OCC
US Banking
OCC Operational Risk Management: Challenge Requirements for Business Continuity and Cyber Risk
The OCC's heightened expectations for operational risk management require banks to implement robust challenge processes for business continuity planning, cybersecurity risk assessment, and operational resilience frameworks.
2024-03-05
13 min read
By OCC Operational Risk Team
OCC
Operational Risk
Cybersecurity
Business Continuity
Executive Summary
Operational risk management has become a priority supervisory focus for the OCC, with particular emphasis on independent challenge of business continuity assumptions and cybersecurity controls. Banks must demonstrate effective challenge processes across all aspects of operational risk, including third-party risk management and technology risk governance.
Key Focus Areas
Business Continuity and Resilience
- Independent challenge of recovery time objectives and maximum tolerable downtime
- Validation of business impact assessments and dependency mapping
- Challenge of crisis management and communication procedures
Cybersecurity Risk Management
- Independent assessment of cyber risk identification and measurement
- Challenge of security control effectiveness and monitoring
- Validation of incident response and recovery capabilities
Third-Party Risk Management
- Challenge of vendor risk assessments and due diligence procedures
- Independent review of contract terms and service level agreements
- Validation of contingency planning for critical service providers
References
- OCC Bulletin 2013-29 - Third-Party Relationships risk management guidance
- OCC Alert 2019-3 - Cyber incident and recovery reporting requirements