Do What You Can, With What You Have, Where You Are

Introduction

Examiners continue to increase the cybersecurity compliance requirements for smaller and smaller financial institutions. With how much cyber attacks have increased worldwide, every organization, no matter how small, needs to be working to improve their cybersecurity posture. With comprehensive services and software designed for small organizations, TraceSecurity strives to empower your financial institution to do what you can, with what you have, where you are.

Do What You Can

As a smaller financial organization, you probably rely on IT service providers for some or all of your network management and security. With IT being handled off-site, it can easily become an “out of sight, out of mind” situation, especially for those that think they’re too small to be targeted. For this reason (and many more), the NCUA, FDIC, and OCC dictate that IT environments must be regularly reviewed and tested for security and compliance.

Thankfully, regulatory bodies have made efforts to streamline the compliance process depending on organization size and complexity. Smaller organizations may only have examinations every 18 months instead of annually, alleviating some of the cost and effort required to maintain compliance.

While you may not be actively involved in the network management, you can still cover your bases through third-party testing and vendor management. Vulnerability scanning, penetration testing, risk assessments, IT security audits, and social engineering are the core components to any effective information security program. TraceSecurity’s services are scalable to work with organizations of any size or budget while continuing to pass regulatory examinations year after year. Our Small Institution Network Assessment is a bundled vulnerability assessment and external penetration test, which meets one of the major compliance requirements for small banks and credit unions.

With What You Have

Whether you manage your IT in-house or through a third-party, it’s important to understand your organization’s specific needs in order to effectively allocate resources to the most critical areas. With limited staff and budget to work with, there’s an added pressure to spend funds wisely. The reality is that you can only work with what you have; budget, staff, service providers, time.

TraceSecurity’s Small Institution Risk Assessment is designed to help small organizations get a full view of their organizational risk, while prioritizing the most critical areas for risk management efforts. A risk assessment is considered to be the best starting place for any cybersecurity program, providing a baseline for investment and improvement over time. By understanding where your largest and most vulnerable risks lie, you can allocate budget and resources to mitigating your biggest weaknesses and prioritize your internal efforts for improvement.

As a baseline, our free Cybersecurity Assessment Tool can be used to perform a self-assessment of your financial institution’s cybersecurity preparedness, giving you a detailed report with actionable recommendations for improvement. The assessment will rank your credit union on cybersecurity maturity based on other organizations of your size.

Where You Are

Even though technological advances bring new vulnerabilities, they also allow for security measures and testing on a more comprehensive scale. The ability to remotely perform the core testing of your networks and systems has been a huge relief to organizations and examiners alike. Remote services allow for smaller financial institutions to save money on travel costs, ease of coordination with your IT service provider(s), and the potential to allocate saved funds to additional security testing that you may not have been able to afford otherwise.

Almost all TraceSecurity services can be performed remotely, with additional bundling options to maximize your budget and cybersecurity testing program.

Remote services include:

• Penetration Testing
• Vulnerability Assessment
• Risk Assessment
• IT Security Audit
• Application Security Testing
• Wireless Assessment & Penetration Testing (newly remote!)
• Configuration Reviews (Servers, VPNs, Firewalls, etc.)
• Remote Social Engineering (Phishing, Vishing, Smishing)