FFIEC IT Examination Handbook IS-II.A.3(a): II.A.3(a) Supervision of Cybersecurity Risk (Information Security)

Institutions manage internal and external threats and vulnerabilities to protect information assets and infrastructure from technology-based attacks, and examiners focus on cybersecurity preparedness when assessing the effectiveness of the overall information security program.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Information Security booklet (September 2016) – FFIEC IT Examination Handbook

IS-I.A I.A Security Culture (Information Security)
IS-I.B I.B Responsibility and Accountability (Information Security)
IS-I.C I.C Resources (Information Security)
IS-II.A.1 II.A.1 Threats (Information Security)
IS-II.A.2 II.A.2 Vulnerabilities (Information Security)
IS-II.A.3(b) II.A.3(b) Resources for Cybersecurity Preparedness (Information Security)
IS-II.B II.B Risk Measurement (Information Security)
IS-II.C.1 II.C.1 Policies, Standards, and Procedures (Information Security)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All FFIEC IT Examination Handbook controls