Requirements ยท Financial services
FFIEC IT Examination Handbook and IT guidance
Federal Financial Institutions Examination Council. 14 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The Federal Financial Institutions Examination Council (FFIEC) is an interagency body of US financial regulators that sets uniform principles and standards for examining financial institutions. Its IT Examination Handbook is a series of booklets, such as Information Security and Business Continuity Management, that examiners use to assess how an institution manages technology risk. The Council also issues joint guidance and statements, for example on authentication and access to financial institution services and systems.
Source: FFIEC IT Examination Handbook. FFIEC in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Moraph’s Trust Center lists “GLBA / FFIEC” among the frameworks its controls are mapped to: “Authentication and data-protection controls aligned to GLBA and FFIEC guidance, with evidence prepared for bank examinations.” It also states: “Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.”
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- FFIEC IT Examination Handbook, Information Security booklet 6 products
- FFIEC Authentication and Access to Financial Institution Services and Systems (2021) 2 products
- FFIEC IT Examination Handbook, Business Continuity Management booklet 2 products
- FFIEC Business Continuity Management booklet 1 product
- FFIEC IT Examination Handbook (Outsourcing Technology Services and Information Security booklets) 1 product
- FFIEC IT Examination Handbook (Outsourcing Technology Services) 1 product
- FFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations booklet 1 product
- FFIEC IT Examination Handbook, Information Security and Architecture, Infrastructure, and Operations booklets 1 product
- FFIEC IT Examination Handbook: Architecture, Infrastructure, and Operations 1 product
- FFIEC IT Examination Handbook: Information Security 1 product
- FFIEC Joint Statement on Security in a Cloud Computing Environment (2020) 1 product
For what it requires of your organization, read the rule itself or ask your counsel. FFIEC in the glossary.
Products
The 14 products that support it
API Security & Integration
Securing the connectivity between legacy mainframes (COBOL) and modern fintech apps.
Lists:
- FFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations booklet
- FFIEC Authentication and Access to Financial Institution Services and Systems (2021)
ATM & Cash Logistics Optimizer
Predictive analytics for branch cash replenishment, minimizing idle cash holding costs (non-earning assets).
Lists:
- FFIEC IT Examination Handbook, Business Continuity Management booklet
Business Continuity Planning
Managing disaster recovery plans and automated testing logs for examiners.
Lists:
- FFIEC IT Examination Handbook, Business Continuity Management booklet
Data Loss Prevention
Network and endpoint blocking of outbound transmission of SSNs or credit card numbers (PAN).
Lists:
- FFIEC IT Examination Handbook: Information Security
Endpoint Detection & Response
24/7 managed detection and hunting on teller workstations to reduce ransomware risk. Recovery, backups and notification decisions remain your institution's.
Lists:
- FFIEC IT Examination Handbook, Information Security booklet
Identity Access Management
MFA and SSO configurations tuned to support the FFIEC Authentication and Access guidance (2021). Your institution owns the risk assessment and the adequacy decision.
Lists:
- FFIEC Authentication and Access to Financial Institution Services and Systems (2021)
- FFIEC IT Examination Handbook, Information Security booklet
Mobile Device Management
"Containerized" corporate apps on advisor personal phones, allowing selective wipe of business data.
Lists:
- FFIEC IT Examination Handbook, Information Security booklet
Privileged Access Management
Vaulting and rotating passwords for core banking admin accounts.
Lists:
- FFIEC IT Examination Handbook, Information Security booklet
Public Cloud Infrastructure
Managing the tenant with "Policy as Code" guardrails designed to block public S3 buckets holding consumer data. Guardrails reduce, not remove, misconfiguration risk; data decisions remain yours.
Lists:
- FFIEC Joint Statement on Security in a Cloud Computing Environment (2020)
- FFIEC IT Examination Handbook: Architecture, Infrastructure, and Operations
Security Awareness Training
Phishing simulations tailored to financial fraud (e.g., "Wire Transfer Request"), producing training evidence for examiners and cyber insurers. Premium decisions remain the insurer's.
Lists:
- FFIEC IT Examination Handbook, Information Security booklet
Third-Party Risk Scoring
Continuous credit-rating-style monitoring of vendor security postures.
Lists:
- FFIEC IT Examination Handbook (Outsourcing Technology Services and Information Security booklets)
Vendor Risk Management (VRM)
Centralized repository for tracking third-party SOC 2 reports and insurance certificates, automating vendor due diligence.
Lists:
- FFIEC IT Examination Handbook (Outsourcing Technology Services)
- FFIEC Business Continuity Management booklet
Virtual Desktop Infrastructure
Secure remote workspaces designed to keep PII off loan officers' local laptops, under file, clipboard and print policies you approve. Access decisions remain yours.
Lists:
- FFIEC IT Examination Handbook, Information Security and Architecture, Infrastructure, and Operations booklets
Vulnerability Management
Authenticated scanning of the banking network on your schedule (e.g., weekly), supporting the GLBA Safeguards Rule's vulnerability-assessment requirement (16 CFR 314.4(d)(2)). Risk assessment and remediation remain the institution's.
Lists:
- FFIEC IT Examination Handbook, Information Security booklet
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.