Categories: Articles

FFIEC Issues Statement on End of Microsoft Support for Windows XP

The Federal Financial Institutions Examination Council agencies have issued the following statement for financial institutions about the end of support for Windows XP and regulatory guidance for addressing the risk from its continued use.

PURPOSE

The Federal Financial Institutions Examination Council (FFIEC) agencies (“agencies”) are jointly issuing this statement to alert financial institutions that the discontinuation of support for the Microsoft Windows XP operating system (XP) could present operational risks to financial institutions, technology service providers (TSPs), and to activities supported by other third parties. The agencies expect financial institutions and TSPs to identify, assess, and manage these risks to ensure that safety, soundness, and the ability to deliver products and services are not compromised.

BACKGROUND

Microsoft will discontinue extended support for XP effective April 8, 2014. After this date, Microsoft will no longer provide regular security patches, technical assistance, or support for XP. Financial institutions, TSPs, and other third parties that use XP in personal computers, servers, and purpose-built devices such as automated teller machines (ATM), or that are dependent on applications that require use of XP could be exposed to increased operational risk.

POTENTIAL PROBLEMS

Potential problems include degradation in the delivery of various products and services, application incompatibilities, and increased potential for data theft and unauthorized additions, deletions, and changes of data. Additionally, financial institutions and TSPs that are subject to the requirements of the Payment Card Industry Data Security Standard (PCI DSS) and continue to use XP after April 8, 2014, may no longer be compliant.

REGULATORY GUIDANCE

Financial institutions and TSPs that use XP should follow their risk management processes to address the risk from the continued use of XP, consistent with the risk management guidance contained in the FFIEC Information Technology (IT) Examination Handbook.

Important considerations include

  • performing risk assessments: Identify and measure the risk from the continued use of XP throughout the organization and at third parties, including business continuity and disaster recovery situations.
  • selecting appropriate mitigations: Consider costs and potential risks, including compatibility with other systems and applications, in selecting a mitigation strategy.2
  • conducting appropriate planning: Develop an implementation plan addressing priorities for changes, ensuring appropriate change management procedures, and monitoring related third parties’ mitigation and migration activities, as warranted.3
  • monitoring and reporting: Monitor the risk mitigation implementation to ensure that the level of risk is acceptable. The effectiveness of controls should be tested periodically and results reported to senior management or a committee of the board of directors, as appropriate, to ensure risk continues to be managed.

The PDF version of the original statement is available here on the FFIEC website.

Bryan Antepara

Bryan Antepara: IT Specialist Bryan Antepara is a leader in Cloud engagements with a demonstrated history of digital transformation of business processes with the user of Microsoft Technologies powered by the team of eMazzanti Technologies engineers. Bryan has a strong experience working with Office 365 cloud solutions, Business Process, Internet Information Services (IIS), Microsoft Office Suite, Exchange Online, SharePoint Online, and Customer Service. He has the ability to handle the complexity of moving data in and out of containers and cloud sessions, makes him the perfect candidate to help organizations large and small migrate to new and more efficient platforms.  Bryan is a graduate of the University of South Florida and is Microsoft Certification holder.

Recent Posts

Protecting Municipal Data: Security Tips for City Officials

The FBI reported that cyber attacks against government facilities saw an increase of almost 36…

14 hours ago

The Advantages of Collaborating with a Managed Services Provider

In today’s fast-paced, technologically advanced world, businesses of all sizes increasingly rely on digital systems…

17 hours ago

Technology Buzzwords: Demystifying the Jargon of the Digital Age

You likely hear terms like "blockchain," "machine learning," and "cloud computing" without considering their real…

20 hours ago

Top 5 Collaborative Tools in Microsoft 365 Drive Productivity and Innovation

In today’s fast-paced digital landscape, businesses cannot thrive without effective collaboration. Microsoft continues its unwavering…

1 week ago

7 Essential Contact Information Tips for Email Signatures to Enhance Your Professional Image

An email signature accomplishes much more than simply telling readers who you are and how…

2 weeks ago

Maximizing Threat Response Efficiency with Security Copilot

Cyber security professionals work hard to safeguard companies’ information. But with criminals constantly changing their…

3 weeks ago