UPDATES TO FDIC'S InTREx

In an effort to tackle emerging cybersecurity threats, the FDIC recently updated their Information Technology Risk Examination (InTREx) procedures, which we'll closely examine in this blog to help you stay prepared for your next audit.

What is InTREx? - A Short Overview

Originally introduced in 2016, the FDIC's Information Technology Risk Examination (InTREx) was specifically designed to evaluate and mitigate the diverse array of technological risks inherent within the banking sector through a comprehensive audit and assessment. Applicable only to FDIC-supervised financial institutions, auditors perform annual assessments to ensure banks adhere to regulations.

Typically, about three months (90 days)  before a scheduled IT examination, your bank will receive an Information Technology Profile (ITP) questionnaire from the FDIC. This questionnaire helps determine the resources needed for your IT examination. Originally the questionnaire comprised  26 questions, however, the updated version was recently condensed to just 13.

Approximately 45 days before the exam, you'll receive an IT request letter listing the resources examiners require to review your IT operations. The FFIEC’s URSIT methodology defines the InTREx examination core modules. This exam covers four main areas: Audit, Management, Development & Acquisition, and Operations & Maintenance. Each area receives a URSIT rating from 1 (best) to 5 (worst), which combines into an overall score.

The Examiner Conclusions and Comments page is what you’ll receive at the end which summarizes the overall state of your IT function. The Information Technology Assessment page will list URSIT ratings, findings, recommendations, management's responses with corrective action timelines, and comments on cybersecurity preparedness and information security compliance

Updates FDIC's InTREx

Audit Core Modules

Under the recent update, the Audit module was reformatted to list procedures under their relevant decision factors, making it easier and more efficient for examiners. Unlike the 2016 version, where decision factors were at the beginning, the 2023 version embeds them into the program, making it more streamlined and reducing the need to navigate through the document

Support And Delivery Core Modules

The support and Delivery module now includes the Computer Security Incident Notification Rule, which went effective April 1, 2022. This rule requires banks to notify federal regulators within 36 hours of discovering a significant security incident that disrupts banking operations. Additionally, the business continuity planning procedures were updated to align with the FFIEC's revised Business Continuity Management booklet, replacing most old procedures.

ITP

As mentioned previously, the Information Technology Profile survey, which is sent out before audits to help scope the IT environment, has now been streamlined from 26 questions to 13. New questions added to the survey address emerging technologies such as artificial intelligence (AI) and peer-to-peer (P2P) payments, as well as topics related to mergers and acquisitions.

How to prepare for the InTREx exam and demonstrate compliance with FDIC regulations

Preparing for an InTREx examination involves familiarizing yourself with the manual and staying updated with the latest changes. An effective strategy is to map your evidence, such as policies, screenshots, and necessary audit documents, to InTREx requirements. Assign responsibility for gathering these evidence items to the relevant team members who manage those specific security controls. This proactive approach ensures that evidence is collected continuously throughout the year, significantly reducing the stress and last-minute rush typically associated with pre-audit preparations. By staying organized and prepared year-round, you can be confident in meeting all examiner requirements when the audit time arrives.

Additionally, mapping your InTREx evidence to other frameworks, such as NIST and CIS, can provide a comprehensive view of your security posture across multiple standards. This comparative mapping can highlight areas of strength and opportunities for improvement. If you need assistance with these mappings, we offer comprehensive solutions that align InTREx with other common control frameworks. By leveraging our platform, you can streamline your preparation process and ensure that you meet various compliance requirements with ease.

Passing InTrex with Rivial

Avoid the yearly headaches and intensive effort of compliance audits by leveraging our wide range of tailored solutions. If you want to offload and automate the majority of your cybersecurity responsibilities, try our platform—a trusted tool for banks to manage cybersecurity governance, effortlessly collect evidence, manage compliance across multiple frameworks, and proactively manage risk. Our one-click reports are so detailed that auditors frequently commend us for our thorough work.

Discover more ways to prepare for a compliance audit, or if you have questions about our platform and want to streamline your InTrex audit, schedule a call with one of our consultants.