Penetration Testing · For Banks

Bank Penetration Testing for Your Next Exam

An independent tester attacks your bank's network the way a real criminal would. You get a clear report on what worked and what to fix first.

Let's Talk Through Your Scope

Bank penetration testing gives you proof that someone independent tried to break into your systems. Examiners look for that proof. This page shows what the rules say, what examiners read, and where a pentest fits.

What do the bank rules say about testing?

Federal bank regulators share one rule for information security: the Interagency Guidelines Establishing Information Security Standards. Section III.C.3 says banks must “regularly test the key controls, systems and procedures” of their security program.

Your risk assessment sets how often you test and how deep you go. The rule also says who should take part. An outside company, or staff who do not build or run your security program, should run the tests or review them.

The same text appears in four places. Your charter decides which one applies to you.

National banks and federal savings associations: OCC, 12 CFR Part 30, Appendix B, section III.C.3.
State member banks: Federal Reserve, 12 CFR Part 208, Appendix D-2, section III.C.3.
Bank holding companies: Federal Reserve, 12 CFR Part 225, Appendix F, section III.C.3.
FDIC-insured banks outside the Federal Reserve, and state savings associations: FDIC, 12 CFR Part 364, Appendix B, section III.C.3.

What do examiners read?

Examiners use the FFIEC IT Examination Handbook as their guide. Its Information Security booklet (section IV.A.2) names penetration testing as one of four ways to get assurance about your security. The other three are self-assessments, vulnerability assessments and audits.

Section IV.A.2(b) covers penetration tests. It says your risk assessment should set how often you test and how wide the test reaches. It also says management decides how independent the tester must be.

The booklet also lists the steps examiners follow. In Appendix A, Objective 10 tells them to check whether management uses independent organizations to test its security program. A pentest from an outside firm is one clear way to show that.

Section III.C.3 never says “penetration test.” The handbook does. When an examiner asks how you test your key controls, a pentest report gives a direct answer.

Where does a pentest fit?

A pentest does not make a bank compliant on its own. It gives you evidence for one part of your program: independent testing of your key controls. Your policies, training and risk assessment cover the rest.

Section III.F adds one more reason to test. Your bank must report to its board at least once a year, and the report should cover the results of testing. A pentest gives your board real results to read.

We run network penetration testing from two starting points. An external test shows what an attacker can reach from the internet. An internal test shows what the same attacker can reach after stealing one password.

Why Red Raine Labs?

Red Raine Labs is owner-operated. The experienced tester who scopes your test also runs it and writes the report. We never hand your test to a junior tester.

Real attacks. We exploit weaknesses to show what an attacker could reach. We do not hand you scanner output.
Honest ratings. We rate each finding by what happened in your network, not by a generic score.
A report for two readers. Your board gets a plain summary. Your IT team gets every finding with proof and a fix. Then we walk you through it.
Remote or on site. We can test your bank from anywhere in Michigan, and most tests run from our side.

Read the sources

Do not take our word for it. Read the rules and the handbook yourself.

Planning your next independent test?

Tell us your charter, your size and when your exam is due. We will help you pick a scope that fits.