FFIEC IT Handbook

Why does it matter?

The FFIEC IT Handbook is the yardstick U.S. examiners use for technology risk, so aligning to it before an examination avoids findings, matters requiring attention, and enforcement actions.

Key benefits include:

• Examination readiness

Institutions that map controls and evidence to the booklets' examination procedures answer examiner requests quickly and completely.

• Consistent supervisory expectations

The same booklets are used by all federal banking agencies and many state regulators, so one program satisfies multiple examiners.

• Complete coverage of IT risk

The ten booklets span governance, security, resilience, development, outsourcing, and payments rather than security alone.

• Board and management accountability

The Management booklet sets clear expectations for board oversight, IT risk management structure, and reporting.

• Third-party oversight

The Outsourcing Technology Services and Supervision of Technology Service Providers booklets define how institutions and examiners assess service providers.

How does it work?

The handbook is organized as independent booklets, each with an introduction, guidance chapters, and appendices containing examination procedures, a glossary, and references to laws, regulations, and guidance. The Management booklet establishes IT governance and IT risk management (identification, measurement, mitigation, monitoring, and reporting); the Information Security booklet covers governance of the security program, risk identification, measurement, and mitigation, security operations, and program effectiveness through testing and assurance; the remaining booklets address audit, business continuity, development and acquisition, architecture and operations, outsourcing, payment systems, and the supervision of technology service providers.

Examiners use the booklets' examination procedures and work programs to scope and conduct IT examinations and to rate institutions under the Uniform Rating System for Information Technology. Institutions prepare by performing self-assessments against each relevant booklet, maintaining policies and standards that reflect the guidance, keeping asset inventories, risk assessments, testing results, vendor due diligence, incident and continuity exercise records, and board reporting current, and by tracking remediation of prior examination findings. Booklets are revised individually, so programs must monitor the InfoBase for updates.

Within SmartSuite, teams can operationalize the IT Handbook by loading each booklet's sections and examination procedures as requirements, mapping them to policies, controls, and evidence, assigning owners and review dates, and tracking examination requests, findings, and remediation in one workspace. Dashboards show readiness by booklet and give management and the board the reporting the handbook expects.

Key Elements

• IT governance and management

Board oversight, IT management structure, enterprise architecture, and the IT risk management process defined in the Management booklet.

• Information security program

Governance, risk identification and measurement, control implementation, security operations, and assurance testing set out in the Information Security booklet.

• Business continuity management

Business impact analysis, resilience planning, testing, and exercises covered by the Business Continuity Management booklet.

• Development, architecture, and operations

Controls over software development, procurement, change management, infrastructure design, and delivery of IT services.

• Third-party and service provider oversight

Risk management of outsourced technology services and the agencies' supervisory program for technology service providers.

• Payment systems

Risk identification and controls for retail and wholesale payment systems, including large-value transfers.

• IT audit

Characteristics of an effective IT audit function and how examiners evaluate audit independence, coverage, and follow-up.

What does it cover?

The IT Handbook applies to institutions supervised by the FFIEC member agencies, including national and state banks, savings associations, credit unions, and holding companies, and to the technology service providers the agencies examine. It covers the full scope of information technology risk: governance, information security, business continuity, development and acquisition, architecture and operations, outsourcing, retail and wholesale payments, and IT audit. Institutions of every size are examined against it, with the depth of review scaled to complexity and risk profile.

What are its objectives?

The FFIEC IT Handbook is intended to help examiners and institutions achieve the following outcomes.

Give examiners uniform guidance and procedures for assessing IT risk management across all federally supervised institutions.

Set clear expectations for board and senior management oversight of information technology.

Ensure institutions identify, measure, mitigate, and monitor technology and information security risk.

Promote resilience through business continuity planning, testing, and incident response.

Establish sound practices for developing, acquiring, operating, and outsourcing technology.

Protect the safety and soundness of payment systems and the security of customer information.

Framework in Context

The IT Handbook is the operational reference behind U.S. banking IT supervision: it implements the Interagency Guidelines Establishing Information Security Standards issued under the Gramm-Leach-Bliley Act, complements the OCC's Cybersecurity Supervision Work Program and the 2023 Interagency Guidance on Third-Party Relationships, and is cross-referenced by NYDFS 23 NYCRR 500, the NAIC Insurance Data Security Model Law, and FINRA cybersecurity guidance. The FFIEC Cybersecurity Assessment Tool, which institutions used alongside the booklets, was retired on August 31, 2025 (OCC Bulletin 2024-25), so the booklets themselves are now the reference for cybersecurity examinations. Its Information Security and Management booklets align with NIST CSF 2.0, NIST SP 800-53, ISO/IEC 27001, and COBIT 2019, and institutions commonly reuse SOC 2 reports and PCI DSS assessments as evidence during examinations.

Common Framework Mappings

The FFIEC IT Handbook is commonly mapped to cybersecurity, control, and financial services frameworks so that institutions can present one control set to examiners, auditors, and customers.

Mapped frameworks include:

FFIEC CAT

GLBA Safeguards Rule (16 CFR Part 314)

OCC CSWP

NYDFS 23 NYCRR 500

NAIC MDL-668

FINRA Cybersecurity

NIST CSF 2.0

NIST 800-53 Rev.5

ISO 27001:2022

COBIT 2019

CIS Controls v8.1

SOC 2

PCI DSS 4.0.1

SOX

MAS TRM 2021

Interagency Guidelines Establishing Information Security Standards

Interagency TPRM Guidance (2023)

NCUA Rules and Regulations Part 748