FFIEC IT Examination Handbook IS-IV.A.4: IV.A.4 Assurance Reporting (Information Security)

Reports of self-assessments, penetration tests, vulnerability assessments and audits are timely, complete, transparent and relevant to management decisions, prioritise risks and findings, suggest remediation options, highlight repeat issues and root causes, go to those with authority to act, those accountable for outcomes and those who advise on risk decisions, trigger appropriate escalation and response, and reach the board in summary as appropriate.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Information Security booklet (September 2016) – FFIEC IT Examination Handbook

IS-I.A I.A Security Culture (Information Security)
IS-I.B I.B Responsibility and Accountability (Information Security)
IS-I.C I.C Resources (Information Security)
IS-II.A.1 II.A.1 Threats (Information Security)
IS-II.A.2 II.A.2 Vulnerabilities (Information Security)
IS-II.A.3(a) II.A.3(a) Supervision of Cybersecurity Risk (Information Security)
IS-II.A.3(b) II.A.3(b) Resources for Cybersecurity Preparedness (Information Security)
IS-II.B II.B Risk Measurement (Information Security)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All FFIEC IT Examination Handbook controls