Financial
Compliance-ready IT for banks and businesses that take cards
Whether you face an FDIC exam or a PCI DSS questionnaire, the work is the same: firewalls, patching, MFA, monitoring and the records to prove it. Palatinis manages and documents those controls so your team can focus on your customers.
- Community banks
- Credit unions
- Accounting & tax firms
- Insurance agencies
- Retail & restaurants
- E-commerce
- FFIEC exam support
- PCI DSS readiness
What Is the FFIEC IT Exam?
Every FDIC-supervised bank goes through an IT examination as part of its regular safety and soundness exam. Examiners measure your technology program against standards set by the FFIEC. This guide explains what they look for, what changed recently and where Palatinis fits.
Key takeaways
- The FFIEC IT Examination Handbook is the standard examiners use. The FDIC applies it through its InTREx exam procedures and rates you on a 1–5 scale.
- The FFIEC Cybersecurity Assessment Tool (CAT) was retired on August 31, 2025. Banks now assess themselves with frameworks such as NIST CSF 2.0.
- Banks must notify the FDIC within 36 hours of a significant computer-security incident, and their technology providers, including MSPs, must notify the bank.
The FFIEC explained
The Federal Financial Institutions Examination Council (FFIEC) is an interagency body that sets uniform examination standards for U.S. financial institutions. Its members are:
State-chartered banks that aren't Fed members
National banks and federal savings associations
State member banks and holding companies
Federally insured credit unions
Consumer financial protection
State banking regulators
The FFIEC doesn't examine banks itself. It publishes the IT Examination Handbook, a set of booklets that each agency's examiners use. The booklets cover Information Security; Architecture, Infrastructure, and Operations; Business Continuity Management; Management; Audit; Development, Acquisition, and Maintenance; Outsourcing Technology Services; and payment systems.
Behind the handbook sits the law. The Gramm-Leach-Bliley Act (GLBA) requires a written information security program, and the agencies' Interagency Guidelines Establishing Information Security Standards spell out what that program must include.
How the FDIC examines IT
The FDIC reviews technology during each safety and soundness exam, generally every 12 to 18 months. Its examiners use the Information Technology Risk Examination (InTREx) program, introduced in 2016 and last revised in 2023 to add the incident notification rule and more on service provider oversight.
Before the exam, the bank completes an IT profile describing its systems, vendors and risk. Examiners then review four areas and assign a rating under the Uniform Rating System for Information Technology (URSIT):
- Audit: independent review and testing of IT controls
- Management: board oversight, risk assessment, policies and vendor management
- Development and Acquisition: how systems are selected, configured, changed and patched
- Support and Delivery: day-to-day operations, security, continuity and incident response
The IT rating feeds into the bank's overall CAMELS rating, so technology findings can affect the whole exam.
Why it matters
Findings carry weight
Weak IT ratings lead to matters requiring board attention, follow-up exams and, in serious cases, formal enforcement actions. They also take management time away from running the bank.
Small banks are targets
Ransomware, business email compromise and wire fraud hit community banks because they hold money and often run lean IT teams. Examiners know this and expect controls in line with your risk.
Your vendors are your risk
Examiners expect you to oversee every third party that touches your systems or customer data, including your core processor, cloud services and IT provider.
Insurers ask the same questions
Cyber insurance carriers want MFA, EDR, tested backups and training, the same controls examiners review.
The 12 control areas
Most IT exam findings at community banks come from the same 12 areas. For each one, here's what your examiner expects to see and how we take the work off your team's plate.
Governance and oversight
Information security program and risk assessment
A board-approved security program, a current IT risk assessment and an annual report to the board.
Third-party risk management
Due diligence before contracting, contract terms that protect the bank and ongoing monitoring of each vendor.
Security awareness training
Ongoing training for employees and directors, including phishing and social engineering.
Systems and change
Asset inventory
A complete list of hardware, software, data and connections, used to drive the risk assessment.
Secure configuration and change management
Hardened baselines and documented, approved changes to production systems.
Patch and vulnerability management
Timely patching of operating systems and applications, and regular vulnerability scanning with tracked remediation.
Operations and security
Authentication and access control
Under the FFIEC's 2021 authentication guidance, MFA and least privilege for employees, administrators, customers and vendors, based on risk.
Network security and segmentation
Layered defenses at the perimeter and inside the network, with sensitive systems separated from the rest.
Malware protection and monitoring
Endpoint protection on every system and timely detection of malicious activity.
Logging and log review
Security logs collected from key systems, protected from tampering and reviewed.
Business continuity and backup
A business impact analysis, offline or immutable backups, and testing that shows you can actually recover.
Incident response and notification
A tested incident response plan that covers the 36-hour regulator notice, customer notice and law enforcement contact.
What's changed
- The CAT is gone (August 31, 2025). The FFIEC retired its Cybersecurity Assessment Tool. Banks can choose their own framework. Common choices are NIST CSF 2.0, CISA's Cybersecurity Performance Goals, the CIS Controls and the CRI Profile.
- 36-hour incident notification (2022). Banks must notify their primary federal regulator within 36 hours of determining a notification incident occurred. Bank service providers must notify their bank customers as soon as possible when an incident has disrupted, or is likely to disrupt, services for four hours or more.
- Authentication guidance (2021). Replaced the 2005 and 2011 guidance. MFA is expected for high-risk users, including employees, administrators and third parties, not only online banking customers.
- Third-party risk guidance (2023). The FDIC, Federal Reserve and OCC issued joint guidance on managing third-party relationships across their full life cycle.
- Development, Acquisition, and Maintenance booklet (2024). The most recently revised handbook booklet, covering secure system and software life cycles.
Preparing for your IT exam
- Update your IT risk assessmentReflect new systems, vendors and threats since the last exam.
- Refresh your asset inventory and diagramsMake sure what's on paper matches what's on the network.
- Map controls to a frameworkWith the CAT retired, choose a framework such as NIST CSF 2.0 and document where you stand.
- Close open findingsShow what you did about the last exam's and last audit's findings, with evidence.
- Review your vendorsCollect SOC reports, contracts and monitoring notes for each critical provider.
- Test recovery and responseRun a backup restore test and an incident tabletop, and keep the results.
- Complete the IT profileAnswer the FDIC's pre-exam request accurately and on time.
- Report to the boardMake sure board minutes show security oversight, not just approval.
Your MSP as a bank service provider
When an MSP manages a bank's systems, it becomes part of the bank's third-party risk. Examiners will ask how you chose your provider and how you monitor it. Expect to cover:
- How the provider protects your data and its own access to your network
- Insurance coverage, including cyber liability and errors and omissions
- Incident notification terms that meet the 36-hour rule
- Business continuity if the provider has an outage
- Your right to audit, and what happens to your data when the contract ends
Palatinis builds these terms into our Master Services Agreement and provides a due diligence package on request, so your vendor review doesn't hold up your exam.
Our services mapped to the FFIEC exam
Palatinis is a managed IT and security provider. We aren't an examiner or an independent auditor. We run and document the controls examiners review, and we work alongside your IT officer and auditors.
| Service | What you get | Control areas |
|---|---|---|
| “Hastati” – Managed Endpoints | Managed EDR with 24/7 monitoring, web traffic controls, automated patching, asset inventory | 3, 4, 6, 7, 9 |
| “Fortress” – Managed Firewalls | Firewall management, rule reviews, VPN, logging | 5, 8, 10 |
| “Roads” – Managed Switches | Switch management and network segmentation | 8 |
| “Foundation” – Managed Servers | Server hardening, patching, backups and logging | 4, 5, 6, 10, 11 |
| Security assessment | Active Directory security review, firewall review, MFA verification | 1, 7, 8 |
| Engineering | Risk assessment input, IR planning, vendor reviews, exam prep | 1, 2, 11, 12 |
Why community banks work with us
One team accountable for everything
Your workstations, servers, switches and firewalls are managed by one team under one agreement. When something breaks, there's no finger-pointing between vendors, and one call gets it fixed.
Security comes standard
Every managed device gets 24/7 threat monitoring, web traffic controls and automated patching from day one. These aren't add-ons you have to remember to buy.
Exam-ready documentation
Patch reports, asset inventories, network diagrams and change records are produced as we work, so pulling evidence for your examiner takes minutes, not weeks.
Vendor relationships that save you time
We're a registered partner with Microsoft, Cisco, HPE, Juniper and Palo Alto Networks, so we can source, deploy and support the equipment your bank already runs.
FFIEC FAQ
Do we still need to complete the FFIEC CAT?
No. The FFIEC retired the Cybersecurity Assessment Tool on August 31, 2025. It was always voluntary. Examiners still expect you to assess your cybersecurity, and most banks now use NIST CSF 2.0 or a similar framework.
What is InTREx?
The FDIC's Information Technology Risk Examination program, the procedures FDIC examiners use to review IT at the banks they supervise.
What is URSIT?
The Uniform Rating System for Information Technology. Examiners rate audit, management, development and acquisition, and support and delivery, then assign a composite IT rating from 1 (strong) to 5 (critically deficient).
Who examines credit unions?
The NCUA, using the same FFIEC handbook. Its own examination tools differ from the FDIC's, but the controls in this guide apply.
What counts as a notification incident?
A computer-security incident that the bank believes in good faith could materially disrupt or degrade its operations or ability to serve customers. Ransomware on core systems is a typical example.
Can the FDIC examine our IT provider?
Under the Bank Service Company Act, regulators have authority to examine services performed for a bank. In practice they focus on large technology service providers, but they'll review how you oversee every provider.
How does GLBA relate to the FFIEC?
GLBA requires financial institutions to protect customer information. The banking agencies' Interagency Guidelines put that into specific requirements, and the FFIEC handbook explains how examiners assess them.
Can Palatinis guarantee a good exam rating?
No one can. Ratings depend on your whole program, including board oversight and audit. We make sure the technical controls we manage are in place, documented and easy to show examiners.
This guide is general information based on the FFIEC IT Examination Handbook and FDIC guidance as of October 2026. It isn't legal or regulatory advice. Your examiners and auditors set your specific expectations.
What Is PCI DSS?
If your business takes credit or debit cards, you agreed to protect that card data when you signed with your payment processor. PCI DSS is the rulebook for how. This guide explains the standard in plain language and shows where Palatinis can carry the load.
Key takeaways
- PCI DSS applies to every business that stores, processes or transmits cardholder data, from a single-register shop to a national chain.
- Version 4.0.1 is the current standard. Its newer requirements, including MFA for all access to card systems, became mandatory on March 31, 2025.
- Most small merchants validate with a Self-Assessment Questionnaire, but the security work behind it is the same: firewalls, patching, MFA, logging and testing.
PCI DSS explained
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements created by the major card brands (Visa, Mastercard, American Express, Discover and JCB) and maintained by the PCI Security Standards Council.
It isn't a law. It's a contractual obligation that comes with your merchant agreement. Your acquiring bank or payment processor decides how you prove compliance and can apply fees, raise rates or end the relationship if you don't.
The standard protects cardholder data (the card number, name, expiration date and service code) and sensitive authentication data (the full magnetic stripe, CVV code and PIN). The systems that touch this data, plus anything connected to them, make up your cardholder data environment (CDE).
Why compliance matters
Breaches land on small businesses
Point-of-sale malware, skimmers and stolen remote-access passwords target smaller merchants because their defenses are thinner. One compromised register can expose every card swiped for months.
The costs stack up
After a breach, a merchant can face forensic investigation costs, card replacement charges, processor penalties, higher transaction fees and a loss of the ability to accept cards at all.
Insurers and customers check
Cyber insurance applications ask about MFA, patching and endpoint protection, the same controls PCI DSS requires. Customers increasingly ask too, especially in healthcare, professional services and B2B sales.
It's a good security baseline
Even outside card data, the 12 requirements describe a solid security program. Doing them well protects payroll, client files and email as well.
Who must comply
Every merchant and service provider that handles card data. How you prove compliance depends on your transaction volume. Visa's merchant levels are the most common reference:
| Level | Annual Visa transactions | Typical validation |
|---|---|---|
| Level 1 | Over 6 million | On-site audit by a Qualified Security Assessor (QSA) and a Report on Compliance (ROC) |
| Level 2 | 1 to 6 million | Self-Assessment Questionnaire (SAQ), sometimes a QSA |
| Level 3 | 20,000 to 1 million e-commerce | SAQ plus quarterly external scans |
| Level 4 | Under 20,000 e-commerce, or up to 1 million total | SAQ, as directed by your acquirer |
Most local businesses are Level 4. Your SAQ type depends on how you take cards:
| SAQ | Who it's for |
|---|---|
| A | Card-not-present merchants that fully outsource payment pages (hosted checkout) |
| A-EP | E-commerce sites that control part of the payment page |
| B / B-IP | Standalone dial-out or IP-connected payment terminals |
| C-VT | Manual entry into a processor's web-based virtual terminal |
| C | Payment applications connected to the internet, such as a POS system |
| P2PE | Validated point-to-point encrypted terminals only |
| D | Everyone else, including merchants that store card data and all service providers |
The 12 requirements
PCI DSS groups 12 requirements under six goals. For each one, here's what your business needs to have in place and how we take the work off your plate.
Build and maintain a secure network
Install and maintain network security controls
Firewalls and router rules that keep the card environment separate from everything else, with documented rules and regular reviews.
Apply secure configurations to all system components
No default passwords, unnecessary services turned off and a hardening standard for every device.
Protect account data
Protect stored account data
Store as little card data as possible, never store CVV or PIN after authorization, and encrypt or mask anything you keep.
Protect cardholder data with strong cryptography during transmission
Card data crossing public networks must be encrypted with current protocols such as TLS 1.2 or higher.
Maintain a vulnerability management program
Protect all systems and networks from malicious software
Anti-malware on every system at risk, kept current, plus protection against phishing.
Develop and maintain secure systems and software
Install critical security patches promptly and protect public-facing web applications.
Implement strong access control measures
Restrict access by business need to know
Only the people whose job requires it can reach card systems and data.
Identify users and authenticate access
Unique IDs for everyone, strong passwords (12 characters minimum in v4.0) and MFA for all access into the card environment.
Restrict physical access to cardholder data
Secure the places where card data lives, and regularly inspect card terminals for tampering and skimmers.
Regularly monitor and test networks
Log and monitor all access to system components and cardholder data
Keep audit logs, review them for suspicious activity and retain them for at least a year.
Test security of systems and networks regularly
Quarterly internal and external vulnerability scans, annual penetration testing and wireless checks.
Maintain an information security policy
Support information security with organizational policies and programs
Written security policies, annual risk assessment, security awareness training, vendor management and an incident response plan.
What changed in v4.0
PCI DSS v3.2.1 was retired on March 31, 2024. The future-dated requirements in v4.0 became mandatory on March 31, 2025. The changes small merchants notice most:
- MFA everywhere in the CDE. Multi-factor authentication is required for all access into the card environment, not only remote access.
- Longer passwords. A 12-character minimum, up from 7.
- Phishing defenses. Technical controls to detect and protect against phishing, plus training that covers it.
- Authenticated internal scans. Internal vulnerability scans must log in to systems to find more issues.
- Targeted risk analysis. You document why you chose certain frequencies, such as how often you review logs.
- Payment page script control. E-commerce sites must inventory and monitor scripts on payment pages.
Preparing for a PCI DSS assessment
- Confirm your level and SAQ typeAsk your processor which questionnaire applies, and how you take cards today.
- Map your card dataFind every system that stores, processes or transmits card data, and everything connected to them.
- Reduce scopeSegment the network, switch to hosted checkout or P2PE terminals, and delete stored card data you don't need.
- Run a gap analysisCompare your current controls against each requirement in your SAQ.
- RemediateFix the gaps, starting with MFA, patching, firewall rules and endpoint protection.
- DocumentWrite the policies, network diagrams and inventories the SAQ asks you to attest to.
- Scan and testComplete internal scans and passing quarterly external ASV scans.
- Complete and submitFinish the SAQ and Attestation of Compliance (AOC), then submit to your acquirer.
- Stay compliantCompliance is continuous. Keep patching, scanning, reviewing logs and training staff all year.
Our services mapped to PCI DSS
Palatinis is a managed IT and security provider, not a QSA or ASV. We do the technical work and documentation that make your assessment straightforward, and we work alongside your assessor and scanning vendor.
| Service | What you get | Requirements |
|---|---|---|
| “Hastati” – Managed Endpoints | Managed EDR with 24/7 monitoring, web traffic controls, automated patching, asset inventory | 2, 5, 6, 8, 10 |
| “Fortress” – Managed Firewalls | Firewall management, rule reviews, VPN, logging | 1, 4, 10, 11 |
| “Roads” – Managed Switches | Switch management and VLAN segmentation | 1 |
| “Foundation” – Managed Servers | Server hardening, patching, access and log management | 2, 6, 7, 10 |
| Security assessment | Active Directory security review, firewall review, MFA verification | 1, 3, 7, 8 |
| Engineering | Scope reduction, scanning, policies, SAQ preparation | 3, 9, 11, 12 |
Why businesses work with us
One team accountable for everything
Your registers, office PCs, servers, switches and firewalls are managed by one team under one agreement. When something breaks, there's no finger-pointing between vendors, and one call gets it fixed.
Security comes standard
Every managed device gets 24/7 threat monitoring, web traffic controls and automated patching from day one. These aren't add-ons you have to remember to buy.
Evidence for your questionnaire
Patch reports, asset inventories, network diagrams and firewall rule reviews are produced as we work, so completing your SAQ means pulling reports, not starting from scratch.
Vendor relationships that save you time
We're a registered partner with Microsoft, Cisco, HPE, Juniper and Palo Alto Networks, so we can source, deploy and support the equipment you run.
PCI DSS FAQ
Does PCI DSS apply if I use Square, Stripe or Clover?
Yes. Using a payment provider shrinks your scope a lot, often down to SAQ A or a short SAQ B, but you still have to complete your questionnaire and secure the devices and network your staff use.
What is a QSA?
A Qualified Security Assessor is a company certified by the PCI Security Standards Council to perform official assessments. Large merchants need one. Most small merchants self-assess instead.
What is an ASV scan?
An external vulnerability scan of your internet-facing systems, run by an Approved Scanning Vendor. Many SAQs require a passing scan every quarter.
What is the Attestation of Compliance (AOC)?
A signed form, submitted with your SAQ or ROC, in which you state that you meet the requirements that apply to you.
What is the cardholder data environment (CDE)?
The people, processes and systems that store, process or transmit card data, plus any systems connected to them. Network segmentation keeps it small.
What are compensating controls?
Alternative controls you can use when a requirement can't be met as written, as long as they meet its intent and you document the risk analysis.
Is PCI DSS a law?
No. It's a contractual standard enforced by the card brands through your acquirer. Some states reference it in data security laws, and breach notification laws still apply.
Can Palatinis certify me as PCI compliant?
No. Only you (through an SAQ) or a QSA (through a ROC) can attest to compliance. We implement and maintain the controls, prepare documentation and help you complete the questionnaire.
This guide is general information based on PCI DSS v4.0.1 and isn't legal advice. Your acquiring bank or payment processor sets your specific validation requirements.