FCA Cyber Risk Management

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-01-01 Cyber Risk Management rule (12 CFR part 609) takes effect
2. 2023-12-11 FCA published the Cyber Risk Management final rule (88 FR 85832)

1. 2023-12-11
   Cyber Risk Management final rule (88 FR 85832) Major versionCurrent

   Rescinded and revised the part 609 electronic commerce rules, renamed the part "Cyber Risk Management" and required a written cyber risk management program; effective 1 January 2025. source

   More

   • The board, or a board committee, must approve the written program each year and oversee it.
   • The program needs an annual risk assessment, vulnerability remediation, an incident response plan, training and vendor management.
   • Institutions must notify FCA no later than 36 hours after determining that an incident has occurred.
   • The business plan must include a technology plan that assesses the cyber risk management program.
2. 2022-07-28
   Cyber Risk Management proposed rule Draft

   FCA proposed replacing its electronic commerce rules in part 609 with cyber risk management requirements. source

Applies to every Farm Credit System institution, with a program scaled to the institution's size, risk profile and complexity.

Who

Each System institution must implement a comprehensive, written cyber risk management program consistent with the size, risk profile and complexity of its operations. source

What it protects

The security and confidentiality of current, former and potential customer and employee information, against reasonably anticipated threats and unauthorized access or use. source

Board duties

Each year the board or a board committee must approve the written program, oversee it and decide the expertise needed to run it; management reports to the board at least quarterly. source

Incident reporting

The incident response plan must provide for notifying FCA as soon as possible or no later than 36 hours after the institution determines that an incident has occurred. source

Vendors

Institutions must perform due diligence in selecting vendors, assess risk for all vendors and monitor their IT and cyber risk management vendors. source

Business plan

The annual business plan must include a technology plan with goals, budget and an assessment of the adequacy of the whole cyber risk management program. source

Institutions test their own controls through independent testers, and FCA examiners review the program as part of examination.

Control testing

Key controls must be tested regularly at a frequency set by the risk assessment, by independent third parties or by staff independent of those who run the program. source

Annual risk assessment

The program must include an annual risk assessment, and the incident response plan must be reviewed at least annually. source

Examination

FCA examiners review cyber risk management programs much like other internal control programs, including the written program, incident response plan and risk assessments. source

Examination manual

FCA's examination manual section 31.7, Information Technology & Security, guides how examiners evaluate IT and security processes and internal controls. source

FCA can issue orders and assess daily civil money penalties for violations of the Farm Credit Act or its regulations.

Notice and hearing

Before assessing a penalty FCA must notify the institution or person and seek their views, and it weighs financial resources, good faith, gravity and history of violations. source

Published actions

FCA publishes notices of enforcement actions it has issued under section 5.65(d) of the Farm Credit Act. source

1. Law text 12 CFR part 609 – Cyber Risk Management
2. Law text Cyber Risk Management final rule (11 December 2023)
3. Law text Cyber Risk Management proposed rule (28 July 2022)
4. Law text 12 CFR 622.61 – Inflation-adjusted civil money penalties
5. Guidance FCA notices of enforcement actions

1. FTC Safeguards Rule

   The FTC Safeguards Rule covers non-bank financial institutions under the FTC; FCA's rule covers only Farm Credit System institutions and adds a 36-hour notice to FCA.

2. NYDFS Part 500

   NYDFS Part 500 binds entities licensed by New York's financial regulator; FCA's rule binds the federally chartered Farm Credit System.

3. SEC Cybersecurity

   The SEC rules require public companies to disclose material cyber incidents to investors; FCA's rule sets program and supervisory-notice duties for Farm Credit institutions.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to FCA Cyber Risk Management (RSS)