Joint Trades Comments on Computer-Security Incident Notification Requirements for Banking Organizations

Chief Counsel’s Office
Attention: Comment Processing
Office of the Comptroller of the Currency
400 7th Street SW, Suite 3E–218
Washington, DC 20219

Ann E. Misback, Secretary
Board of Governors of the Federal Reserve System
20th Street and Constitution Avenue NW
Washington, DC 20551

James P. Sheesley, Assistant Executive Secretary
Attention: Comments
Federal Deposit Insurance Corporation
550 17th Street NW
Washington, DC 20429

The American Bankers Association (“ABA”), Bank Policy Institute(“BPI”), Institute of International Bankers (“IIB”), and the Securities Industry andFinancial Markets Association (“SIFMA”) (collectively, the “Associations”) appreciate the opportunity to comment on the notice of proposed rulemaking issued by the Office ofthe Comptroller of the Currency, the Board of Governors of the Federal Reserve System,and the Federal Deposit Insurance Corporation (collectively, the “Agencies”) relating tocomputer-security incident notification requirements for banking organizations and theirbank service providers. The Agencies’ thoughtful review and study of cybersecurity issuesis evident in the proposed rule, and the Associations welcome this positive step towardachieving clarity and consistency in the industry in this important area.

Like institutions throughout the public and private sectors, bankingorganizations are reliant on interrelated computer systems, and continue to be targeted incybersecurity attacks. As such, our members recognize the importance of timely detectionof significant cybersecurity threats, and fully support the Agencies’ goal of ensuring timelyawareness of these threats in order to promote the safety and soundness of the U.S. financialsystem. In that regard, we appreciate the Agencies’ recognition that a requirement thatbanking organizations timely notify the Agencies of critical cybersecurity incidents willrepresent the formalization of a voluntary practice that already exists.

The Associations also strongly support the Agencies’ efforts to minimizethe regulatory burden placed on banking organizations addressing significant cybersecurityincidents, and to harmonize the proposed rule with existing definitions and notificationstandards. Harmonization and other efforts to reduce additional burden will maximizebanking organizations’ ability to focus in a crisis on protecting their customers andrestoring and ensuring the confidentiality, availability, and integrity of the systems on which their services and operations depend. We welcome the opportunity to collaboratewith the Agencies on a rule that furthers our shared interest in this regard.

While the Associations support many aspects of the proposed rule, webelieve change is warranted in several areas, and we propose revisions in those areas. Ourrecommendations are intended to bring additional clarity and consistency to the proposedincident notification framework, to ensure the Agencies receive timely notification of thesignificant cybersecurity incidents that are the focus of the proposed rule, and to minimizeexcess burden on banking organizations, including by avoiding unnecessary andburdensome over-reporting of less significant or easily remediated matters not intended tobe captured by the proposed rule. We believe and intend that these proposed revisions willbe workable for large and small institutions alike.

Download the PDF to read the full letter.