FFIEC IT Examination Handbook MGT-I.B.2: I.B.2 Information Security (Management)

The institution has a comprehensive information security program covering all technology and information assets and complying with the Information Security Standards, with administrative, technical and physical safeguards based on its inherent risk profile and activities; the board delegates to the CISO the assessment of whether IT operations conform to policy and the CISO considers the risks of new products, technologies and systems; testing of the program's controls is delegated to an independent auditor; program management and monitoring are separated from daily security duties, IT has personnel responsible daily for implementing the security policy, and the making of policy changes and exceptions is segregated from control enforcement.