Regulatory Standards · United States
OCC Cybersecurity Controls
Examination-ready cyber controls for US banks.
OCC examiners expect sound cyber risk management, third-party oversight and timely incident notification. Astragar maps controls to evidence and shows where gaps create real exposure.
Book a OCC Controls review✓ Available in Astragar GRC
36h
To notify your regulator of a notification incident
FFIEC
IT Examination Handbook informs examiner expectations
2023
Interagency guidance on third-party risk management
What OCC Controls requires
The obligations, in brief.
Risk management
Cyber risk governed within the bank's enterprise risk framework.
Controls & testing
Controls proportionate to risk, independently tested and evidenced.
Third parties
Lifecycle oversight of service providers and their security.
Incident notification
Notify the OCC within 36 hours of qualifying computer-security incidents.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every OCC Controls requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put OCC Controls controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
Astragar is already used to run OCC control certifications through auditor, CISO and executive sign-off.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
Start with a scoped OCC Controls review: requirements mapped, evidence gaps found, remediation prioritised by financial impact.
Book a OCC Controls reviewAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
