"Basic cyber hygiene prevents 98% of cyberattacks." That's a quote from former CISA Director Jen Easterly, and it's the foundation of a guide released by the Conference of State Bank Supervisors (CSBS) in December 2025.
The Fundamentals of Cyber Hygiene for Financial Institutions identifies 10 fundamental controls, grounded in existing FFIEC guidance, that community financial institutions should have in place to defend against common threats.
To help financial institutions put these controls into practice, the guide is structured around three key areas:
So, what does the guide say, and how should your institution use it? Let's take a look.
In this article we will cover the following:
The guide starts with a look at the current cyber threat environment. Some of the key threats covered include:
Some other threats covered include denial-of-service (DoS) attacks and corporate account takeover (CATO). This list might look familiar, and that's intentional. What makes it special is the source and the context.
An information security program that consistently implements and manages the ten fundamental controls is a practical response to this reality.
To defend against these threats, the guide identifies 10 cyber hygiene controls and practices. If you look at this list and think, "Wow. These look familiar." Great! (That's kind of the point.)
These controls aren't supposed to be new, but they are the ones that make a difference.
| Control | Description |
| Cybersecurity Awareness Training | Building a culture of security through regular, meaningful employee training |
| Data Backup Programs | Making sure critical data can actually be recovered when something goes wrong |
| End-of-Life (EOL) Management | Tracking and retiring unsupported assets that no longer receive security updates |
| Incident Response Programs | Having a tested, current plan for detecting, containing, and recovering from cyber incidents |
| IT Asset Management (ITAM) | Knowing what technology you have, where it lives, and how it connects to everything else |
| Event Logging & Threat Detection | Maintaining visibility into system events so you can identify and respond to suspicious activity |
| Multi-Factor Authentication (MFA) | Requiring more than a password to access systems and data |
| Vulnerability & Patch Management | Identifying and remediating software and hardware vulnerabilities before they get exploited |
| Threat Intelligence Programs | Gathering and acting on threat information before it becomes an incident |
| Third-Party Risk Management (TPRM) | Managing the security risks that come with your vendor and service provider relationships |
None of these are new concepts, and the guide is upfront about that. The guide's goal is to help you strengthen existing cyber hygiene practices, and provide a way to explain these controls to executive leadership.
The heart of the guide is a set of ten fact sheets, one for each fundamental control. Each fact sheet explains why the control matters, what a solid program looks like, and what FFIEC guidance says about it.
The fact sheets are written to be read by cybersecurity staff and senior management alike, without having to run it through your LLM of choice and say, "but make it conversational."
If you already have programs in place for these areas (which you probably do), the fact sheets aren't asking you to start over. Instead, they are written to help you improve the controls you already have in place.
A few areas worth paying special attention to:
The goal is to put controls in the context of modern, relevant threats. These are real actions you can take which have a real impact.
Pro Tip: The fact sheets also work well as communication tools. If you need to explain a cybersecurity investment to someone without a technical background, these resources are a great place to start.
Getting Board Members meaningfully engaged in cybersecurity can be a challenge. For this, each fact sheet is paired with a set of questions written specifically for Board members to ask. Each question comes with an explanation of why the control matters.
A few examples of where the questions get specific:
The goal of these questions is to create the kind of ongoing, top-down attention to cybersecurity that makes a real difference in the institution's cybersecurity posture.
Pro Tip: Consider sharing relevant Board questions from the guide with the Board before your next cybersecurity report. Better yet, use them to shape your own reporting. If you're already answering these questions proactively in your reports to the Board, you're demonstrating exactly the kind of oversight the regulators expect to see.
The purpose of the CSBS Cyber Hygiene Fundamentals for Financial Institutions is to help you determine if your key controls are doing what they're supposed to do. That's a harder question than it sounds, so if you're not sure where to focus, pick one fact sheet. Look honestly at your program against it, work through the Board questions, and find one place to improve this quarter. Then do it again and again.
If you're looking for a way to manage all of this in one place, Tandem is an information security GRC application built specifically for community financial institutions. From risk assessments and IT asset inventories to vendor management, phishing simulations, incident management, and beyond, Tandem is designed to help you stay on top of your key controls without reinventing the wheel every year.
Subscribe to the Tandem Blog to get monthly educational content on cybersecurity and compliance delivered straight to your inbox. And if you'd like to see Tandem in action, watch a demo at Tandem.App/Demos.
Q: Am I required to implement the controls in the CSBS Cyber Hygiene Guide?
A: This guide does not contain new regulatory requirements. However, the ten controls it covers are grounded in existing FFIEC guidance and regulatory standards, like GLBA.
Q: Will my examiners be looking for the CSBS Cyber Hygiene Guide to be implemented within my organization?
A: Examiners want to see evidence that key controls are implemented in a thoughtful, risk-based manner, and the Board is genuinely engaged in oversight. That means having things like documented policies and procedures, evidence of security testing, and Board reporting that reflects real understanding rather than checkbox compliance. The Board questions in the guide are a useful preview of the kinds of questions examiners may ask you.
Q: How does the CSBS Cyber Hygiene Guide relate to existing cybersecurity frameworks?
A: The guide complements existing cybersecurity frameworks. If you're already performing cybersecurity control self-assessments using the NIST Cybersecurity Framework (CSF), the CSBS Ransomware Self-Assessment Tool (R-SAT), or another framework, you don't need to start over. The fact sheets can be used alongside those tools to make sure the specific controls and threats covered here are addressed in your program.
Q: What if we already have programs for all ten controls in the CSBS Cyber Hygiene Guide? Do we still need to review this?
A: Yes. The guide's focus on consistent implementation and ongoing management emphasizes the importance of regular review. The Board questions are also worth reviewing even if your programs are mature, since they can highlight gaps in how cybersecurity is being communicated and overseen at the Board level.
Q: We're a small institution with limited staff and resources. How do we prioritize which controls matter most?
A: Start with the controls most likely to be exploited at your institution. For most community institutions, that means MFA, patching, and incident response. If you're not sure where your biggest gaps are, working through the fact sheets as a gap assessment is a reasonable starting point. Tandem's GRC software products are also designed to help you identify and prioritize risks in a structured way.