Banking and Finance Sector-Specific Plan - U.S. Department of ...

3. Assess Risks
Both the public and private members of the Banking and Finance Sector conduct risk assessments. These assessments look at
issues and potential vulnerabilities both within individual organizations and sector-wide. Since risk management is part of the
banking and finance culture, both regulators and private organization have a long history of conducting regular risk assessments.
In the private sector some of these risk assessments are mandated through regulation and validated by the examination
process. Furthermore, the private sector institutions conduct voluntary risk assessments to meet their business needs as part of
their continuity panning and/or in conjunction with trade associations’ recommendations and self-regulatory requirements.
Following the attacks of September 11, 2001, the sector’s risk assessment efforts became more formalized and took on a renewed
sense of urgency. The FBIIC began an organized annual effort to examine the financial sector’s resilience. The process has
continued and matured over the years to include physical and cyber-based components of the sector as well as dependencies
on other critical sectors. Information in this process is garnered through the regulators’ extensive knowledge of sector participants.
Furthermore, this information is verified through consultation with key private sector organizations. Information shared
between the members of the sector and the financial regulators provide insights into the operational, financial, and systemic
risks facing individual organizations and the sector as a whole. Through organizations such as the Federal Financial Institutions
Examinations Council (FFIEC), various private sector trade associations, and the FBIIC, there is ongoing verification and validation
updating of risk assessment information. Furthermore, through individual information-sharing efforts between the Treasury
Department and individual financial institutions, this process is furthered informed regarding new and emerging threats.
Through this process, the Treasury Department has identified potential limitations and created a process to identify and assess
vulnerabilities within the sector.
The following sections refer to the efforts of the Treasury Department, working with the FBIIC members and the private sector,
to identify sector vulnerabilities and assess the risks across the Banking and Finance Sector.
Assess Risks