The banking agencies' October 26, 2016 Federal Register notice opened a discussion about enhanced cyber-risk standards. Its formal designation was an advance notice of proposed rulemaking, or ANPR. That procedural label matters: the document sought input on potential requirements, rather than announcing a completed set of new obligations that institutions had to implement immediately. [2016-25871]
A joint release issued October 19 explained the sequence. The Federal Reserve, FDIC and Office of the Comptroller of the Currency were issuing the ANPR before developing a more detailed proposal. They also sought views on methods for quantifying cyber risk and comparing it across financial entities. October 19 was the announcement date; October 26 was publication in the Register. [fed-cyber-release]
The notice organized the inquiry into five areas: cyber governance, risk management, internal dependencies, external dependencies, and incident response, resilience and situational awareness. It contemplated a tiered approach, with more stringent treatment of systems critical to the financial sector. Neither the categories nor the possibility of a higher tier should be read as proof that a final regulatory design had been selected. [2016-25871]
Comments were due January 17, 2017. That was a deadline to respond to the consultation, not a deadline to comply with adopted enhanced standards. Readers assessing the historical record should keep those stages separate. Both retained documents came from the same agencies and policy process; the release explains the intended sequence while the notice sets out the consultation. Neither supplies evidence of eventual implementation or results. [2016-25871][fed-cyber-release]
Source documents
- Enhanced Cyber Risk Management Standardshttps://www.govinfo.gov/content/pkg/FR-2016-10-26/html/2016-25871.htm
- Agencies issue advance notice of proposed rulemaking on enhanced cyber risk management standardshttps://www.federalreserve.gov/newsevents/pressreleases/bcreg20161019a.htm