Bank cyber gaps now arrive as observations the board never has to see

The week

On August 27, 2026, the OCC and FDIC issued a final rule defining an unsafe or unsound practice and limiting when examiners may issue matters requiring attention. It was published in the Federal Register on September 1 and takes effect November 2. Under the rule, an MRA requires a practice contrary to prudent operation that could reasonably be expected to cause material financial harm, or has already caused it, or an actual violation of law. Weaknesses below that line become supervisory observations. Observations need not go to the board, need no action plan and are not tracked as findings. The FDIC also dropped its separate category of matters requiring board attention. The Federal Reserve did not join the rule. The week also marked one year since the FFIEC removed its Cybersecurity Assessment Tool on August 31, 2025.

Earlier in this series we argued that the CAT’s retirement orphaned the inherent risk profile, the step that told a bank how much security it needed. The new supervisory rule removes a second external prop. For years, an MRA was how a cyber weakness found its way onto the board agenda with a deadline attached. Under the final rule, that happens only when the weakness can be tied to material financial harm. The agencies’ own discussion allows that IT disruption and cyber vulnerabilities can meet the standard, judged by the severity and likelihood of material harm. Many routine findings will not.

The rule’s effect on cyber programs falls into three parts. Some findings move below the line. Several obligations stay exactly where they were. And banks must now supply an escalation discipline that the examiner used to impose. Organizations should confirm with counsel how the rule applies to their charter, since it covers OCC- and FDIC-supervised banks and not Federal Reserve or NCUA supervision.

What moves below the line

Consider the findings that commonly appeared in IT examinations: incomplete asset inventories, slow patching of internal systems, gaps in log retention, untested recovery plans for secondary applications, and thin documentation of vendor oversight. Each is a sound practice concern. Few can be shown, on their own, to threaten material harm to a bank’s financial condition. Under the rule, many will arrive as supervisory observations.

An observation is informal. The bank is not required to present it to the board, adopt corrective action or submit an action plan. Examiners are not to track voluntary changes beyond normal recordkeeping. Absent a change in circumstances, observations generally are not escalated to MRAs. For a stretched security team, that frees capacity for higher risks. It also removes the deadline that often secured budget for unglamorous fixes.

The cyber weaknesses most likely to stay above the line are those tied to availability of critical services, ransomware resilience and the integrity of payment and customer data. A bank that cannot restore core processing after an attack faces an obvious path to financial harm. Weak identity controls on a privileged administrative console may also qualify, depending on what sits behind it. Banks should expect examiners to explain that link in writing, since the rule asks them to support an MRA with objective facts and reasoning.

What stays the same

The rule changes how findings are classified. It does not change the underlying obligations. The interagency information security guidelines under the Gramm-Leach-Bliley Act still require a written program overseen by the board. The 2021 computer-security incident notification rule still requires banks to notify their regulator within 36 hours of a qualifying incident. Third-party risk management guidance still applies, and violations of law, including consumer protection and anti-money laundering requirements, can still support an MRA.

Ratings also remain. Examiners may use the information behind observations to support component ratings, including management and IT ratings. A bank that accumulates observations without addressing them may see the effect in its ratings rather than in a list of MRAs. That is a less visible signal, and easier for a board to miss.

What the bank must now supply

With no common assessment tool and fewer formal findings, the bank’s own governance has to carry the weight. Three pieces matter. The first is an internal findings register that records examiner observations alongside internal audit, penetration test and self-assessment findings, with an owner and a target date for each. Observations should not live only in an exam letter. Internal audit should test the register once a year, checking that closed items were actually fixed and that nothing was downgraded without a recorded reason. Without that check, informal findings can drift for years.

The second is an escalation threshold the board approves. It should say which findings go to the board or its risk committee, on what criteria, and how often. Criteria might include exposure of critical services, repeat findings, age past target date and findings that touch privileged access. The threshold should be written in the bank’s own terms, not the agencies’ materiality test, because the board’s duty of oversight is broader than the examiner’s enforcement standard.

The third is a sizing link. Our September 2025 article argued for rebuilding the inherent risk step that the CAT once supplied. That step now does double duty. It tells the bank how much control it needs, and it gives the escalation threshold a reference point. A finding that leaves a control below the level the risk profile requires is a board matter, whether or not an examiner would call it material.

Banks that run this discipline well may find the new rule helpful. Examiners will spend less time on documentation findings and more on whether controls work, and a bank with its own register can show that it already knows its gaps.

With hindsight

The rule takes effect on November 2, 2026, so it is too early to see how examiners will apply the materiality test to cyber weaknesses in practice. The FDIC moved to a single MRA category for examinations issued after August 31. The OCC also proposed a separate rule on how violations of law are treated in MRAs, which remains pending. The Federal Reserve has pursued a similar direction through internal policy rather than joining the rule. The CAT’s absence has not produced a single successor. Banks use NIST CSF 2.0, the CRI Profile and other frameworks, and NCUA continues to support its own tool for credit unions. Taken together, these changes leave more of the judgment about cyber priorities with each bank’s management and board. Banks should watch early examination reports after November for how observations and ratings interact.