Security for institutions
that regulators audit annually.

Yes. FDIC IT examinations follow the FFIEC IT Examination Handbook with focused reviews on information security, business continuity, and vendor management — scoped to institution size and risk profile. We work with state-chartered, FDIC-insured banks to prepare the pre-exam questionnaire responses, organize the evidence binder by the examiner's request list, validate the information-security program against FFIEC CAT maturity levels, and stand up a side-by-side war room during exam week.

Our role is to make the examiner's job fast, not to adversarially minimize findings — examiners appreciate the difference, and cooperative exams tend to produce better outcomes than defensive ones. If your last exam produced Matters Requiring Attention or an informal enforcement action, we can scope a remediation engagement tied specifically to closing those items before the next supervisory cycle.

OCC exams apply to national banks, federal savings associations, and federal branches of foreign banks. The framework is still FFIEC — OCC examiners use the same IT Examination Handbook and the same CAT — but OCC has specific guidance around operational resilience (Heightened Standards for large banks, community-bank scaled guidance for smaller institutions), third-party risk management (the 2023 Interagency Guidance on Third-Party Relationships), and the ever-evolving OCC bulletins.

We track OCC bulletins as they publish and fold any change into active engagements for affected clients. For de novo national banks or recent charter conversions we provide structured first-exam preparation since the OCC's ramp expectations are materially different from a renewal exam — the supervisory letter after a first exam sets the tone for the next several cycles, and we treat it accordingly.

Yes. 23 NYCRR 500 — universally called DFS-500 or 500 — applies to any entity operating under a DFS license, charter, or authorization: banks, insurers, mortgage lenders, virtual-currency businesses, money transmitters, and more. The 2023 amendment raised the bar substantially: mandatory CISO reporting to the board, annual risk assessments, 72-hour cybersecurity-event notification, 24-hour ransomware-payment notification, independent audit for Class A companies, enhanced MFA, encryption, asset inventory, business-continuity testing, and the annual Certification of Material Compliance signed by the highest-ranking executive and the CISO.

We cover the program end-to-end: initial gap assessment, remediation roadmap, CISO advisory support, incident-response coordination with DFS, and the annual certification workflow. Many clients we work with outside New York still use DFS-500 as their internal baseline, because DFS effectively sets the US state-level floor — institutions operating across multiple states find it easier to comply with DFS once than to manage a fifty-state patchwork of differing requirements.

The FTC's 2023 amendment to the GLBA Safeguards Rule added Section 314.4(j), requiring non-bank financial institutions to notify the FTC within 30 days of discovering a notification event affecting the information of 500 or more consumers. Banks are covered separately by the federal banking agencies' Computer-Security Incident Notification rule, which requires notification of the primary federal regulator within 36 hours of a good-faith belief that a covered incident has occurred.

In practice: an incident is discovered, the clock starts, the IR team confirms scope and consumer impact, privacy counsel reviews the notification threshold, and if 500+ consumers are affected the FTC notification is filed via the portal with detailed incident characterization. Customer notification timing is separate and governed by state law — we coordinate both, because missing the FTC deadline is a separate violation from missing the state-law customer notification window. Our IR retainer package includes notification-support hours specifically for this workflow, so when the event happens the team is not figuring the process out for the first time.

SOX Section 404 ITGC — IT general controls — covers the IT systems, processes, and access that support financial reporting. The four classic domains: change management (who changes what, who approves, evidence of testing), logical access (provisioning, deprovisioning, role changes, privileged access, periodic access review), computer operations (backup, scheduling, monitoring, incident response), and program development or SDLC (design, coding, testing, migration to production).

For financial institutions, ITGC intersects significantly with FFIEC and NYDFS requirements — most controls serve both frameworks with minor wording differences. We map the control set against both SOX and the banking regulators to avoid duplicate evidence work, coordinate directly with your external audit firm on scope and walkthrough format, and prepare your IT staff for the control-owner interviews that auditors always conduct. First-year SOX engagements for newly public companies run six to nine months; renewal engagements run two to four. Pre-IPO engagements start 18 months before S-1 filing.

Merchants are Level 1 through Level 4 based on annual Visa and Mastercard transaction volume, with Level 1 requiring a full Report on Compliance from a QSA and lower levels typically completing a Self-Assessment Questionnaire. Acquirers — the banks and processors that sponsor merchants — have materially different scope: they are always Level 1, they are responsible for merchant due diligence and oversight (PCI-DSS Requirement 12.8 and related card-brand programs), and they face direct card-brand fines if they sponsor out-of-compliance merchants.

For acquirers we focus on the merchant-oversight program, the card-brand data-security programs (Visa CISP, Mastercard SDP), and the full v4.0.1 ROC preparation. For merchants we focus on scope reduction first — tokenization, P2PE, outsourcing the CDE — because every asset removed from CDE scope is an asset that does not need the full control set. v4.0.1's future-dated requirements, now in effect as of March 31, 2025, added significant work around authenticated vulnerability scanning, phishing-resistant MFA for CDE access, and the customized-approach option that lets you satisfy a requirement through a different control path.

Yes to both, always. A Business Associate Agreement (BAA) is the standard HIPAA vehicle and applies when we touch Protected Health Information — which happens in financial services more often than people expect (health-savings accounts, health-insurance-adjacent platforms, wealth-management serving medical practices). NDAs are signed before any engagement data moves.

For financial-services engagements specifically we also execute information-sharing agreements consistent with FFIEC third-party risk guidance, and where clients require it we agree to notification obligations that mirror the client's own regulatory notification timelines — so if you have a 36-hour FDIC incident notification obligation, our engagement contract commits us to notifying you inside a window that lets you meet yours. Custom data-protection addenda, Tennessee Banking Department or Mississippi Department of Banking required clauses, and examiner-transparency provisions get reviewed and signed without friction.

Yes. The FFIEC Cybersecurity Assessment Tool is not technically mandatory, but it has become the de facto framework examiners use to ask about cybersecurity maturity — so nearly every bank and credit union we work with runs it annually. The CAT has two parts: the Inherent Risk Profile (size, complexity, technologies, delivery channels, mobile-product offerings, third-party connections) and the Cybersecurity Maturity assessment across five domains and five maturity levels.

Annual support looks like: a one-month workbook refresh against the prior year, validation of maturity claims with evidence from the control environment, gap-to-aspirational-level mapping, a board presentation with the current posture versus target, and an evidence binder for the next exam cycle. For credit unions we also align the output with NCUA's Information Security Examination (ISE) requirements where applicable. The subscription cadence keeps the binder exam-ready between visits, which is where most institutions struggle otherwise.

Internal audit is typically the primary coordination point for anything we do against a SOX or regulatory framework, because they own the control-testing calendar and the issue-tracking workflow. We meet with your internal audit lead at engagement start to align scope with their annual plan, share our testing approach so there is no duplicate or gap coverage, and agree on issue-tracking (usually AuditBoard, Workiva, or your internal ITSM platform).

When we identify findings during testing, we log them into the same system internal audit uses, using their severity and status taxonomy, so the remediation tracking lives where your board and examiners expect it — not in a separate consultant-only deliverable that creates parallel universes of truth. Three-lines-of-defense discipline matters here: we are second-line when we are consulting on control design, third-line when we are testing, and we make the hand-off explicit at each stage so internal audit's independence is not compromised by our dual posture.

Yes. Money Services Businesses registered with FinCEN — including virtual-asset service providers and crypto on-ramps — operate under a distinct compliance stack: the Bank Secrecy Act anti-money-laundering program, FinCEN registration and reporting (SAR, CTR, 314(a) and 314(b) information sharing), state money-transmitter licensing in every state of operation (including the 2024 Money Transmission Modernization Act adoption by many states), NYDFS BitLicense for New York operations, and the evolving state-level virtual-asset regulation.

Our work focuses on the cyber and IT-controls side: BSA/AML platform security, KYC-data protection, private-key custody architecture (HSM, multi-party computation, or hot/cold segregation), transaction-monitoring-system controls, and examiner coordination across FinCEN and state regulators. We do not practice law — BSA compliance is a legal discipline — so we always work alongside the client's FinCEN counsel. For the technical controls and the IT portion of the examination, we carry the full weight.