Your information security program, reported to the board and recorded incident by incident.

Section III.F of the Interagency Guidelines Establishing Information Security Standards asks for a report to the board on the information security program at least annually. Zovos generates that report from the Cybersecurity landing. Its seven sections follow III.F in order. They cover overall status and compliance, the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations and management’s responses, and recommendations for changes in the program.

• 01Sections one to six are computed from your registers, and every figure is cited to the records it counts.
• 02An empty register reports zero, never an estimate.
• 03Your information security officer writes the recommendations in a shared draft, and that draft is sealed into the report when it is generated.
• 04The report is filed as a sealed PDF with your other board reports and reaches directors through the board portal.
• 05After the report is generated, you can record the annual board report obligation as met on the Obligations calendar.

The Security incidents register records each incident with its severity, its detection time, the systems affected, the service provider where it occurred, the kinds of information involved and the number of customers affected. A named person at your institution records the determination of what the incident is, with its time and its basis. Zovos never makes that determination. Once it is recorded, each incident lists the notification regimes, whether each one applies and why, the deadline it sets, the citation it comes from, and the evidence that each notice was sent.

• 01A bank’s primary federal regulator is owed notice no later than 36 hours after the determination, under 12 CFR 53.3, 225.302 or 304.23.
• 02A credit union owes NCUA notice no later than 72 hours after the determination, under 12 CFR 748.1(c).
• 03When an incident at an entity the FTC Safeguards Rule covers involves the information of 500 or more consumers, FTC notice is due no later than 30 days after discovery.
• 04Customer notice, the cyber insurer and state breach laws are marked by hand, because their terms rest on your judgment, your policy or each statute.
• 05For a suspicious activity report, the register records only that the question was considered and by whom.
• 06No deadline appears before a determination is recorded, and a recorded determination changes only with a reason that stays in the audit trail.

An incident connects to the records it touches. It can be promoted to a finding, linked to a loss event or used to create one in the loss event register, tied to the service provider where it occurred, and given tasks and evidence documents. An incident closes only with a root cause and the lessons learned.

• 01Loss amounts stay in the loss event register, so a loss is never counted twice.
• 02The board report reads the incident register, and it still reports incident-class loss events that no incident links.
• 03Only members who hold the security read permission open the register, and examiner access does not reach it.

The Cybersecurity landing shows the program at a glance. It lists the security and continuity frameworks your institution has enrolled and keeps in scope, with their coverage. Those can be the FFIEC IT and business continuity booklets, GLBA, NCUA Chapter VII, NIST CSF 2.0, the CRI Profile, NIST SP 800-53, the CIS Controls, ISO/IEC 27001, NYDFS Part 500 and PCI DSS. The landing also carries the board report, the open security incidents with the notices still due, the open findings tagged to those frameworks, and the controls crosswalked to them with their test status.

• 01A framework appears on the landing only while its enrollment is in scope.
• 02Open incidents are listed with the earliest notice deadline first.

Automated control tests read the security tools your institution already owns, such as Tenable, Qualys, CrowdStrike and Jamf. A test can be set up only on a connection whose provider can answer its check, so a vulnerability check cannot be placed on an identity provider. A check that cannot be read records an error and never a silent pass.

• 01In the board report, tests whose latest run errored are reported on their own and left out of every pass rate.
• 02The security evidence connectors read summary figures such as counts, rates and remediation aging, not the vulnerability inventory or detection detail.

Zovos records how your institution governs its information security program and keeps the evidence behind it. It does not detect threats, respond to incidents or send notices for you. Your security tools detect, your team responds, and Zovos holds the record of what was decided, by whom, and when.

• 01Notices are sent by your team, and Zovos records when, to whom and by whom each one was sent.
• 02Every write to an incident is recorded in the audit trail.