OCC Updated Cybersecurity Supervision Program

The Office of the Comptroller of the Currency aligned its guidance with the latest NIST framework standards.

Updated on Sept. 21, 2026 in Cybersecurity

Bold flat-color editorial illustration of a secure architectural grid, representing a resilient cybersecurity framework for the banking sector. — The Office of the Comptroller of the Currency has updated its Cybersecurity Supervision Work program, mapping examination procedures to the latest NIST framework standards to improve national bank oversight. AI Illustration. Upload story photo >

Live Poll

Should federal regulators require banks to adopt standardized cybersecurity frameworks?

The OCC has updated its Cybersecurity Supervision Work (CSW) program to better align with the NIST Cybersecurity Framework. The move rescinds previous guidance and streamlines IT examination procedures for national banks.

Why it matters

The update aims to address the evolving risk landscape in the banking sector by mapping examination procedures to current industry standards. It supports more effective, risk-based oversight of bank IT systems.

The updated CSW maps directly to the FFIEC IT Examination Handbook and aligns with NIST Cybersecurity Framework categories. It supplements existing bank information technology procedures without establishing new regulatory expectations.

The players

Office of the Comptroller of the Currency

This is an independent bureau within the United States Department of the Treasury that charters, regulates, and supervises all national banks.

NIST

The National Institute of Standards and Technology is a laboratory and measurement agency that develops cybersecurity frameworks used by industries globally.

FFIEC

The Federal Financial Institutions Examination Council is a formal interagency body empowered to prescribe uniform principles and standards for the federal examination of financial institutions.

The details

While the program update provides a structured framework, the OCC clarified that banks are not explicitly required to use the CSW to assess their own cybersecurity. The adjustment reflects a broader shift in oversight to support risk-based IT examinations.

June 26, 2023: OCC Bulletin 2023-22 was originally issued.
October 2025: The OCC focused its oversight on material financial risks.
May 2026: The OCC identified AI as a cyber threat.
September 21, 2026: The OCC released the updated CSW bulletin.

The Tech Race

This update follows the path of integrating the NIST Cybersecurity Framework into formal banking oversight to standardize defense practices. It positions federal regulators to better monitor industry threats like the AI-driven risks identified by the agency earlier this year.

For banking institutions, this update provides more cohesive procedures for IT examinations to streamline compliance efforts. Customers will not see direct changes to their accounts, but the move aims to strengthen the digital infrastructure protecting their financial data.

The takeaway

Banks should review the new mapping against the FFIEC IT Examination Handbook to ensure their risk-based assessments remain current. Implementing these standardized frameworks helps institutions proactively address modern threats like artificial intelligence.