Tuning-Up Your Bank Security Program

Given the increase in social unrest and the logistical challenges of COVID–19, banks should take a deep look at their overall security programs and consider giving them a thorough review and update. The bank’s security program considers a number of elements including, but not limited to, physical security, data security, employee security and coordination with law enforcement.  Banks should take a hard look at their overall security risk assessment and modify accordingly to address current circumstances.

Physical Security

The Bank Protection Act requires the Board to name a Security Officer and for the Security Officer to prepare an annual report to the board on the status and effectiveness of the bank’s security program. The requirements spelled out in the regulation are rather general in nature, however, best practice suggests the duties of the Bank Security Officer include:

1. Preparing an annual security risk assessment;
2. Engaging on new bank facilities projects to ensure security considerations are identified and addressed;
3. Ensuring employees receive appropriate [risk based] security training;
4. Coordination with law enforcement both before and after a security event;
5. Working with third party firms such as insurance companies to identify and reduce bank [security] risks;
6. Working with internal risk staff such as compliance, legal and audit to ensure that policies, procedures, training, and testing are in place to meet bank security requirements;

Both the COVID-19 crisis and the high volume of social unrest have changed the bank security landscape considerably.  

1. “Work from Home” has extended the bank“footprint” into a multitude of locations;
2. Bank facilities are operating under closed conditions, reduced hours, or limited access;
3. Normal work patterns and practices have changed considerably;

 Moreover, the external environment has changed considerably:

1. Many locales have seen an increase in property crimes against business, including banks;
2. Crimes such as ATM theft have increased;
3. Increased “social unrest” and calls to “de-fund”the police have impacted police operations, response times, and other activities in a number of jurisdictions;

Other Security Matters:

It is not just physical security that is impacted by these factors, there are numerous other impacted areas such as data security,employee security, and customer data. Since many organizations are operating in a radically different manner, consideration should be given to:

1. Data Security – ensuring virtual networks, bank systems and work processes are up to date with current security protocols,updated system patches, and other fixes such as VPN’s, increased use of multi-factor authentication, etc.
2. Virtual Meeting Management – Many of us are using systems such as ZOOM and Skype – ensure policies and procedures are in place to mandate that these be used in a secure and well controlled manner.Ensure frequent changes in passwords and “audit” the attendance of your meetings.
3. Employee Security Awareness – While working from home, ensure that work related conversations remain confidential and bank data is properly managed and secure.

Steps the Security Officer should take

In light of these risks and the volume of changes to the external environment, the Bank Security Officer should consider conducting a thorough reassessment of its overall risk profile and impact to operations. Factors to consider include, but are not limited to:

1. Prepare an updated Bank Security Risk Assessment to ensure the program is up to date with regard to potential bank risks and the corresponding risk response;
2. Conduct as-needed inspections of facilities and bank premises to ensure security protocols are up to date and commensurate with the increased risk profile;
3. Contact law enforcement to discuss any changes that may be needed and discuss factors such as response time, current changes to coverage, etc. Identify any significant trends or increased risks that they may be aware of.
4. Review and update employee training, policies,or procedures;
5. Coordinate with IT and data security to ensure that data security practices are up to date and that enhanced bank and customer data protections are in place in a “work from home environment.

‍