Board Report: 2026-SR-B-001 February 3, 2026
The Board's OASIS technology platform, which examiners use to document their supervisory activities of the nation's largest financial institutions, contains confidential supervisory information. The loss or misuse of CSI could result in significant legal, reputational, or financial risk to the Board, Reserve Banks, financial institutions, and individuals.
We identified several concerns regarding CSI access in OASIS, which the Board must address before we conduct further work. For example, users have more access to sensitive information than appears to be warranted based on their specific financial institution examination assignments, which is inconsistent with Board policy and information security principles.
We have four recommendations to enhance the Board's practices and controls for safeguarding CSI in OASIS.
