Cybersecurity

Subscribe to Cybersecurity via RSS

In the latest episode of the Consumer Finance Monitor podcast that we are releasing today, we explore a topic that is becoming increasingly important for financial services companies and virtually every other business operating in today’s digital economy: how privacy, cybersecurity, and AI governance can be transformed from compliance obligations into sources of customer confidence, resilience, and competitive advantage.… Continue Reading

The federal banking agencies, the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency, have issued a joint statement establishing a coordinated approach for the handling of highly sensitive information during bank examinations. While the statement does not impose new supervisory expectations, it represents an important acknowledgment that the examination process itself can create cybersecurity and information security risks if highly sensitive information is not handled appropriately.… Continue Reading

A newly launched academic institute is seeking to influence the future direction of consumer financial services regulation by promoting a policy framework centered on consumer choice, market competition, empirical research, and innovation. In the podcast we are releasing today on Consumer Finance Monitor, our host Alan Kaplinsky (founder, former chair for 25 years and now senior counsel) interviewed Professors Todd Zywicki of George Mason University Antonin Scalia Law School and Tom Miller of Mississippi State University about their newly created Institute for Consumer Financial Choice (ICFC), its mission, and its ambitious agenda.… Continue Reading

The White House has announced the launch of GOLD EAGLE, a new artificial intelligence-powered cybersecurity clearinghouse intended to accelerate the identification, verification, prioritization, and remediation of software vulnerabilities across both the public and private sectors. According to the White House announcement, the initiative is designed to leverage frontier AI capabilities to identify cyber vulnerabilities more quickly than existing methods while reducing duplicative scanning efforts and providing actionable remediation information to government agencies and private-sector organizations.… Continue Reading

The quality of the CFPB’s information security program “has decreased since last year, leading us to conclude the program no longer is effective,” the bureau’s Inspector General (IG), said in a report.

The bureau’s overall security program has decreased from “manageable and measurable” to “defined,” the IG said in an annual audit conducted between April 2025 and October 2025, which is only one step above the lowest security rating.… Continue Reading

As previously reported in May 2024 FHA announced a requirement for FHA approved lenders to notify the U.S. Department of Housing and Urban Development (HUD) of Significant Cybersecurity Incidents, and the requirement was effective immediately.  Apparently in response to industry criticism, in Mortgagee Letter 2024-23 FHA announced revised requirements.

Originally, for purposes of the reporting requirement, a Significant Cybersecurity Incident (Cyber Incident) is “an event that actually or potentially jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies and has the potential to directly or indirectly impact the FHA-approved mortgagee’s ability to meet its obligations under applicable FHA program requirements.” … Continue Reading

The California Privacy Protection Agency (CPPA) recently published two new sets of draft regulations addressing a range of cutting-edge data protection issues.  Although the CPPA has not officially started the formal rulemaking process, the Draft Cybersecurity Audit Regulations and the Draft Risk Assessment Regulations will serve as the foundation for the  process moving forward. … Continue Reading

On November 9, 2022, New York Department of Financial Services (NYDFS) Superintendent Adrienne Harris announced that the NYDFS formally proposed an updated cybersecurity regulation.  Although the updates had previously been released in draft form, the formal announcement commences the 60-day comment period. 

The proposed regulations would create three different tiers of companies based on their size, operations, and nature of their businesses. … Continue Reading

On July 29, 2022, the New York Department of Financial Services (“NYDFS”) released Draft Amendments to its Cyber Security Regulations.  The Amendments, if adopted, would further regulatory trends and impose important new requirements on covered entities.

The Amendments contain three significant changes relating to ransomware.  First, the Amendment specifically adds “the deployment of ransomware within a material part of the covered entity’s information system” as a cybersecurity event requiring notice to the superintendent within 72 hours. … Continue Reading

In a report released June 21, 2022, the U.S. Government Accountability Office (GAO) urged the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the Department of the Treasury’s (Treasury) Federal Insurance Office (FIO) to jointly assess whether the risk to critical infrastructure and potential financial exposures from catastrophic cyber incidents warrant a federal insurance response, and to inform Congress of the results of their assessment. … Continue Reading