FFIEC IT Examination Handbook IS-I.B: I.B Responsibility and Accountability (Information Security)

The board or its committee oversees the development, implementation and maintenance of the information security program, understands the business case and the business implications of security risk, gives direction, approves the written program, plans and policies, affirms responsibilities, reviews effectiveness assessments and corrective actions, holds senior management accountable for central oversight, coordination and assignment of responsibility, and receives at least annually a report on the program's status and material matters: the risk assessment process, risk management and control decisions including accepted risks, third-party arrangements, testing results, breaches and violations with management's response, and recommended updates, together with the results of management, audit, third-party and other reviews.