Bank cyber gaps now arrive as observations the board never has to see

The week

In the last week of August 2026, an arrangement bank boards had long relied on changed for a large share of American banks. For years, if examiners found something seriously wrong with a bank’s cybersecurity, it would land on the boardroom table, in writing, with a deadline.

On August 27, 2026, the OCC and FDIC issued a final rule defining an unsafe or unsound practice and limiting when examiners may issue matters requiring attention. The OCC, the Office of the Comptroller of the Currency, supervises national banks. The FDIC, the Federal Deposit Insurance Corporation, insures deposits and supervises many state-chartered banks. Between them they oversee a large part of the banking system.

A matter requiring attention, or MRA, is the formal written finding examiners use to tell a bank it must fix something. It is the regulator’s equivalent of a doctor saying “this needs treatment, and I will check back.” “Unsafe or unsound practice” is the legal phrase at the heart of bank supervision: conduct that regulators can act against even when no specific law is broken.

The rule was published in the Federal Register, the government’s official daily journal of rules, on September 1, and takes effect November 2. Under the rule, an MRA requires one of two things. Either a practice contrary to prudent operation that could reasonably be expected to cause material financial harm, or has already caused it, or an actual violation of law.

Weaknesses below that line become supervisory observations. Observations need not go to the board, need no action plan and are not tracked as findings. They are, in effect, advice. The FDIC also dropped its separate category of matters requiring board attention, a stronger flag it had used for issues it wanted directors to see personally.

Not every regulator signed on. The Federal Reserve did not join the rule, so banks it supervises are not covered.

The timing carried a second echo. The week also marked one year since the FFIEC removed its Cybersecurity Assessment Tool on August 31, 2025. The FFIEC, the Federal Financial Institutions Examination Council, is the body through which the banking agencies coordinate their exams, and its Cybersecurity Assessment Tool, or CAT, had for a decade given banks a common way to judge their own cyber risk and maturity. In the space of a year, two outside supports for bank cyber governance had been taken away.

Two outside supports, now both gone

The CAT’s retirement orphaned the inherent risk profile, the step that told a bank how much security it needed. An inherent risk profile is an honest look at how exposed the bank is before any controls are counted: how many online channels it runs, how much money moves through it, how many outside technology providers it depends on. Without that step, a bank has no yardstick for whether its security is enough.

The new supervisory rule removes a second external prop. For years, an MRA was how a cyber weakness found its way onto the board agenda with a deadline attached. A security team that had been asking for money to fix something dull but important could point to the MRA and get it funded.

Under the final rule, that happens only when the weakness can be tied to material financial harm. “Material” means significant enough to matter to the bank’s financial condition, rather than merely inconvenient. The agencies’ own discussion allows that IT disruption and cyber vulnerabilities can meet the standard, judged by the severity and likelihood of material harm. Many routine findings will not.

The rule’s effect on cyber programs falls into three parts. Some findings move below the line. Several obligations stay exactly where they were. And banks must now supply an escalation discipline that the examiner used to impose. Escalation discipline is simply the set of rules that decides which problems go up the chain to senior management and the board, and how fast.

Organizations should confirm with counsel how the rule applies to their charter, since it covers OCC- and FDIC-supervised banks and not Federal Reserve or NCUA supervision. NCUA, the National Credit Union Administration, oversees credit unions. A bank’s charter determines its primary regulator, so two banks of the same size in the same town may be on different sides of this line.

What moves below the line

Consider the findings that commonly appeared in IT examinations:

• Incomplete asset inventories. The bank does not have a full list of its computers, software and data. You cannot protect what you do not know you have.
• Gaps in log retention. Logs are the automatic diaries computer systems keep of who did what and when. If they are not kept long enough, investigators cannot reconstruct an incident.
• Untested recovery plans for secondary applications. There is a plan to restore less critical systems after a failure, but nobody has checked it works.
• Thin documentation of vendor oversight. The bank relies on outside technology firms but cannot show how it checks on them.

Each is a sound practice concern. Few can be shown, on their own, to threaten material harm to a bank’s financial condition. Under the rule, many will arrive as supervisory observations.

An observation is informal. The bank is not required to present it to the board, adopt corrective action or submit an action plan. Examiners are not to track voluntary changes beyond normal recordkeeping. Absent a change in circumstances, observations generally are not escalated to MRAs.

For a stretched security team, that frees capacity for higher risks. Time once spent writing action plans for documentation gaps can go to the threats that really hurt banks. It also removes the deadline that often secured budget for unglamorous fixes. A missing inventory never wins a budget fight against a new customer app on its own merits; an MRA used to tip the balance.

What is likely to stay above the line

The cyber weaknesses most likely to stay above the line are those tied to availability of critical services, ransomware resilience and the integrity of payment and customer data. Ransomware is malicious software that locks up an organization’s systems or data until a ransom is paid, and it is one of the most damaging attacks banks and their suppliers face.

The rule’s preamble, the explanatory text that accompanies a rule, gives its own example: weaknesses around unsupported operating systems and patch management, which compensating controls rarely offset and which attackers commonly exploit through ransomware and data theft. An unsupported operating system is software the maker no longer fixes. Patch management is the routine of installing the software fixes that close known security holes. Compensating controls are workarounds meant to reduce a risk when the main fix cannot be made; the preamble’s point is that for these weaknesses, workarounds rarely do the job.

A bank that cannot restore core processing after an attack faces an obvious path to financial harm. Core processing is the central system that keeps account balances and posts every deposit, withdrawal and payment. If it is down, the bank effectively cannot operate.

Weak identity controls on a privileged administrative console may also qualify, depending on what lies behind it. A privileged console is the master control panel that system administrators use, with powers ordinary staff do not have. Banks should expect examiners to explain that link in writing, since the rule asks them to support an MRA with objective facts and reasoning.

What stays the same

The rule changes how findings are classified. It does not change the underlying obligations. That distinction is easy to lose, and it matters.

• The interagency information security guidelines under the Gramm-Leach-Bliley Act still require a written program overseen by the board. The Gramm-Leach-Bliley Act is the federal law that, among other things, requires financial institutions to protect customer information.
• The 2021 computer-security incident notification rule still requires banks to notify their regulator within 36 hours of a qualifying incident.
• Third-party risk management guidance still applies, covering how banks choose and oversee outside providers.
• Violations of law, including consumer protection and anti-money laundering requirements, can still support an MRA.

Ratings also remain. Banks receive supervisory ratings that summarize the regulator’s view of their condition and management, and those ratings affect how closely the bank is watched and what it can do. Examiners may use the information behind observations to support assigned ratings. A bank that accumulates observations without addressing them may see the effect in its ratings rather than in a list of MRAs. That is a less visible signal, and easier for a board to miss. A board that only reads the list of formal findings could see it shrink while the bank’s standing slips.

What the bank must now supply

With no common assessment tool and fewer formal findings, the bank’s own governance has to carry the weight. Three pieces matter.

1. One findings register

The first is an internal findings register that records examiner observations alongside internal audit, penetration test and self-assessment findings, with an owner and a target date for each. A penetration test is an authorized simulated attack, carried out by specialists to find weaknesses before criminals do. The register is simply one list of every known gap, wherever it came from.

Observations should not live only in an exam letter. Internal audit should test the register once a year, checking that closed items were actually fixed and that nothing was downgraded without a recorded reason. Without that check, informal findings can drift for years.

2. A board-approved escalation threshold

The second is an escalation threshold the board approves. It should say which findings go to the board or its risk committee, on what criteria, and how often. Criteria might include exposure of critical services, repeat findings, age past target date and findings that touch privileged access.

The threshold should be written in the bank’s own terms, not the agencies’ materiality test, because the board’s duty of oversight is broader than the examiner’s enforcement standard. The examiner is asking “is this bad enough for us to require action?” The board must ask “is this something we need to know about to run the bank responsibly?” Those are different questions, and the second one has a lower bar.

3. A link to how much security the bank needs

The third is a sizing link. The inherent risk step that the CAT once supplied now has to be rebuilt by the bank itself, and it does double duty. It tells the bank how much control it needs, and it gives the escalation threshold a reference point. A finding that leaves a control below the level the risk profile requires should be reported to the board, whether or not an examiner would call it material.

Banks that run this discipline well may find the new rule helpful. Examiners will spend less time on documentation findings and more on whether controls work, and a bank with its own register can show that it already knows its gaps.

Fewer formal findings, more weight on the board

The rule can be read as simple good news: fewer formal findings, less paperwork, more examiner attention on what really matters. For a board, the more useful reading is about where accountability now lies, and what that means for money, customers and reputation.

Money

Cyber hygiene is rarely exciting. Keeping an accurate inventory, holding logs long enough, testing recovery for systems nobody thinks about until they break: none of this produces revenue or a ribbon-cutting. For years, a formal finding with a deadline helped these items compete for budget with projects that customers can see. Without that push, the bank’s own planning process has to give them a fair hearing. If it does not, the work slips, and the cost shows up later, usually at the worst possible moment, in the middle of an incident.

Customers

Customers do not care how a weakness was classified. They care whether they can reach their money and whether their information is safe. Weaknesses that look minor in isolation, such as an incomplete inventory or a short log history, are often exactly what slows a bank down when something does go wrong. A team that does not know which systems it has will take longer to find out which were affected, and customers will wait longer for answers.

Regulators and the 36-hour clock

The incident notification rule still requires notice within 36 hours of a qualifying incident. Meeting that clock depends on the same basics that may now arrive only as observations. Good logs tell a bank what happened; a good inventory tells it what was touched. A bank that let those slip because they no longer drew MRAs may find itself struggling with a requirement that has not changed at all.

Reputation and personal accountability

Directors have a duty to oversee the bank’s risks, and cyber risk is now firmly among them. After a serious incident, the questions from customers, the press and sometimes the courts are rarely about how an examiner labeled a finding. They are about what the board knew and what it did. A board that can show a register, a threshold and a record of follow-through is in a far stronger position than one that can only say no formal findings were raised.

Two banks, one observation

Suppose two community banks, both supervised by the OCC, each receive the same supervisory observation after the rule takes effect: its recovery plan for a secondary lending application has never been tested.

At the first bank, the observation sits in the exam letter. Nobody is required to act, the security team has three more urgent projects, and the item is never written down anywhere else. Two years later, a different observation notes that the bank’s inventory is still incomplete, and a third mentions vendor documentation. None reaches the board. The directors see fewer MRAs than ever and assume things are improving. Then the next examination’s ratings come back lower, and the board is surprised.

At the second bank, the chief information security officer enters the observation in the findings register the week the letter arrives, with an owner and a target date. The board-approved threshold says that findings unresolved past their target date, or repeated across exams, go to the risk committee. Six months later the test has not been run, so the item appears in the committee pack with a short explanation and a new date. The directors ask why, and the test is done the following quarter. When internal audit reviews the register, it confirms the item was actually closed. At the next exam, the bank can show examiners exactly how it found and fixed its own gaps.

The rule treated both banks identically. The difference is entirely in what each bank built for itself.

A register, a threshold and an honest audit

The pieces are a single register, a written threshold approved by the board, a current inherent risk profile that sets the bar for controls, and an annual audit check that the register is honest. Management reporting should also show observations and ratings side by side, so directors see the full picture rather than just the formal findings.

The failures are predictable:

• Reading fewer MRAs as better security.
• Letting observations live only in exam correspondence, where they are forgotten.
• Copying the agencies’ materiality test as the board’s own threshold, which sets the bar too high for good oversight.
• Losing the budget case for basic hygiene, such as inventories and logs, now that no deadline is attached.
• Assuming the rule applies without checking the bank’s charter and primary regulator.

What the board should be able to see

• Where do we record examiner observations, and are they in the same register as audit and testing findings?
• What criteria decide which cyber findings come to this board or its risk committee, and did we approve them?
• Do we have a current inherent risk profile, and does it tell us how strong each key control needs to be?
• Can we restore core processing after a ransomware attack, and when did we last prove it?
• Are we tracking our ratings alongside observations, so we would notice a slow decline?

Behind those sit two narrower checks: who owns each open cyber finding and how many are past their target date, and whether internal audit’s last test of the register found anything that had been closed without being fixed.

With hindsight

The rule takes effect on November 2, 2026, so it is too early to see how examiners will apply the materiality test to cyber weaknesses in practice. The first examination reports written under it will be the real test of where the line falls.

Some changes are already visible. The FDIC moved to a single MRA category for examination reports issued after August 31, retiring its separate board-level flag. The OCC also proposed a separate rule on how violations of law are treated in MRAs, which remains pending, so another piece of the picture may still shift.

The regulatory map is uneven. The Federal Reserve did not join the rule, though its vice chair for supervision has urged a similar focus on material financial risk. Banks supervised by the Fed therefore sit under a different formal regime, even if the direction of travel looks similar.

The CAT’s absence has not produced a single successor. Banks use NIST CSF 2.0, the CRI Profile and other frameworks, and NCUA continues to support its own tool for credit unions. NIST CSF 2.0 is the widely used cybersecurity framework from the National Institute of Standards and Technology, and the CRI Profile is a version tailored to financial services. Both are useful, and neither is a shared regulatory yardstick in the way the CAT was.

Taken together, these changes leave more of the judgment about cyber priorities with each bank’s management and board. That is not necessarily bad. A board that knows its own risks and tracks its own gaps may well be better governed than one that waited for an examiner to tell it what mattered. But it does mean that an uneventful year of exams is no longer evidence of a strong cyber program.

Banks should watch early examination reports after November for how observations and ratings interact. If observations begin to show up in ratings, the boards that kept their own registers will see it coming; the ones that counted only MRAs will not.