Banking and Finance Sector-Specific Plan - U.S. Department of ...

the FBIIC agencies identify financial institutions that play significant roles in key financial markets either individually or as a
group. The vulnerabilities assessments address physical and cyber weaknesses in the financial services sector and are representative
of both kinds of incidents. Collectively, these risk assessments provide an overall risk profile of the sector.
3.2 Screening Infrastructure
As stated in section 1, the Banking and Finance Sector may be divided into several functions: deposit and payments systems;
credit and liquidity products; investment products; and risk-transfer products. The Treasury Department and members of the
FBIIC use a screening process to identify certain assets within the Banking and Finance Sector that are systemically important.
The sector is constantly changing, as are the dynamic screening efforts of the FBIIC to identify these systemically important
assets. The Treasury Department and the FBIIC continually meet with financial institutions and regulators to determine any
new assets that are critical to the operations of the sector. When a new asset is identified, the Treasury and the FBIIC take appropriate
actions to address any vulnerability related to that asset.
The described asset data are controlled by the Treasury Department and the members of the FBIIC. The Treasury and key stakeholders
in the public and private sectors update the asset data on an as-needed basis.
3.3 Assessing Consequences
The Banking and Finance Sector assesses the consequences of an asset’s loss or impairment within the context of its impact on
the sector’s ability to operate efficiently and in an orderly manner and its potential impact on the public’s confidence in the
financial system as a whole. Several factors used in this assessment include diversity, redundancy, nature of dependence on the
asset, network or system, and symbolic importance.
3.4 Assessing Vulnerabilities
The Banking and Finance Sector conducts ongoing vulnerability assessments. These vulnerability assessments include examinations
into the potential risks resulting from cross-sector dependency, sector-specific vulnerabilities and dependencies on key
assets, systems, technologies, and processes. These assessments are based upon the extensive knowledge of regulators and guidance
issued, and take into account physical, cyber, and human vulnerabilities, available redundancy, and the sector’s reliance on
sector-specific assets, systems and processes, and cross-sector reliance on these factors. Consequence assessments include direct
economic impacts and national confidence impacts, and are based on expert judgment and exercises.
Through the vulnerability assessments, the sector has determined that some of its greatest challenges are its dependence on the
telecommunications network and the power grid. Also, the Treasury Department and the FBIIC have identified the following
additional important sector dependencies: Communications, Energy, Information Technology, and Transportation systems. As
addressed in chapter 5 on protective programs, various efforts are underway to address these dependence risks.
Assess Risks