Cyber & IT Supervisory Forum - November 2023

Internal Use Only

R ‐ SAT v. 2.0: Overview

• Updates to the R ‐ SAT took approximately 12 months to complete • Based on work from R ‐ SAT Working Group and feedback from IT Advisory Team, Bankers Electronic Crimes Task Force, US Secret Service, and FDIC • Rolled our R ‐ SAT, v. 2.0 via two webinars • October 10: Commissioners • October 24: Industry • 2,478 individuals registered for the Industry webinar; 1,508 attended • 1,374 bankers representing 47 states and territories • Webinar and slides emailed to registrants and are also available on CSBS website (along with the R ‐ SAT and Lessons Learned paper)

3

Internal Use Only

R ‐ SAT v. 2.0: What’s Being Asked of Your Department

Adoption of the R ‐ SAT is critical to change institution behaviors To change behavior, we must all distribute the RSAT 1) The Method Most Likely to Change Behavior: Require entities to complete and return the R ‐ SAT to your department within 90 to 180 days. 2) Next Best Method: Notify entities that examiners will discuss their completed R ‐ SAT at the next examination. 3) Minimum/Baseline Method: Ask for a completed copy of the R ‐ SAT prior to every examination.

4