Skip to main content
Commerce Security Authority
Category: Regulations and Standards

FFIEC IT Examination Handbook

Also known as: FFIEC IT Handbook, FFIEC Information Technology Examination Handbook, IT Examination Handbook, FFIEC IT Handbook InfoBase, IT Examination Handbook InfoBase
Simply put

The FFIEC IT Examination Handbook is a set of guidelines and best practices issued by the Federal Financial Institutions Examination Council (FFIEC) for financial institutions and the examiners who oversee them. It is organized into topical booklets, such as Information Security and Management, that describe expectations for how institutions handle technology risk. It serves as reference and training material for field examiners and as guidance for the institutions they review.

Formal definition

The FFIEC IT Examination Handbook is the Information Technology examination guidance maintained by the Federal Financial Institutions Examination Council and delivered through the IT Examination Handbook InfoBase. It comprises multiple topical booklets, including the Information Security booklet and the Management booklet, each of which sets examiner expectations for specific IT and risk domains; individual booklets are periodically revised and rescind and replace prior versions (for example, the Management booklet updated in 2015 replaced the June 2004 version). Practitioners should note that the Handbook is examination guidance for supervised financial institutions rather than a payment-security standard, and it is separate and distinct from PCI DSS and the related PCI standards; specific booklet content, structure, and effective dates should be confirmed against the currently published version in the FFIEC InfoBase.

Why it matters

For supervised financial institutions in the United States, the FFIEC IT Examination Handbook defines the expectations that field examiners use to evaluate how an institution manages technology and information security risk. Because the Handbook shapes the examination process itself, its booklets effectively communicate what regulators consider sound practice across domains such as information security and IT management. Institutions that align their controls and governance to the relevant booklets are better positioned to demonstrate the maturity of their risk management during examination.

The Handbook is examination guidance for supervised financial institutions rather than a payment-security standard, and it is separate and distinct from PCI DSS and the related PCI standards. A payment processor, acquirer, or merchant risk team should not treat FFIEC alignment as a substitute for PCI DSS validation, nor assume PCI DSS compliance satisfies FFIEC examiner expectations. The two frameworks address overlapping but different concerns, and an institution subject to both must map its controls against each one independently.

Because individual booklets are periodically revised and rescind and replace prior versions, the specific expectations in force can change over time. Practitioners should confirm booklet content, structure, and effective dates against the currently published version in the FFIEC IT Examination Handbook InfoBase rather than relying on an older edition, since referencing a superseded booklet may misstate current examiner expectations.

Who it's relevant to

Financial institution IT and risk teams
Supervised financial institutions use the relevant booklets, such as Information Security and Management, as guidance for how they govern technology risk and prepare for examination. Aligning controls to the currently published booklets helps institutions demonstrate sound practice, though it does not substitute for separate obligations such as PCI DSS validation where applicable.
Field examiners
The Handbook serves as reference, educational, and training material for field examiners overseeing financial institutions, setting the expectations they apply when reviewing an institution's IT and information security posture across specific domains.
Compliance and audit functions
Compliance officers and internal auditors at supervised institutions map internal controls to the applicable booklets and must track when a booklet is revised, since a new version rescinds and replaces the prior one and can change the expectations in force.
Payment security and PCI practitioners
Security engineers, acquirers, processors, and merchant risk teams should note that the FFIEC IT Handbook is examination guidance separate and distinct from PCI DSS and related PCI standards. Where an institution is subject to both, controls should be assessed against each framework independently rather than assuming one satisfies the other.

Inside FFIEC IT Handbook

FFIEC IT Examination Handbook
A collection of booklets issued by the Federal Financial Institutions Examination Council (FFIEC) that provides guidance to examiners and financial institutions on information technology risk management, controls, and examination expectations. It is guidance for U.S. financial institutions and their examiners, and is distinct from PCI DSS or card brand rules.
Booklet structure
The handbook is organized into topical booklets addressing areas such as information security, business continuity, retail payment systems, audit, outsourcing/third-party risk, and architecture and operations. Coverage and titles are periodically revised, so practitioners should confirm the current set of published booklets rather than assume a fixed list.
Risk-based supervisory focus
The guidance frames IT controls in terms of risk assessment, governance, and management oversight rather than prescribing a fixed checklist. It is intended to inform how examiners evaluate an institution's IT risk posture.
Relationship to payment security standards
Where the handbook addresses payment or card processing, it operates alongside—not in place of—separate standards such as PCI DSS, PCI PIN, and PCI P2PE, and alongside card brand and network rules. Compliance with one does not establish compliance with another.
Audience and applicability
The primary audience is examiners and the financial institutions they supervise. Merchants, processors, and service providers subject to PCI DSS may find overlapping control themes, but the handbook's authority and scope differ from PCI SSC standards.

Common questions

Answers to the questions practitioners most commonly ask about FFIEC IT Handbook.

Is the FFIEC IT Handbook the same thing as PCI DSS, or does complying with one satisfy the other?
No. The FFIEC IT Handbook is guidance issued by the Federal Financial Institutions Examination Council for examiners and the financial institutions they supervise; PCI DSS is a separate standard developed and maintained by the PCI Security Standards Council to protect account data. They have different authors, scopes, and enforcement mechanisms. Aligning with FFIEC guidance does not by itself establish PCI DSS compliance, and validating against PCI DSS does not by itself satisfy FFIEC examination expectations. An organization subject to both must address each on its own terms, and should confirm current requirements against the respective published sources.
Does the FFIEC IT Handbook impose legally binding rules with fixed requirement numbers I can cite?
The FFIEC IT Handbook is supervisory guidance rather than a control catalog with fixed, citable requirement numbers in the way a standard like PCI DSS uses numbered requirements. Its content is organized into booklets that are updated over time, and examiners apply it in the context of applicable laws, regulations, and agency expectations. Because wording and structure change across editions, you should reference the specific booklet and current published version rather than assuming static language, and treat legal enforceability as a matter determined by the relevant regulator and applicable law.
How do teams typically use the FFIEC IT Handbook alongside a PCI DSS program?
Many institutions map their control activities to both sources rather than treating them interchangeably. Where the FFIEC IT Handbook addresses broader IT governance, risk management, and operational areas, PCI DSS focuses on protecting account data within its defined scope. A practical approach is to maintain a mapping that shows which controls respond to FFIEC examination expectations, which respond to PCI DSS, and where a single control may support both, while documenting that satisfying one does not automatically satisfy the other.
How should we prepare documentation ahead of an examination that references the FFIEC IT Handbook?
Preparation generally centers on being able to demonstrate governance, risk assessment, and control operation in the areas the relevant booklets address. Teams commonly assemble policies, risk assessments, evidence of control performance, and records of oversight, and confirm they are working from the current published booklet rather than a superseded edition. Because the guidance is applied by examiners in context, it is useful to document how decisions were risk-based rather than to expect a fixed checklist.
Who in a payment or merchant organization should own alignment with FFIEC IT Handbook guidance?
Ownership depends on whether the organization is a supervised financial institution or a party working with one. Within a supervised institution, responsibility typically spans IT governance, information security, and risk and compliance functions, with oversight from management and the board. Payment processors, acquirers, and merchant risk teams that are not directly examined may still encounter the guidance indirectly through partner institutions, and should coordinate with those institutions to understand which expectations flow down through contractual or oversight relationships.
How do we keep our program current as the FFIEC IT Handbook is revised over time?
Because individual booklets are updated on their own timelines, a common practice is to monitor for revisions to the booklets relevant to your operations and to periodically re-check control mappings against the current published versions. Rather than assuming prior editions remain accurate, teams verify wording and structure at the source, note where updates affect existing controls, and reconcile any overlaps with separately maintained standards such as PCI DSS so that changes to one framework are reflected without conflating the two.

Common misconceptions

The FFIEC IT Handbook and PCI DSS are the same thing or can be used interchangeably.
They are separate frameworks with different governance, authorities, and scope. The FFIEC IT Handbook is examination guidance for U.S. financial institutions; PCI DSS is a payment card industry standard governed by the PCI SSC. Meeting one does not demonstrate compliance with the other, and controls such as protecting cardholder data versus sensitive authentication data are defined by PCI DSS, not the handbook.
Following the handbook is a fixed checklist that guarantees regulatory approval or eliminates IT risk.
The handbook is risk-based guidance intended to help institutions manage IT risk; it does not guarantee any outcome. Examination judgments depend on an institution's specific risk profile and controls, and no single framework eliminates fraud or operational risk.
Handbook booklets and their content are static, so a cited version can be relied on indefinitely.
The FFIEC periodically revises and reissues booklets, and titles and coverage change over time. Practitioners should confirm requirements and terminology against the currently published version rather than assume fixed content or numbering.

Best practices

Confirm you are referencing the currently published FFIEC booklet, since titles, coverage, and content are revised over time.
Treat FFIEC IT Handbook guidance and PCI DSS as complementary but separate; map each control to its governing framework and do not assume compliance with one satisfies the other.
Where payment card data is in scope, apply PCI DSS distinctions—storing permitted cardholder data under defined controls while never retaining sensitive authentication data after authorization, even when encrypted—alongside handbook IT risk expectations.
Use the handbook's risk-based approach to drive your own risk assessment rather than treating it as a static pass/fail checklist.
Coordinate examination-driven IT controls with card brand and network rules, noting that liability and payment rules vary by region and change over time.
Document the specific framework, booklet, and version underlying each control so audit and examination evidence remains traceable and current.