FedLine Solutions Security and Resiliency Assurance Program - Tandem

To promote the security of payment systems, the Federal Reserve has an initiative in place called the FedLine Solutions Security and Resiliency Assurance Program. This program requires organizations who use FedLine services to (1) complete an assessment, (2) develop a remediation plan, and (3) submit proof of compliance with the security requirements to the Federal Reserve.

In this article, we will discuss answers to frequently asked questions about this program and explain how you can use Tandem to manage your annual assessment. 

What is FedLine? 

FedLine is a suite of payment solutions, designed to facilitate electronic payments in an efficient, reliable, and secure manner. FedLine solutions include FedLine Direct, FedLine Command, FedLine Advantage, FedLine Web, and FedMail. To learn more about each of these solutions and the included services, see the FedLine Solutions page on the Federal Reserve website. 

What is the FedLine Solutions Security and Resiliency Assurance Program? 

To ensure security and reduce the risk of fraudulent payments, the Federal Reserve has developed a series of security requirements which must be implemented for institutions using FedLine Solutions. The requirements include things like PC controls, hardware controls, network controls, documentation and data, assurance, etc.

To ensure these requirements are being met, the Federal Reserve has developed the "FedLine Solutions Security and Resiliency Assurance Program." The program has three components:

1. Assessment. Each organization must conduct a self-assessment to determine if the requirements are met. In addition, the Federal Reserve may require an independent assessment or review, based on a variety of factors (e.g., implemented solutions, use cases, organizational complexity, etc.).
2. Remediation Plan. For any gaps highlighted in the assessment process, the organization must develop a plan of action to remediate the deficiencies.
3. Attestation. An organization official or executive in charge of payments must sign an attestation form to confirm the organization understands the security requirements, has conducted the assessment, has a remediation plan, etc.

How can I complete the assessment and attestation?

While each organization is responsible for determining how to best conduct the assessment for their environment, here are some steps to help you through the process.

Step 1: Review Communications from the Federal Reserve

Attestation materials designed to guide you through the process were sent to your organization. If you have not received the materials or if you cannot locate them, contact the FedLine Solutions Customer Contact Center.

Step 2: Gather the Required Documents

Download the following documents from the FedLine Solutions website.

• Operating Circular 5
• Certification Practice Statement: Federal Reserve Banks' Certification Authority
• Certification Practice Statement: Federal Reserve Banks' Services Public Key Infrastructure (PKI)
• Password Practice Statement

Depending on which FedLine Solutions your organization has implemented, you will also need to locate the Security and Controls Procedures documents for each solution. These documents are not publicly available. You have three options for locating them:

• Locate where your organization stored them during the solution implementation process.
• Download the FedLine Web and FedLine Advantage documents from the EUAC Center.
• Contact the FedLine Solutions Customer Contact Center to request a copy.

Step 3: Conduct the Assessment

Each document includes a list of requirements. To perform a self-assessment, review the requirements with applicable personnel (e.g., payments, technology, operations, etc.) and determine if each requirement is implemented. Make note of any items which are not in place.

Did You Know? You can use Tandem Cybersecurity Assessment to track and document your FedLine Solutions Security and Resiliency Assurance Program assessments? See the "How Tandem Can Help" section below for details.

If the Federal Reserve notifies you that you must have an "independent assessment," you may be able to do one of the following:

• Hire an independent third party to perform the assessment.
• Have an independent internal department perform the assessment (e.g., internal audit, compliance).
• Conduct a self-assessment and have it reviewed and substantiated by an independent party.

Step 4: Create a Remediation Plan

If any areas of noncompliance were noted during the assessment process, create a gap analysis and remediation plan to address the deficiencies. Escalate the issues to the responsible parties and develop a written plan-of-action to address the gaps.

Step 5: Submit the Attestation

You are not required to submit the self-assessment, but are required to submit an attestation. Instructions for submitting the attestation are included with the attestation materials you received from the Federal Reserve. When finished, save copies of the self-assessment, supporting documentation, and attestation documents for your records.

Step 6: Set a Schedule

The attestation process must be completed by December 31st of each year. Schedule a time to review the assessment, update any remediated areas, and recomplete the attestation before the deadline each year.

How Tandem Can Help

At Tandem, it is our goal to improve security while easing the burden of regulatory compliance, and we are honored to have so many financial institutions contacting us for assistance with completing this assessment.

Several of the required documents are confidential and the Federal Reserve has elected to not share them with the public. This means we cannot provide the entire FedLine Solutions Security and Resiliency Assurance Program as a template in our product.

However, Tandem Cybersecurity Assessment can provide templates for the publicly available components, such as Operating Circular 5 and the Password Practice Statement.

In addition, the Pro version of the product now allows users to create their own frameworks. With Tandem Cybersecurity Assessment (Pro), you can:

• Create frameworks based on the Security and Controls Procedures materials.
• Conduct cybersecurity self-assessments each year using the framework.
• Assign responsibility and upload attachments as evidence.
• Perform a gap analysis and create action plans for remediation.
• Generate custom documents and reports for compliance purposes.

Learn more about how Tandem Cybersecurity Assessment can help you at Tandem.App/Cybersecurity.

Additional Resources 

For additional information, see the following FedLine Solutions Security and Resiliency Assurance Program resources.

• Resource Center
• Frequently Asked Questions
• Training Program Slides
• Fed360 Blog

Update Log:

• 11/21/2025: Updated to include new Tandem Cybersecurity Assessment capabilities.