Cyber Security for Financial Services: Rules and Cost

A retailer that loses customer records loses records. A financial institution that loses control of a system can lose the money in the same hour, and every sensible security decision in this sector starts from that difference. It is also the only kind of business in the United States that gets a federal security rule written for its data, a supervisor who turns up to examine it against that rule, and a breach clock measured in hours. Those three together make defending a community bank, a credit union, an investment adviser or a four-person mortgage brokerage a different job from defending a manufacturer of the same size, even though the attacks at the front door look identical.

Why Cyber Security for Financial Services Is Different

Three things separate this sector, and the spending order follows from them rather than from any threat list.

The first is that the data has a named legal standard attached. Most companies decide for themselves what reasonable security means. A financial institution does not, and which standard applies depends on its regulator: the Federal Trade Commission for non-bank firms, the federal banking agencies for banks, the Securities and Exchange Commission for broker-dealers and advisers, and a state department of financial services on top.

The second is that the asset is liquid. A stolen retail record is worth something once it is resold. A stolen banking session, a compromised payment instruction or a set of account and routing numbers is worth something immediately, without a buyer, which is why fraud prevention and information security are one budget in this sector even when they sit in two departments.

The third is the clocks. Most breach laws give an organization thirty to sixty days. A bank has thirty six hours to tell its primary federal regulator and a New York licensee has seventy two hours to tell Albany, windows short enough that the work has to be done before the incident rather than during it.

The volume behind this is not a guess. FinCEN's analysis of Bank Secrecy Act reporting counted 4,194 ransomware incidents and more than $2.1 billion in payments between January 2022 and December 2024, and financial services paid more than any other industry, approximately $365.6 million across 432 incidents. Manufacturing had more incidents. Financial services paid more money.

Which Companies Count as Financial Institutions

Most readers get this wrong about their own company, and it is worth settling first.

The Gramm-Leach-Bliley Act reaches businesses engaged in activities that are financial in nature, which is much wider than the word bank suggests. The FTC's own guidance lists thirteen examples of a financial institution under section 314.2(h) of the Safeguards Rule: mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, and investment advisors. The 2021 amendments added finders, meaning companies that bring buyers and sellers together and leave the two of them to negotiate.

Which regulator applies decides which document to read. Banks, thrifts and federally insured credit unions answer to the federal banking agencies and the National Credit Union Administration. Broker-dealers, investment companies, registered investment advisers and transfer agents answer to the SEC. Anything licensed under New York's Banking Law, Insurance Law or Financial Services Law is a covered entity under 23 NYCRR Part 500 whoever else regulates it, which is why a Texas firm with a New York license runs two rulebooks. Card data adds a contractual layer, because PCI DSS applies to anyone storing or transmitting card numbers and the card brands enforce it rather than a government.

What the GLBA Safeguards Rule Requires

The rule is short, and it is written as obligations rather than as a product list, which is what gives a small firm room to spend sensibly.

Three specifics decide most of the spending, and all three are unusually concrete for a federal rule.

Multi-factor authentication is required outright, not recommended. The rule tells a covered firm to implement it for anyone accessing customer information, using at least two of a knowledge factor, a possession factor and an inherence factor. New York goes further: section 500.12(a) requires multi-factor authentication for any individual accessing any information system, not only for remote access, unless the entity qualifies for the limited exemption.

Encryption is also required rather than addressable. The FTC's wording is to encrypt customer information on your system and in transit, and where that is infeasible, to use effective alternative controls approved in writing by the qualified individual, so there is no version of compliance where nobody looks at the question. Encrypting customer records at rest and on anything portable also does a second job, because the FTC's reporting obligation attaches to unencrypted customer information.

Testing is specified in a way that carries a price tag. A firm either runs continuous monitoring, or it runs an annual penetration test alongside vulnerability assessments including system-wide scans every six months. Those are different budgets, and choosing between them is the first real decision a small financial institution makes.

What Financial Data Is Worth to an Attacker

A payment card is cancelled in hours and reissued in days. Almost nothing else a financial institution holds works that way.

An account number and a routing number stay attached to the account for its life, and changing them means changing every direct deposit, standing payment and payee record connected to it. A Social Security number is permanent. Income figures, tax documents, loan applications and statements of assets stay accurate for years. Transaction history is the quietly dangerous one, because it turns a cold call into a convincing one: somebody who can name your last three payees, the size of your mortgage payment and the day it leaves your account does not sound like a stranger.

The Cyber Attacks That Actually Hit Financial Institutions

Vendor pages list every threat that exists. The sector's own regulators publish what actually happened, and the shape is narrower.

Ransomware is first by money. FinCEN's Bank Secrecy Act analysis puts the peak in 2023 at 1,512 reported incidents and roughly $1.1 billion in payments, falling to 1,476 incidents and roughly $734 million in 2024 after law enforcement disrupted two major groups. The median single transaction was $124,097 in 2022, rose 41 percent to $175,000 in 2023, then settled at $155,257.

Payment fraud is first by frequency, and it rarely involves malware. Business email compromise aims at the person who approves a wire or updates a payee record, using a spoofed or genuinely compromised mailbox and an invoice that looks routine. Financial institutions are hit from both directions here: as the target, and as the place their customers' fraudulent transfers land.

Account takeover is third, and it scales. Attackers replay username and password pairs harvested from unrelated breaches against banking and brokerage logins, because reused passwords remain the norm. Credential stuffing is cheap enough to run at millions of attempts and only has to succeed occasionally to pay for itself, which is why login anomalies matter more here than in most sectors.

The chain that produces the largest losses is consistent enough to draw.

Distributed denial of service rounds out the list, used here both for extortion and as noise covering a fraud attempt while the security team watches a traffic graph.

How Fast a Financial Institution Has to Report a Breach

The reporting rules change behavior during an incident more than anything else in this sector's regulation, and they are the part most often discovered too late. Four clocks can run at once.

For a bank, the OCC and the other federal banking agencies require notice as soon as possible and no later than 36 hours after it determines a notification incident occurred, meaning one that disrupts or degrades, or is reasonably likely to disrupt or degrade, the viability of its operations. The rule reaches suppliers too: a bank service provider must alert a designated contact at the bank as soon as possible once it determines an incident has materially disrupted covered services, or is likely to, for four or more hours.

For a New York licensee, section 500.17(a)(1) requires notice to the superintendent no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider. Section 500.17(c) adds the sharpest requirement in American cyber security regulation: within 24 hours of an extortion payment, notice of the payment, and within 30 days a written description of why payment was necessary, what alternatives were considered and what sanctions diligence was done.

For a non-bank firm under the FTC, the trigger is a notification event, defined as an acquisition of unencrypted customer information without authorization. At 500 or more consumers it goes to the FTC within 30 days of discovery through the agency's online form. For broker-dealers, investment companies, registered investment advisers and transfer agents, the SEC's 2024 amendments to Regulation S-P require an incident response program and notice to affected individuals as soon as practicable, and not later than 30 days after becoming aware of unauthorized access.

Two consequences follow for anyone drafting a written incident response plan here. Thirty six hours is not thirty six hours of investigation, because a determination, a form and an authorized signature all have to fit inside it. And an incident at a vendor starts your clock without ever touching your network.

What Cyber Security Costs a Bank or Credit Union

This is the section the vendor guides skip.

Start with what the sector says about itself. In the 2025 CSBS Annual Survey of Community Banks, cybersecurity was again the top internal risk, with 58 percent of community bankers calling it extremely important, ahead of every other risk by a clear margin. Technology and its cost came second, and regulation, tied as the top external risk a year earlier, fell to sixth. These bankers are not arguing about whether the threat is real. They are arguing about capacity.

Treasury has written that capacity gap down. Its report on artificial intelligence and cyber security in the sector found a widening gap between large and small financial institutions, with large firms building models in house while smaller ones lack the data and expertise, and a fraud data divide in which institutions without large historical fraud data sets cannot build comparable anti-fraud systems.

The examination landscape shifted underneath community institutions at the same time. The FFIEC sunset the Cybersecurity Assessment Tool on August 31, 2025, a decade after its 2015 release, pointing institutions instead toward the NIST Cybersecurity Framework 2.0, the CISA Cybersecurity Performance Goals, the Cyber Risk Institute profile and the CIS Critical Security Controls. A tool many small banks built their whole program around is gone, and choosing its replacement is now a governance decision rather than a download.

One honest budget lever sits in the rules rather than in a product, because both the FTC and New York scale obligations to size. The Safeguards Rule exempts firms holding customer information on fewer than five thousand consumers from certain provisions, and Part 500's limited exemption at section 500.19(a) applies to a covered entity with fewer than 20 employees and independent contractors, or less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets. Knowing which side of those thresholds you sit on is worth an hour before any purchase order goes out.

Third Party and Vendor Risk in Financial Services

Financial institutions run on other people's software: core processors, payment networks, loan origination platforms, statement printers, wealth management systems. Regulators know it, so vendor oversight is written into every rulebook.

The Safeguards Rule requires a firm to select service providers capable of maintaining appropriate safeguards, write those requirements into the contract, and keep monitoring them. The banking agencies put an obligation on the supplier itself, with that four-hour disruption trigger. New York's 72-hour clock counts an incident at a third-party service provider as the firm's own reportable event.

The practical control is a list: every vendor with access to customer information or to a system that touches it, what access each one has, who owns the relationship internally, and which of them are contractually required to call you. Most institutions find on the first attempt that the list is longer than expected and that several entries have nobody's name against them.

How to Secure a Financial Services Firm

In order, cheapest and most effective first. Each item maps to something a regulator has written down, which is what makes the spending defensible at examination.

When to Hire a Financial Services Cyber Security Firm

Hire when one of three things is true: nobody is watching the systems outside business hours, an examiner or a partner institution has asked a security question you cannot answer in writing, or something is happening now. Before that, the money goes further on the eight items above.

Ask for experience with your regulator rather than with security in general, a response retainer covering notification support and not only technical containment, and a clear answer on who drafts the 36 or 72 hour filing. Managed detection and response covers the overnight gap without hiring a team, and a fractional security officer can hold the qualified individual role at a firm too small to employ one.