U.S. data
breach in 2024
Average cost of a U.S. data
breach in 2023
Spike in breaches from 2023
to 2024-the highest since the
COVID pandemic
Source: IBM
This " cyberhygiene tool " is one of
the most accessible applications that
community banks have available. It
doesn't aff ect a bank's operations,
nor does it involve a regulator,
but it does provide weekly reports
based on system scans for potential
vulnerabilities. This makes it a
no-brainer for banks that would
otherwise have to establish their own
internal systems for cyberhygiene
monitoring and reporting.
Third-party systems are another
potential entry point for cybercriminals
and something that community banks
should be aware of. The bottom line
is that their vulnerability can easily
become your vulnerability. We saw
this as early as the massive data breach
that Target suff ered in 2013, when
criminals exploited the systems of an
HVAC contractor.
Developed by the Federal Reserve,
the FDIC and the OCC, ThirdParty
Risk Management: A Guide
for Community Banks provides a
roadmap that banks can use to create
and implement their own thirdparty
risk-management practices. It
includes scenarios that are specifi cally
applicable to community banks,
making it a good resource for ICBA
members that want to improve their
third-party vendor management
practices in 2025.
Community banks using the Federal
Financial Institutions Examination
ICBA has been working to ensure
that the Cyber Incident Reporting for
Critical Infrastructure Act (CIRCIA)
of 2022 doesn't place undue burden
on community banks that are
already reporting cyber incidents to
regulators. We're not sure exactly
where this issue is headed in 2025
(or beyond), but ICBA is working to
ensure that the fi nal rule matches as
closely as possible to the reporting
rules that are already in place.
Council's Cybersecurity Assessment
Tool (CAT) should be aware that the
tool will be sunsetting in August,
with no immediate replacement
announced. This tool was developed
in response to the increasing volume
and sophistication of cyber threats. It
helps institutions identify their risks
and determine their cybersecurity
preparedness.
Banks that rely on CAT should start
exploring other options sooner rather
than later. Not only will any new
cyber-assessment tool take time and
eff ort to identify, learn and adopt, but
you also want to pick a platform that
regulators are both comfortable with
and supportive of.
Lance Noggle (lance.noggle@
icba.org) is ICBA senior vice
president, operations and
senior regulatory counsel.
independentbanker.org // 35
http://www.independentbanker.org
Independent Banker - January 2025

Table of Contents for the Digital Edition of Independent Banker - January 2025
