On September 21, 2026, the OCC announced that it had recently updated the structure and references of the OCC Cybersecurity Supervision Work Program (CSW) used by examiners. The CSW provides high-level examination objectives and procedures that are aligned with existing supervisory guidance and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).
According to the OCC, it continues to update its approach to assessing cybersecurity risk as part of risk-based supervision in response to evolving cyberattacks and the fact that banks are adopting various standardized tools and frameworks to assess cybersecurity preparedness.
Highlights of the changes to the CSW include the following:
Procedures remain unchanged and no new procedures were added;
Structure was updated to align with the updated NIST CSF categories and subcategories;
Addresses evolving risks and supports risk-based bank information technology examinations;
Maps to the Federal Financial Institutions Examination Council (FFIEC) Information Technology (IT) Examination Handbook and common cybersecurity frameworks; and
Focuses on cybersecurity preparedness and supplements the OCC’s bank information technology examination procedures contained in the “Community Bank Supervision,” “Large Bank Supervision,” and “Federal Branches and Agencies Supervision” booklets of the Comptroller’s Handbook and the FFIEC IT Examination Handbook booklets.
In line with this, the OCC Bulletin 2023-22, “Cybersecurity: Cybersecurity Supervision Work Program,” issued on June 26, 2023 was rescinded.
The OCC clarified that the CSW does not establish new regulatory expectations, and banks are not expected to use this work program to assess cybersecurity preparedness.
Read the OCC’s press release here.