EXAMINATION AND EVIDENCE READINESS
An examination date, or a finding with a response deadline.
A date on the calendar and a budget that moved ahead of it, or a finding with a deadline and approved money. Both need dated, owned evidence and a plan somebody can sign.
Your supervisor, and what you are examined against.
Examiner means at least six bodies here.
| If you are | Your supervisor | Examined against | Limit |
|---|---|---|---|
| A national bank or federal savings association | The OCC | The Interagency Guidelines, 12 CFR Part 30 Appendix B, and the FFIEC IT Examination Handbook | No size threshold. The program is scaled, not excused. |
| A state member bank | The Federal Reserve and your state | The Interagency Guidelines, 12 CFR Part 208 Appendix D-2, and the Handbook | As above. |
| A state nonmember bank | The FDIC and your state | The Interagency Guidelines, 12 CFR Part 364 Appendix B, and the Handbook | As above. |
| A federal credit union | The NCUA | 12 CFR Part 748 Appendix A and B, through the Information Security Examination | No asset size exemption. NCUA is your supervisor, not a federal banking agency. |
| A federally insured state chartered credit union | The NCUA and your state supervisory authority | As above | As above. |
| An insurance licensee | Your state department of insurance | Market conduct examination, with financial condition as a separate track | No threshold. Frequency and scope are risk based. |
| A nonbank mortgage company | State financial regulators | A state examination, under the licensing framework the SAFE Act established | The SAFE Act imposes no cybersecurity obligation. Its relevance is structural. |
| A New York licensee, in addition | NYDFS | 23 NYCRR Part 500 | The 500.19(a) limited exemption applies on any one of three tests, set out on Mortgage. |
In Louisiana the state examiner, for a licensed mortgage company and alongside the federal supervisor of a state chartered bank or credit union, is the Louisiana Office of Financial Institutions. Each instrument in full: Financial Services, Mortgage, Insurance.
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
A New York authorization adds a second examination.
- Reaches
- Holders of a DFS license, registration, charter or similar authorization.
- Not
- A firm whose only link is a New York customer.
- Exempt
- Any one of three 500.19(a) tests, set out on Mortgage, removes the requirements that section lists; never the 72 hour or 24 hour notices in 500.17.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What is asked for, in order, and what answers it.
Published procedures make the list knowable.
| Asked for | What answers it |
|---|---|
| The written program | The document and the board minute approving it, together |
| The risk assessment | The assessment and the date it was last performed |
| Evidence the named controls operate | A sample of evidence from the period under examination, not a screenshot taken last week |
| The testing record | The report, its scope statement and who performed it |
| The vendor file | A documented review, a documented decision and an identifiable decision maker |
| The incident response plan | The plan and evidence it has been exercised |
| The annual report to the board | The report and the minute that records it |
| The exception register | Owners and review dates |
Most institutions hold the control; the failure is rarely an absent control. It is evidence unstructured, undated or owned by nobody, found when someone outside asks inside a fixed window. We build the four evidence layers of the Security Assessment against it.
A model's record joins the same file
Two rows above already reach AI. A vendor's new AI feature stays in the same vendor file, and where a system shapes a regulated decision, the operating evidence is its approval record, monitoring output and mapping to the reason given. Same test: dated, findable, owned, refreshed. The work: AI in Regulated Decisions and the AI Governance Program.
What a finding is called, and what follows.
| Finding | Issued by | Record and consequence |
|---|---|---|
| Matter Requiring Attention | Bank supervisor | A deficient practice management is expected to correct. A written response and a commitment date. |
| Matter Requiring Immediate Attention | Bank supervisor | The more serious form, addressed before the next cycle. Response and review run tighter. |
| Document of Resolution | NCUA | What the credit union agreed to do and by when, the board accountable. |
| Market conduct criticism | State insurance department | How the company treats consumers, not whether it is solvent. |
| State examination finding | State financial regulator | To a nonbank mortgage company, in the state's own form and timetable. |
Each sits beside a composite rating, and an IT rating for a depository, which shape the room a response has. This firm makes no claim to know how any institution has been rated.
What makes a corrective action plan credible.
- A named person per item: a department cannot say what it did last week.
- An achievable date per item, set by the work, not by appearances.
- An interim control where the fix is long.
- Evidence on each closure, or it reopens at the next examination.
- One person, not an item owner, accountable for the whole plan.
We help produce the plan, gather what each item needs and flag any date not achievable. Your own people own it and your own people sign it.
Where this firm stops.
Red Stick Solutions does not represent the institution to its regulator, does not negotiate with an examiner on its behalf, and does not attest that a finding is closed.
Findings on IT governance, vendor management or testing: the Security Assessment. Standing ownership afterward: Advisory and vCISO.
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Your date | Tell us the date. The first reply, within one business day, says whether we can meet it. |
| If it stops | You keep everything produced to that point, in the form it is in that day. |
Tell us the date, or send us the finding.
Say which supervisor is coming and when, or what the finding names and its due date. Response work is usually funded outside the annual IT plan, so the number must arrive early.
- Unit
- Written scope for your date or finding: first conversation
- Fee
- In writing once a written scope is agreed, before you sign or grant access.
- Duration
- Elapsed time and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.