IT GENERAL CONTROLS AUDIT
Verify your controls, expose potential risks, and ensure
community confidence.
ENSURE COMPLIANCE AGAINST
CURRENT RISKS & BEST PRACTICES
Cybercriminals are hoping you stop at compliance. They’re counting on your organization conducting a bare minimum GLBA or NCUA audit. This gives malicious actors a fairly easy “in” to breach your environment, steal customers’ non-public personal information (NPI), and sully your hard-earned community reputation.
This is why BAI’s IT General Controls Audit goes far beyond just verifying your policies and procedures against regulatory compliance. We go the extra mile to examine your protocols in light of present-day best practices in IT security and emerging hacking methods that could compromise your environment. This is what we call BAI’s Compliance-PLUS Protection.
VERIFY YOUR CONTROLS
Our exhaustive IT General Controls Audit verifies your organization’s existing controls against regulatory standards (GLBA or NCUA), as well as present-day banking best practices, to see if they work effectively to keep non-public information (NPI) safe and secure.
BAI Security’s team of in-house compliance experts review the following key areas:
- Management and IT Governance (including Cybersecurity Preparedness)
- Development and Acquisition
- Information Technology Operations
- Electronic Payment Systems/Hosted and Managed Applications (including e-Banking)
- 3rd Party Vendor Management
- Business Continuity and Disaster Recovery (including Appendix J)
You may wish to consider our IT Security Assessment or IT Risk Assessment as a complement to this audit.
ENSURE CUSTOMER CONFIDENCE
With BAI’s comprehensive IT General Controls Audit, you can implement the necessary changes to your information security programs and policies to keep customer information private.
We provide customized gap analysis and guidance so you can reach compliance standards and have a written information security plan in place that adequately protects customer and consumer records.
By abiding by the Safeguards Rule, your institution can build trust and confidence among your customers and community, as they are assured that their information is secure.
EASY, SECURE PORTAL
Conducting a compliance audit on a financial organization’s operations can be complex. This is particularly true for smaller to mid-sized institutions with limited resources, as well as larger financial networks with numerous locations and personnel. This is where our deep experience working with banks, credit unions, financial services, branch locations, and more, matters to be able to comprehensively audit your environment without creating a burden for your team. BAI's Secure Portal makes assessment, compliance, and tracking easy for your team. Just log in, upload your relevant documents, and track progress — we’ll take care of the rest!
Looking for Virtual CISO, SOC, EDR, managed backup, Microsoft 365 and Azure consulting?
Visit our parent company, Cyber Advisors!
GLBA
The Gramm-Leach-Bliley Act is a U.S. federal law created to control how financial institutions deal with a consumer’s non-public personal information (NPI). This is information that a financial institution collects when providing a financial product or service that can identify an individual and that isn’t otherwise publicly available.
- The Privacy Rule, which regulates the collection and use of NPI
- The Safeguards Rule, which requires financial institutions to implement a security program to protect NPI
- Pretexting provisions, which prohibits access to NPI under false pretense
- Ensuring the security and confidentiality of NPI
- Protecting against unauthorized access which could cause substantial harm or inconvenience to any customer
- Protecting against any threats which might affect the security or integrity of NPI
GLBA calls for severe civil and criminal penalties for noncompliance, including fines and imprisonment. If a financial institution violates GLBA, the following penalties may be issued:
- The institution will be subject to a civil penalty of not more than $100,000 for each violation.
- Officers and directors of the institution will be subject to, and personally liable for, a civil penalty of not more than $10,000 for each violation.
- The institution and its officers and directors will also be subject to fines in accordance with Title 18 of the United States Code or imprisonment for not more than five years, or both.
