OCC Updates Cybersecurity Supervision Work Program Structure and References

The Office of the Comptroller of the Currency (OCC) recently updated the structure and references of the OCC Cybersecurity Supervision Work Program (CSW) used by examiners. The update, announced in OCC Bulletin 2026-48 on September 21, 2026, is intended to keep the CSW aligned with the evolving National Institute of Standards and Technology (NIST) Cybersecurity Framework. The OCC did not add any new procedures in the update, nor did it change any of the procedures.

The CSW provides high-level examination objectives and procedures that are aligned with existing supervisory guidance and the NIST Cybersecurity Framework. The OCC stated that the CSW does not establish new regulatory expectations, and banks are not expected to use the work program to assess cybersecurity preparedness. The OCC continues to encourage, but does not require, the use of a standardized approach to assess and improve cybersecurity preparedness. Banks may choose from a variety of tools and frameworks available. The bulletin rescinds OCC Bulletin 2023-22, issued on June 26, 2023.

The update maintains alignment between the CSW structure and the evolving NIST Cybersecurity Framework. The CSW continues to enable risk-based examination scoping and is scalable for banks of different sizes and complexity. Examiners may use the CSW's examination procedures during examinations of a community bank's cybersecurity preparedness. The CSW Overview page on www.occ.gov links to the CSW References page, which provides cross-references that map the CSW procedures to existing supervisory guidance, examiner guidance, and industry cybersecurity frameworks, including the OCC Comptroller's Handbooks, FFIEC IT Examination Handbook, the Center for Internet Security Critical Security Controls, and the Cyber Risk Institute Profile.

What remains unknown is whether future updates to the CSW will introduce new procedures or change existing ones as cyber threats continue to evolve. The bulletin does not specify a timeline for the next revision, and it does not indicate whether the OCC will eventually require banks to adopt a standardized cybersecurity framework. Future changes to the CSW References page will be made available through www.occ.gov, but the OCC did not provide details on the frequency or scope of those changes.