Reexamining Regulator Cybersecurity: Data Risks and Oversight Gaps in the Financial System

Recent cyber breaches at the OCC and U.S. Treasury have exposed gaps in federal data handling practices. This article from NETBankAudit explores the risks centralized supervisory data poses to financial institutions, highlights oversight inconsistencies, and outlines key audit actions to mitigate exposure.

Federal regulators have long expected financial institutions to uphold stringent cybersecurity and data governance standards. Yet, recent breaches at regulatory agencies themselves have revealed a troubling paradox: institutions are being held to standards their overseers cannot meet.

In this article, NETBankAudit examines the industry’s growing concern over federal data handling practices, the risks introduced by centralization of supervisory data, and practical implications for compliance and audit teams tasked with safeguarding confidential supervisory information.

Cybersecurity Breaches Undermine Regulatory Trust

A June 2025 joint letter from leading trade associations, including the American Bankers Association (ABA), Bank Policy Institute (BPI), Managed Funds Association (MFA), and Securities Industry and Financial Markets Association (SIFMA), called for sweeping reforms to federal data handling practices. Their concerns were prompted by a series of breaches, including:

A prolonged compromise at the Office of the Comptroller of the Currency (OCC), where hackers accessed 148,000 internal emails between May 2023 and February 2025. These communications contained sensitive financial data on supervised institutions.
A December 2024 attack on the U.S. Treasury involving Chinese state-sponsored actors, compromising documents and devices used by senior leadership.

These incidents prompted the trade groups to call for regulators to meet the same cybersecurity expectations imposed on the private sector and to reassess how supervisory data is collected, centralized, and retained¹.

The Cybersecurity Double Standard Between FI's and Regulators

Audit Risk Introduced by Centralized Supervisory Data

For financial institutions, the fallout extends beyond the direct regulatory scrutiny following a breach. The centralized storage of confidential supervisory information (CSI) by federal agencies introduces new operational and reputational risks:

Lack of Control: Once CSI is submitted to a regulator, institutions lose control over its protection and transmission, leaving them exposed to third-party vulnerabilities.
Regulatory Delay in Notification: In some recent incidents, affected entities were not informed of regulator-side breaches for weeks or months¹. This impairs risk response and may hinder compliance with third-party risk management standards.
Data Aggregation Risks: Large-scale aggregation of sensitive financial data in centralized regulatory systems makes them high-value targets. The attack surface expands with every institution required to upload full supervisory files.

As the June 2025 joint letter argued, agencies should permit more on-premise review of sensitive data, limiting unnecessary duplication or transfer of CSI¹. From a compliance and audit perspective, this model would align with least-privilege access principles and help financial institutions maintain better control of risk.

Current Gaps in Oversight and Policy Alignment

Despite advancements in industry-side third-party risk frameworks, federal agencies remain outside the scope of many security expectations they themselves promote. While the 2023 Interagency Guidance on Third-Party Relationships outlines clear responsibilities for institutions in managing vendor risk, the same rigor has not been mirrored in regulator-side cyber governance².

Auditors should note the following asymmetries:

Breach Notification Standards: Institutions are often required to notify regulators within 36 to 72 hours of an incident. Yet, no reciprocal obligation currently compels regulators to notify institutions after agency-side breaches.
Vendor Oversight Practices: Financial institutions are subject to scrutiny for the performance and controls of all vendors with access to customer or supervisory data. However, regulators themselves often operate opaque contracting and system management processes, without public vendor assessments or third-party attestations.
Incident Response Planning: While institutions must regularly test response playbooks and conduct tabletop exercises, agency processes are not uniformly transparent or standardized across regulatory bodies.

For audit and compliance teams, these inconsistencies create blind spots. CSI that leaves your institution may be unknowingly at risk due to downstream weaknesses in regulator systems.

Harmonization Efforts and the Need for Sector-Wide Reform

In parallel with the industry’s June 2025 advocacy letter, other agencies have acknowledged the need for more cohesive policy. The Cybersecurity and Infrastructure Security Agency (CISA), in its harmonization report to the Office of the National Cyber Director, emphasized the fragmented and duplicative reporting requirements facing critical infrastructure entities, including financial services. The report encouraged standardized reporting, centralized intake, and shared threat intelligence mechanisms³.

Yet, the harmonization effort has largely focused on regulated entities, not the regulators themselves. This remains a critical gap.

The CFPB’s May 2025 notice on confidential supervisory information similarly signals growing tension. The Bureau proposed changes that would limit the disclosure of CSI even in internal investigations or litigation. Critics argue that such restrictions, absent clear data protection reforms on the agency side, may further erode industry trust⁴.

Implications for Financial Institutions and Auditors

In light of these developments, NETBankAudit recommends financial institutions and their audit teams consider the following actions:

Review CSI Handling Procedures: Confirm what types of supervisory data your institution submits to regulators, in what formats, and through which systems. Evaluate whether you have appropriate documentation of access logs, data minimization efforts, and retention policies.

Enhance Regulator Risk Assessments: Treat regulators and federal agencies as third-party data recipients. Conduct risk assessments accordingly, identifying exposure points and evaluating whether agency-side breaches may trigger disclosure obligations under state or contractual privacy rules.

Advocate for Secure On-Site Review: Where possible, request or support policies that allow for sensitive supervisory data to be reviewed securely on-site rather than uploaded to regulator-controlled systems. This aligns with zero-trust principles and helps limit the aggregation of risk.

Include Regulatory Cyber Risk in Board Reports: Provide updates to boards or risk committees about risks introduced by regulator-side data exposure. Clear communication can help prioritize policy engagement and internal contingency planning.

Track Ongoing Policy Developments: Monitor Treasury and agency responses to the June 2025 letter and related cybersecurity harmonization efforts. Future updates may change data handling expectations or lead to interagency guidance.

Protect Your Institution with NETBankAudit Expertise

The cybersecurity risk landscape is not limited to financial institutions and their vendors. As breaches at the OCC and Treasury have shown, federal agencies themselves can introduce systemic vulnerabilities. Compliance and audit professionals must reassess their frameworks to account for these risks and push for consistent, reciprocal standards in data protection.

As the lines blur between internal and external risk domains, financial institutions must remain vigilant, adaptive, and engaged in policy reform. NETBankAudit will continue monitoring regulatory developments and supporting institutions in building resilient, risk-aware audit and compliance programs.

Our team brings deep expertise in FFIEC compliance, BSA/AML reviews, and IT risk assessments — with a focus on helping institutions meet rising expectations while staying operationally resilient.

To learn how NETBankAudit can support your institution in navigating emerging data governance risks, complete our form here.

References

"US financial groups call for reforms in regulators’ handling of sensitive data," Retail Banker International, June 10, 2025.
"Interagency Guidance on Third-Party Relationships: Risk Management," Federal Deposit Insurance Corporation, June 2023.
"Harmonization of Cyber Incident Reporting to the Federal Government," Cybersecurity and Infrastructure Security Agency (CISA), June 2023.
"Proposed Rule on Confidential Supervisory Information," Consumer Financial Protection Bureau, May 2025.
Joint Trades Letter to Treasury Secretary Scott Bessent, June 9, 2025.

 
class SampleComponent extends React.Component { 
  // using the experimental public class field syntax below. We can also attach  
  // the contextType to the current class 
  static contextType = ColorContext; 
  render() { 
    return <Button color={this.color} /> 
  } 
}