OCC Cybersecurity Supervision Work Program (CSWP)

Why does it matter?

The CSW tells a bank what an OCC examiner brings to a cybersecurity examination: the objectives, the procedures and the vocabulary. Because the OCC publishes the program and its cross-references, a bank can prepare for a BIT examination against the same structure the examiner uses, and because Bulletin 2026-48 left every procedure unchanged, preparation done against the 2023 issuance still holds. The alignment with the NIST CSF functions, categories and subcategories gives bank management and examiners a common framework and terminology, which the OCC's overview page names as the purpose of the alignment.

Key benefits include:

• One vocabulary with examiners

The OCC structured the CSW to align with the six NIST CSF 2.0 functions and their categories and subcategories so that examiners and bank management discuss cybersecurity in the same terms.

• Published cross-references

The CSW References page maps the procedures to supervisory guidance, examiner guidance and industry frameworks, including the Comptroller's Handbooks, the FFIEC IT Examination Handbook, the CIS Critical Security Controls and the Cyber Risk Institute Profile.

• Scaled to the bank

The bulletin's note for community banks says the CSW enables risk-based examination scoping and is scalable for banks of different sizes and complexity.

• No new obligations

The CSW does not establish new regulatory expectations; the OCC encourages, but does not require, a standardized approach and leaves the choice of tool or framework to the bank.

• Stable procedures

The 2026 update maintained alignment between the CSW structure and the evolving NIST CSF without adding or changing any procedure, so earlier preparation remains valid.

How does it work?

The CSW sits inside the OCC's risk-based BIT supervision process. Bulletin 2026-48 says it focuses on cybersecurity preparedness and supplements the bank information technology examination procedures in the Community Bank Supervision, Large Bank Supervision, and Federal Branches and Agencies Supervision booklets of the Comptroller's Handbook and in the FFIEC IT Examination Handbook booklets. The overview page adds that examiners apply risk-based supervision principles when using the CSW and may refer to those booklets and other supervisory guidance during their assessments.

The program's structure follows the NIST CSF. The overview page describes the six functions, Govern, Identify, Protect, Detect, Respond, and Recover, with the related categories and subcategories, and the bulletin's highlights say the structure was updated to align with the updated CSF categories and subcategories while the procedures remained unchanged and no new procedures were added. The CSW Overview page on www.occ.gov links to the CSW References page, where the OCC publishes the cross-references and will post future changes.

For a bank, the practical use is a cross-reference. The OCC does not expect banks to assess themselves with the CSW and, citing the FFIEC press release of August 28, 2019, continues to encourage rather than require a standardized approach to assessing cybersecurity preparedness. A bank that keeps its chosen framework mapped to the CSW's functions and categories can answer examiner requests from its existing control set and evidence, in the examiner's vocabulary, without running a second program.

Key Elements

• Examination objectives and procedures

High-level objectives and procedures that are aligned with existing supervisory guidance and the NIST CSF, used by examiners during BIT examinations (Bulletin 2026-48, summary).

• Six CSF 2.0 functions

Govern, Identify, Protect, Detect, Respond, and Recover, with the related categories and subcategories, as the organizing structure (CSW Overview page).

• Unchanged procedures

The 2026 update added no procedures and changed none; only the structure and references were updated (Bulletin 2026-48, highlights).

• No new regulatory expectations

Banks are not expected to use the work program to assess cybersecurity preparedness and may choose from a variety of tools and frameworks (Bulletin 2026-48, summary).

• Risk-based, scalable scoping

The CSW enables risk-based examination scoping and is scalable for banks of different sizes and complexity; examiners may use its procedures in community bank examinations (note for community banks).

• CSW References page

Cross-references from the procedures to the Comptroller's Handbooks, the FFIEC IT Examination Handbook, the CIS Critical Security Controls and the Cyber Risk Institute Profile.

• Comptroller's Handbook booklets

The CSW supplements the Community Bank Supervision, Large Bank Supervision, and Federal Branches and Agencies Supervision booklets and the FFIEC IT Examination Handbook booklets.

What does it cover?

Bulletin 2026-48 is addressed to the chief executive officers of all national banks, federal savings associations, and federal branches and agencies, to department and division heads, and to all examining personnel; its footnote 1 defines banks as national banks, federal savings associations, and federal branches and agencies of foreign banking organizations. The CSW covers cybersecurity preparedness within the OCC's bank information technology examinations and is used by examiners; it does not establish new regulatory expectations and is not a self-assessment tool for banks. Banks of every size are in scope through risk-based scoping, and the bulletin supersedes OCC Bulletin 2023-22 of June 26, 2023.

What are its objectives?

Bulletin 2026-48 and the CSW Overview page state what the program is for:

To provide high-level examination objectives and procedures aligned with existing supervisory guidance and the NIST Cybersecurity Framework.

To address evolving risks and support risk-based bank information technology examinations.

To maintain alignment between the CSW structure and the evolving NIST CSF categories and subcategories.

To map to the FFIEC IT Examination Handbook and common cybersecurity frameworks through the CSW References page.

To focus on cybersecurity preparedness and supplement the Comptroller's Handbook supervision booklets and the FFIEC IT Examination Handbook booklets.

To give examiners a common framework and terminology for discussions with bank management.

Framework in Context

The CSW is one of several documents an OCC-supervised bank meets in a BIT examination. The Comptroller's Handbook booklets for community banks, large banks and federal branches and agencies carry the examination procedures the CSW supplements, and the FFIEC IT Examination Handbook supplies the interagency IT guidance the CSW maps to. The structure comes from NIST CSF 2.0, whose six functions the overview page names. The References page also cross-references the CIS Critical Security Controls and the Cyber Risk Institute Profile, two of the standardized tools a bank may choose under the FFIEC's August 28, 2019 encouragement of a standardized approach to assessing cybersecurity preparedness.

Common Framework Mappings

The OCC's References page cross-references the CSW procedures to supervisory guidance and industry frameworks, and banks commonly map the framework they have chosen to the CSW's functions and categories so that examiner requests can be answered from one control set and one body of evidence.

Mapped frameworks include:

EU DORA

FFIEC CAT

FFIEC IT Handbook

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2