The Federal Financial Institutions Examination Council, or FFIEC, on Wednesday issued guidance to provide financial institutions with examples of effective authentication and access risk management principles and practices. The guidance is intended for customers, employees and third parties accessing digital banking services and information systems.

Among the key elements, the guidance:

• highlights the current cybersecurity threat environment including increased remote access by customers and users, and attacks that leverage compromised credentials; and mentions the risks arising from push payment capabilities;
• recognizes the importance of the financial institution’s risk assessment to determine appropriate access and authentication practices to determine the wide range of users accessing financial institution systems and services;
• supports a financial institution’s adoption of layered security and underscores weaknesses in single-factor authentication;
• discusses how multi-factor authentication or controls of equivalent strength can more effectively mitigate risks; and
• includes examples of authentication controls, and a list of government and industry resources and references to assist financial institutions with authentication and access management.

The guidance replaces previous documents issued in 2005 and 2011, according to the FFIEC. The FFIEC is made up of representatives from the NCUA, Federal Reserve, FDIC, OCC and the SLC. The guidance can be accessed on the FFIEC website.