Banking
Security records built for bank examinations.
Security built for how banks are examined
Banks need to protect customer information, keep services available and explain their decisions. A usable security record connects activity across systems with the investigation and approvals that followed.
Evidence
| Rule | What the examiner asks | Supporting record |
|---|---|---|
| DORA RTS 2024/1774, Art. 12 | Log listed events; detect logging failures. | Collection from connected systems, with an alert if one goes silent. → |
| DORA RTS 2024/1774, Art. 12 | Logs protected against tampering and deletion. | Signed, chained logs and a standalone verifier. → |
| DORA Art. 10 | Promptly detect anomalous activity. | Correlation alerts, plus near-hourly behavior baselines. → |
| Model risk guidance, Apr 2026 | How a model was validated. | Each detector’s testing and promotion, recorded. → |
| 23 NYCRR 500.17 | Notice within 72 hours; 24 after a ransom. | A case timeline and report. → |
| 23 NYCRR 500.17 | Executive compliance reporting. | Control-review evidence and documented approvals. → |
NYDFS 500.6
An audit trail should let an examiner reconstruct relevant activity and check the integrity of the record. Central logging in a SIEM and signed exports support that work, with retention set for the records and requirements in scope.
Incident Notification Rule
The federal rule requires notice as soon as possible, and no later than 36 hours after determining that a notification incident occurred. A dated incident record helps the bank establish what it knew, when it knew it and who made the reporting decision.
DORA Article 10
Core banking and payment records provide context that network alerts alone cannot. Connecting those records with account and infrastructure activity helps the team investigate anomalies and maintain an evidence trail for DORA-related review.
NYDFS 500.17
The CISO and executive reviewers need evidence of how controls operated and how exceptions were handled. SOAR workflow approvals contribute to that history, alongside the broader records used for NYDFS 500.17 reporting.
By rule
DORA RTS 2024/1774, Art. 12
Log listed events; detect logging failures. Collection-health monitoring in a SIEM shows when a source stops reporting and helps the team investigate the gap.
DORA RTS 2024/1774, Art. 12
Logs protected against tampering and deletion. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
Model risk guidance, Apr 2026
How a model was validated. Shadow evaluation and recorded release decisions show how the detector was assessed before production use.
Questions
Does it read our core systems?
Start with the audit files, database records or interfaces the core system provides. A sample-based integration review establishes collection and parsing before the system is added to monitoring.
What about our branches?
Local buffering in the SIEM agent can preserve logs during a connection outage and forward them when the link returns. Source health in a SIEM shows which branches are reporting and where the record is delayed.
Are sign-ins and network traffic in one place?
A SIEM can bring the available identity and network records into one investigation timeline, with threat intelligence and historical context for review.
Who approves an action?
The organization defines who may approve each response. A SOAR workflow presents the decision to that person and retains the approval, action and outcome.
What stays with the bank?
The bank owns its reporting, executive attestations and model-risk decisions. Monitoring and workflow tools provide evidence those decisions can use.
Guide
What cybersecurity rules apply to banks?
Requirements depend on the bank’s charter, location and activities. Relevant examples include the federal Computer-Security Incident Notification Rule, NYDFS Part 500 and the EU’s DORA.
What is the best SIEM for banks?
Choose against the bank’s actual sources and review needs: core banking and payment records, usable retention, collection health and evidence that can be checked independently. Test the daily investigation work as well as reporting.
How do banks meet NYDFS 500.6 audit trail rules?
Define the transactions and cybersecurity events that need a record, then preserve and review the relevant trails for the applicable periods. Integrity checks help show that the retained evidence has not changed.
How ARRTECH takes care of banking security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
