Specifically, when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused; assess the nature and scope of the incident; identify the types of information that have been accessed or misused; and undertake risk mitigation, which can include notifying customers, monitoring for unusual account activity, and re-issuing credit and debit cards.
The Federal Reserve’s approach to information security supervision leverages internal firm expertise, published guidance, and collaboration between the Board, the Reserve Banks, and other U.S. banking agencies to promote effective protection of data and systems by supervised institutions. The Reserve Banks employ examiners specializing in information technology supervision to conduct the bulk of their information security examination activities.