Exams go need-to-know on highly sensitive information

On July 16 the Federal Reserve, OCC, and FDIC issued a joint statement on handling highly sensitive information during examinations (OCC Bulletin 2026-32 and FDIC FIL-37-2026). Security teams have argued the premise for years. Some documents are more dangerous in transit than they are informative in an exam file. Examples include network diagrams and schematics, detailed penetration-test results, technical details of specific IT control weaknesses, and succession plans.

The mechanics put the first move with the bank. Management identifies the requested materials it believes are highly sensitive, and the agencies then evaluate whether additional protocols should apply. Chief among them are alternative review methods, such as on-site examination or direct digital access through the bank’s own systems. These reduce the need to transfer sensitive data onto agency systems at all.

The 72-hour commitment

The statement also formalizes an obligation running in the other direction. If an agency has a reasonable basis to believe a material compromise of confidential supervisory information has occurred, it commits to notify affected banks as soon as practicable and within no more than 72 hours of determining which banks are affected, subject to applicable legal considerations. Exam material sitting on agency infrastructure is a real attack surface. The agencies are now on the clock to tell you if it leaks.

Your pen-test results are a map of your weakest points. The new statement recognizes that the safest place for that map is inside your own walls.