Back to top

Risk Assessment

Commercial E-Banking Risk Assessment and Controls Evaluation


The following e-banking risk assessment and controls evaluation is provided to assist commercial Internet banking users in identifying threats and measure the strength of their controls.

Risk Assessment Questions

For each question, select the answer that best represents your environment. Following the assessment, use the "Control Evaluation - Tips" to evaluate your environment.

Personnel Security:

  1. Are employees required to sign an Acceptable Use Policy (AUP)?
  2. Does each employee using Internet banking go through security awareness training?
  3. Do you run background checks on employees prior to hire?

Computer System Security:

  1. Do computer systems have up-to-date antivirus software?
  2. Is there a process in place to ensure software updates and patches are applied (e.g. Microsoft, web browser, Adobe products, etc.)?
  3. Do users run as local Administrators on their computer systems?
  4. Is a firewall in place to protect the network?
  5. Do you have an Intrusion Detection/Prevention System (IDS/IPS) in place to monitor and protect the network?
  6. Is Internet content filtering being used?
  7. Is e-mail SPAM filtering being used?
  8. Are users of the Internet banking system trained to manually lock their workstations when they leave them?
  9. Is wireless technology used on the network with the Internet banking system?

Physical Security:

  1. Are critical systems (including systems used to access Internet banking) located in a secure area?
  2. How are passwords protected?