A December 2010 draft of the new FFIEC Guidance Guidelines was reportedly distributed in December. The draft suggests financial institutions must improve online security internally as well as for their consumer and commercial customers. But former BofA executive David Shroyer says the guidance is too vague. The current draft’s highlights include: Better risk assessments to address emerging threats, such as man-in-the-middle attacks and keyloggers. Gartner analyst Avivah Litan says acknowledgment of vulnerability for commercial customers is the best thing to come out of the draft.”]
Source: https://www.cuinfosecurity.com/gaps-in-ffiec-guidance-a-3378