On August 29, the FDIC announced that the Federal Financial Institutions Examination Council (FFIEC) updated its examination handbook. These updates revised specific parts and renamed it from the “Development and Acquisition” booklet to the “Development, Acquisition, and Maintenance” (DA&M) booklet. These revisions ensured the booklet remained relevant amid ongoing technology changes in the financial services sector, focusing literally on the development, acquisition, and maintenance of information technology (IT) infrastructure to integrate these components within a business.

Significant updates to the DA&M booklet included the incorporation of cybersecurity throughout as well as new sections on governance, risk management, and common risk elements applicable to hardware and software technologies. The Common Risk Topics section will now cover a wide range of issues, such as licenses, secure development, data protection, and third-party relationship and supply chain risk management. The Development section has been expanded to include discussions on strategic IT planning, development standards and controls, and methodologies like “DevOps” and “DevSecOps.” This section will aim to integrate IT development with business functions to enhance service delivery to customers. The Acquisition section now covers acquisition policies, standards, procedures, and project management, providing detailed guidance on solicitation, evaluation and contractual agreements.

The Maintenance section has been updated to address key operational principles in IT environments, including preventative maintenance, change management and end-of-life considerations.

Throughout the booklet, the FFIEC has improved consistency and alignment with authoritative standards such as NIST, replacing “financial institutions” with “entities” to encompass third-party service providers and significant service providers, and included applicable joint/interagency guidance.