Cyber & IT Supervisory Forum - November 2023

Internal Use Only

R ‐ SAT v. 2.0: Question 18

NEW: Logical reordering of considerations. Added new or significantly reworded considerations to monitor social media (including “hyper ‐ local”) and news sources for public awareness and discussions of the incident; immediately contact federal law enforcement; implement out ‐ of ‐ band communication procedures; perform threat hunting to minimize back ‐ door risks; implement alternative strategies for connecting to critical third ‐ party vendors in the event of an infection; and establish escalation procedures for activating BCP/DR in the event of significant and/or long ‐ term impacts to operations.

21

Internal Use Only

R ‐ SAT v. 2.0: Question 18 (continued)

NEW: Added new or significantly reworded considerations to discuss the prospect of ransom payments with the board and any appropriate committee prior to payment, including awareness of and compliance with OFAC guidance; and notify federal regulators within 36 hours and state regulators in accordance with applicable state requirements.

22