Governance, risk & compliance
Governance that reflects how you actually operate.
We help financial institutions and other regulated organizations build information security programs that are aligned to recognized frameworks, grounded in technical reality, and prepared for examiner and auditor review.
Framework foundation
The six functions of NIST CSF 2.0.
Version 2.0 of the Cybersecurity Framework added Govern as a sixth function at the center of the other five. Governance informs how every other outcome is prioritized, resourced, and overseen.
-
GV
Govern
The organization’s cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored.
-
ID
Identify
The organization’s current cybersecurity risks are understood.
-
PR
Protect
Safeguards to manage the organization’s cybersecurity risks are used.
-
DE
Detect
Possible cybersecurity attacks and compromises are found and analyzed.
-
RS
Respond
Actions regarding a detected cybersecurity incident are taken.
-
RC
Recover
Assets and operations affected by a cybersecurity incident are restored.
Function descriptions are from NIST Cybersecurity Framework 2.0 (NIST CSWP 29).
NIST Cybersecurity Framework
NIST CSF 2.0 organizes cybersecurity outcomes into six functions and gives management, technical staff, and examiners a common language. We use it to measure where your program stands today, define where it needs to be, and build a prioritized roadmap between the two.
What we do
- Current-state assessment against CSF 2.0 categories and subcategories
- Target profile development based on risk, size, complexity, and obligations
- Gap analysis with a prioritized, budget-aware roadmap
- Crosswalks between CSF 2.0, FFIEC guidance, and your existing policies
What you receive
- Current and target CSF profiles
- Gap analysis and remediation roadmap
- Executive summary for management and the board
FFIEC Guidance
The FFIEC IT Examination Handbook is a series of booklets examiners use when evaluating technology risk at financial institutions. We align your program, documentation, and controls to the booklets most relevant to your institution.
What we do
- Program alignment with the Information Security, Business Continuity Management, and Architecture, Infrastructure, and Operations booklets
- Review of IT management oversight, audit coverage, and outsourced technology relationships
- Business continuity and resilience planning informed by the FFIEC Business Continuity Management booklet
- Transition support for institutions that previously relied on the FFIEC Cybersecurity Assessment Tool
What you receive
- FFIEC IT Examination Handbook crosswalk
- Program gap findings
- Prioritized remediation plan
Moving beyond the CAT. The FFIEC sunset its Cybersecurity Assessment Tool on August 31, 2025, noting that institutions can refer directly to government resources such as NIST CSF 2.0 and CISA’s Cybersecurity Performance Goals. The FFIEC does not endorse any particular assessment tool. We help institutions choose an approach that fits and move their self-assessment to it.
FDIC Examination Readiness
Thorough preparation helps an IT examination proceed efficiently. We help FDIC-supervised institutions organize evidence, close known gaps, and prepare management to discuss the information security program with confidence.
What we do
- Pre-examination readiness reviews covering audit, management, development and acquisition, and support and delivery, the core areas assessed under the FDIC’s InTREx program
- Preparation of responses to pre-examination requests, including the Information Technology Profile
- Evidence organization: policies, board reporting, risk assessments, testing results, and vendor reviews
- Status review of prior examination and audit findings
- Preparation for management interviews and walkthroughs
What you receive
- Examination readiness assessment
- Organized, indexed evidence package
- Prior findings status report
Security Governance
Strong programs have clear ownership. We help define the roles, oversight structures, and reporting relationships that keep information security accountable to senior management and the board of directors.
What we do
- Information security program structure and charter
- Roles and responsibilities, including the information security officer function
- IT steering and risk committee structure, agendas, and minutes
- Board reporting consistent with the Interagency Guidelines Establishing Information Security Standards, which call for reporting to the board, or an appropriate board committee, at least annually
What you receive
- Governance charter
- Responsibility (RACI) matrix
- Committee and board reporting templates
Risk Assessments
A risk assessment should drive decisions, not sit on a shelf. We identify reasonably foreseeable threats, evaluate the controls in place, and deliver results management can act on.
What we do
- Information security risk assessments
- Asset and data inventories that support meaningful risk analysis
- Third-party risk assessments informed by the 2023 Interagency Guidance on Third-Party Relationships
- Business impact analysis supporting continuity planning
- Risk reviews for new technologies, vendors, and significant changes
What you receive
- Risk assessment report
- Risk register with treatment plans
- Vendor risk ratings and due diligence summaries
Policy Development
Policies must be specific enough to guide behavior and accurate enough to hold up under testing. We write and update policies, standards, and procedures that describe what your organization actually does.
What we do
- Information security program and policy suite development
- Acceptable use, access control, change management, and data classification policies
- Incident response, business continuity, and vendor management policies
- Standards and procedures that put policy requirements into practice
- Annual review cycles and board approval support
What you receive
- Complete, consistent policy suite
- Supporting procedures and standards
- Policy-to-control mapping
Audit Remediation
Findings from examinations and independent audits need more than a quick fix. We identify root causes, implement corrective actions, and document closure clearly so it can be validated during follow-up review.
What we do
- Finding analysis and root-cause identification
- Corrective action plans with owners and target dates
- Hands-on technical remediation where needed
- Closure evidence packages for auditors and examiners
- Coordination with your independent auditors. We support their work without compromising their independence.
What you receive
- Remediation tracker
- Closure evidence for each finding
- Support preparing management responses
Executive Reporting
Boards and senior management are accountable for overseeing cybersecurity. We give them clear, accurate reporting on risk posture, program progress, and the decisions that require their attention.
What we do
- Board and committee cybersecurity reports
- Key risk and control indicators tailored to your organization
- Remediation and roadmap progress reporting
- Plain-language briefings on emerging threats and regulatory developments
What you receive
- Board report templates
- Recurring program status reporting
- Executive briefing materials
References
Primary sources we work from.
We base our work on published guidance from the agencies and standards bodies themselves. These are the sources we cite in assessments, crosswalks, and policy documentation.
Independence and scope. SEDSGA, LLC is not affiliated with, certified by, or endorsed by NIST, the FFIEC, the FDIC, or any regulatory agency. We do not provide legal advice, and our services support, rather than replace, your independent auditors. Examination outcomes are determined solely by the examining agency, and no consultant can guarantee a rating or audit result.
Next step
Have an examination or audit on the calendar?
The earlier readiness work begins, the more options you have. Let’s talk about your timeline and prior findings.
or email wes@sedsga.net