|
What is the National Institute of Finance? |
E-mail |
|
The National Institute of Finance (NIF) is a proposed U.S. Government entity that would serve as a resource to gather and provide appropriate data for the financial regulatory community. The NIF would also provide the analytical capabilities to monitor systemic risk, perform independent risk assessments of individual financial entities, and provide advice to the Federal regulatory agencies tasked with ensuring the health of the financial system. |
|
Last Updated on Tuesday, 03 November 2009 11:15 |
|
What is the proposed legal status of the NIF? |
E-mail |
|
The NIF would be an agency of the U.S. Federal Government organized within and under the authority of the proposed systemic risk regulator. |
|
Last Updated on Thursday, 24 September 2009 21:39 |
|
Is the NIF meant to replace the systemic risk regulator? |
E-mail |
|
No. The core mission of the NIF will be to support the systemic risk regulator, by delivering a range of data management, analytic and research services. |
|
Last Updated on Tuesday, 06 October 2009 17:09 |
|
Would the NIF replace or supersede the government's current capabilities to collect and manage financial data, or would it supplement those capabilities? |
E-mail |
|
The NIF would supplement and not supersede the government's existing capabilities, and would not affect the existing authority of regulatory agencies to collect and manage data. To support its mandate, the NIF would establish uniform data standards to assure the accuracy and comparability of the detailed financial data it collects. Financial regulatory agencies may benefit from the NIF's expertise and economies of scale by contracting with the NIF to handle data management tasks on their behalf. |
|
Last Updated on Tuesday, 06 October 2009 17:30 |
|
Does the proposed data collection authority represent a dramatic expansion of federal government power? |
E-mail |
|
Access to data is an established regulator tool; financial regulators already have extensive authority to collect granular data from regulated entities under the existing “safety and soundness” provisions of the law. Core supervisory and regulatory tasks—including institutional risk monitoring, examination support and detection of insider-trading—already require the examination of position-level information. The NIF would standardize these data reporting requirements, and would extend them to cover the growing number of shadow bank and other financial entities that are systemically important. |
|
Last Updated on Friday, 27 November 2009 07:17 |
|
Why would the NIF need a strong analytic capacity? |
E-mail |
|
An analytic capacity is required because data on its own does not constitute useful information. In order for the systemic regulator to be effective, the NIF will need to develop appropriate metrics, and monitor and report changes in system-wide risk levels and patterns. The analytic part of the NIF would also engage in fundamental research to support the systemic regulator. In addition, the NIF would provide analytic tools to regulators who oversee individual institutions. The analytic capacity of the NIF would provide essential tools to regulators so they would no longer need to outsource critical activities, such as running a stress test or determining the health of a financial institution. |
|
Last Updated on Friday, 27 November 2009 08:32 |
|
Are there any other government agencies that provide models for the NIF? |
E-mail |
|
The core functions of the NIF will be to collect, manage and analyze data, monitor conditions in financial markets, and generate non-partisan, objective research. These roles make it broadly analogous to agencies such as the National Weather Service, the National Transportation Safety Board, and the National Labs run by the Department of Energy. |
|
Last Updated on Tuesday, 20 October 2009 10:54 |
|
Would the NIF be a clearinghouse for transactions? |
E-mail |
|
No. The NIF would not be a clearinghouse for trades, nor would it assume the roles currently played by exchanges and clearinghouses. The NIF would not settle financial transactions. The NIF would not be a party to any trades. |
|
Last Updated on Friday, 27 November 2009 07:17 |
|
What is the fundamental value proposition of the NIF? |
E-mail |
|
The fundamental benefits of the NIF are three-fold: It will improve the efficiency and effectiveness of financial regulation; it will reduce the likelihood of systemic crises and costly institutional failures; and it will consequently increase public confidence and trust in our financial markets. |
|
Last Updated on Thursday, 24 September 2009 21:42 |
|
Doesn't the U.S. Federal Government already have plenty of economists? Why do we need this? |
E-mail |
|
No institution presently has the capacity and mandate to gather comprehensive data, and to conduct the applied research needed to safeguard the financial system against systemic risk. Managing systemic risk in a timely and comprehensive manner is a different challenge from those regulators have addressed in the past. Meeting this challenge will require novel interdisciplinary collaboration among experts in statistics, applied mathematics, operations research, network analysis and computer science, as well as financial economics. The data and analytic needs will be significant and the NIF will take advantage of economies of scale in staffing and computing resources in ways that our individual, focused regulators cannot.
|
|
Last Updated on Thursday, 26 November 2009 19:45 |
|
How would creating a National Institute of Finance benefit the U.S. financial services industry? |
E-mail |
|
A National Institute of Finance would benefit the U.S. financial services industry in three ways: It would reduce operating costs. Standardizing data reporting will dramatically reduce back office costs (costs associated with verifying details of trades with counter parties) and costs associated with maintaining reference databases (legal entity and financial instrument databases). Morgan Stanley estimates that implementation of the NIF will result in 20% to 30% savings in operational costs. It would improve risk management. By requiring daily reporting of all positions to the NIF, firms will be able to present a complete picture of their positions to their own internal their risk management groups. This will in turn ensure that senior management has a consistent and clear understanding of the firm's exposures – particularly their exposure to different counterparties during times of economic stress. It would create a safer and more competitive market. By helping improve individual firm risk management and providing better tools to the regulators to monitor and oversee systemic risk, the U.S. financial markets will be made safer, and will attract more business than competitors that are more prone to major shocks or collapses during times of economic stress. |
|
Last Updated on Friday, 27 November 2009 08:08 |
|
What is the Committee to Establish the National Institute of Finance? |
E-mail |
|
The Committee to Establish the National Institute of Finance (CE-NIF) is a volunteer-led effort. Its goal is to see that financial regulators are provided with the data and analytic tools necessary to monitor systemic risks and safeguard the financial system. |
|
Last Updated on Thursday, 24 September 2009 21:38 |
|
Why was the NIF concept created? |
E-mail |
|
The concept of a National Institute of Finance was developed in response to the catastrophic breakdown in world financial markets in 2008. The members of the CE-NIF believe that preventing a recurrence of these events requires improvements in the data and analytic tools available to regulators. |
|
Last Updated on Tuesday, 06 October 2009 17:08 |
|
Who started this effort? |
E-mail |
|
The CE-NIF was founded by John Liechty and Arthur Small, professors at Penn State University; Allan Mendelowitz, Member and formerly Chair of the Federal Housing Finance Board; Mark Flood, an economist; and Mark Reesor of the University of Western Ontario. |
|
Last Updated on Thursday, 24 September 2009 21:40 |
|
How did the founders come up with the idea for the NIF? |
E-mail |
The idea for the NIF arose during a brainstorming session at a research conference held in Washington DC in February, 2009. The conference, which was organized by the Office of the Comptroller of the Currency and the National Institute of Statistical Sciences, brought together regulators, academics and industry risk professionals to explore statistical issues in financial risk modeling and bank regulation. |
|
Last Updated on Wednesday, 25 November 2009 12:04 |
|
What are your goals? |
E-mail |
|
The CE-NIF's goal is to see financial regulators equipped with the data and tools they need to regulate the financial services industry effectively. We are currently working to have proposed legislation formally establishing the NIF passed into law as a vital component of impending financial regulatory reform. |
|
Last Updated on Thursday, 24 September 2009 21:41 |
|
Who is funding this effort? |
E-mail |
The CE-NIF is a volunteer-led effort, managed by the individual members. The direct expenses of the Committee have to date been funded primarily through voluntary contributions from committee members themselves. The CE-NIF has not received financial support from any commercial organizations. We gratefully acknowledge in-kind contributions from the Courant Institute for Applied Mathematics at New York University, for hosting an organizing workshop; and from the Enterprise Data Management Council, for limited media and communications support. |
|
Last Updated on Tuesday, 10 November 2009 13:19 |
|
Is this an industry-funded initiative? Do the members have a vested interest in seeing the NIF created? |
E-mail |
|
No. The CE-NIF is not an industry-funded initiative or front group. It was founded by a small group of academics and regulators who have no financial stake in seeing the NIF created. The Committee has invited members from the financial services and information technology industries with the chief goal of working together to create a healthier and more transparent financial system. Industry luminaries work alongside participants from governmental, academic, professional and international organizations. Commercial interests do not own, control, or finance this initiative. |
|
Last Updated on Tuesday, 29 September 2009 17:57 |
|
Is your goal to use the NIF proposal to avoid more onerous regulation? |
E-mail |
|
No. The NIF proposal is not intended to block other efforts at financial regulatory reform. We believe that no matter how Congress reforms the authorities assigned to financial regulators, effective systemic risk monitoring and management will require the capabilities put forward in the NIF proposal. |
|
Last Updated on Tuesday, 06 October 2009 17:20 |
|
What types of data would the NIF collect? |
E-mail |
|
The NIF will collect four main types of data, all of which serve as inputs to models of systemic risk: - Instrument reference data — the legal and contractual structures that define financial instruments;
- Entity reference data — the participants in the issuance and transactions process and their relationships (e.g., parent-subsidiary hierarchies);
- Transactions and positions data — detail on the transactions and holdings of financial institutions;
- Market data — market prices, trading volumes, and other key measures (e.g., volatilities) that emerge from the trading process.
In addition, the NIF would utilize macroeconomic and other data (e.g., GDP, unemployment rates, tax rates, house price indexes, etc.) already available from other sources; there is no need to duplicate these other collection efforts. |
|
Last Updated on Tuesday, 20 October 2009 08:48 |
|
Will the NIF need comprehensive coverage across all industry participants? Why? |
E-mail |
|
Comprehensive collection across industry participants is required. Otherwise, problematic contracts and exposures will naturally migrate to avoid supervisory scrutiny. The build-up of exposures by AIG Financial Products Division provides a cautionary example of this phenomenon of "regulatory arbitrage." |
|
Last Updated on Tuesday, 06 October 2009 11:35 |
|
Will the NIF require counterparty information? Why? |
E-mail |
|
Counterparty information is required. Only by mapping the network of relationships among participants will analysts be able to understand and simulate the behavior of the system as a whole. It is these inter-relationships that make the financial system too complex to be represented by a simple sum of its individual institutions. This is the core of the macroprudential problem. |
|
Last Updated on Tuesday, 06 October 2009 11:35 |
|
Will the NIF require daily reporting? Why? |
E-mail |
|
The NIF will require daily reporting of transaction data. Getting this type of granular data is central to the NIF being able to do its job (as explained elsewhere in these FAQs). By requiring daily reporting, the NIF will be able to minimize the reporting burden on the reporting entities. Once data reporting is standardized, the least costly way to report transaction data is with the equivalent of an electronic “cc” automatically attached to each trade confirmation message.
|
|
Last Updated on Thursday, 19 November 2009 18:49 |
|
How will the NIF handle transactions involving non-U.S. institutions? |
E-mail |
Data will be required from U.S.-based financial institutions and their foreign affiliates. In addition, foreign institutions would be required to report on transactions conducted in the U.S.
|
|
Last Updated on Tuesday, 06 October 2009 12:13 |
|
Read more...
|
|
Why will the NIF need to collect so much data, of so many different kinds? |
E-mail |
|
The next crisis undoubtedly will surprise us as the previous ones have done. Policy makers will require answers to urgent questions that we cannot foresee today. Whatever answers are supplied will be acted upon in a crisis; getting such actions wrong can make any crisis much worse. Given that building a data collection system can take years, it will be too late to initiate such an effort when the need arises. The next crisis will have to be addressed with the data held in the NIF at the time it occurs. This makes it essential that the NIF hold at least a complete, up-to-date, high-quality, standardized, ready-to-process set of foundational data (entity data, instrument data, transaction data) and the necessary analytical tools and systems to evaluate their implications. |
|
Last Updated on Friday, 20 November 2009 07:36 |
|
Won’t the NIF simply be swimming in data when crucial answers are needed? |
E-mail |
|
By providing common reference databases and a common reporting language, the NIF will be able to integrate the data it collects in an automated fashion. Because the NIF will require entities to send electronic cc’s for all of their transactions, on a regular basis, the NIF will always have a current view of the financial system. Because these data will be properly organized and tied together in a consistent manner and because the NIF will have dedicated high performance computing resources to process the data, the NIF will be able rapidly to provide decision-makers with needed summaries and aggregations – especially during a time of crisis. |
|
Last Updated on Friday, 27 November 2009 13:28 |
|
What is meant by “granular” data? |
E-mail |
|
Data on contractual terms and conditions -- such as the interest rate, principal, and maturity of a loan -- are key ingredients in risk calculations. We recommend that such data be captured at the most granular level: as attributes of specific legal contracts. The alternative is to capture the information at some higher level of aggregation, such as the average interest rate and maturity across all loans in a portfolio. However, aggregated data are necessarily and unavoidably less informative than fully granular data. Detailed data will provide the flexibility required to feed a diverse range of risk models. The resulting insights will be invaluable in identifying future systemic fragilities, whose source cannot be predicted today. Because granular, contract-level data will typically constitute business confidential information, data security will be a core feature of the NIF. |
|
Last Updated on Friday, 23 October 2009 08:39 |
|
How can granular or contract-level data tell us anything about system-level risk? |
E-mail |
|
The solvency of a financial entity depends, in part, on assets that are guaranteed by other financial entities (counterparties). Understanding how financial entities are connected contractually is critical to understanding how failures can cascade through the financial network. Aggregation and netting are based on assumptions that vary from market participant to market participant, assumptions that do not always hold in practice and that are especially vulnerable to failure during a crisis. |
|
Last Updated on Tuesday, 10 November 2009 13:12 |
|
How will granular or contract-level data help regulators understand an emerging crisis? |
E-mail |
|
The NIF must be able to understand the capacity of the financial system to manage and distribute risks; to monitor how risk flows through the financial network, and to identify potential points of failure. This understanding can only be built up based on a detailed view of market liquidity (how frequently and deeply instruments trade), and a clear analysis of the obligations and rights of liquidity providers. For example, financial entities that are under stress are forced to sell assets, which can lead to a fire sale and a lack of liquidity. As liquidity disappears in one market they are forced to sell other assets, which can quickly lead to a lack of liquidity in other markets. The failure of multiple markets can cause a widespread lack of confidence, resulting in runs on the entire market. |
|
Last Updated on Tuesday, 10 November 2009 13:14 |
|
How will granular or contract-level data help regulators deal with the growing complexity of financial contracts? |
E-mail |
|
Some of the risks that are hardest to measure are those associated with highly complex and innovative financial instruments whose payoffs depend on other financial instruments, assets, or external factors, often in intricate ways. Without detailed, granular data, it can be difficult or impossible to understand the risks involved with such complex instruments. For example, shocks to the value of underlying collateral at the bottom of a complex structured product (e.g., mortgage-backed or asset-backed structured products) can result in “toxic assets” that cannot be priced. In order to understand the risk to solvency of financial entities that hold these complex instruments, and the risk in turn to the counterparties of these entities, the NIF must be able to see how all of these complex financial instruments connect to their underlying collateral. This capability depends on access to granular, contract-level data.
|
|
Last Updated on Thursday, 19 November 2009 20:10 |
|
Why would the NIF need granular data to monitor systemic risks? Why wouldn’t aggregated or netted data be sufficient? |
E-mail |
|
Data aggregation could potentially create serious blind spots. The process of aggregation results in the irretrievable loss of information that could be critical during a crisis. It is not possible to know in advance the most appropriate way to aggregate data for the purposes of systemic risk analysis. The NIF needs to collect and maintain granular data exactly in order to determine the most appropriate ways to aggregate data for the purposes of monitoring systemic risk and responding to crises whose sources cannot be predicted in advance. |
|
Last Updated on Tuesday, 09 March 2010 10:38 |
|
Read more...
|
|
Are there situations where the NIF would collect or use aggregated data? When and why? |
E-mail |
|
Wherever practicable, the NIF would collect data at the most granular level. Aggregation is a one-way street: granular data can be aggregated, but the original detail ordinarily cannot be recovered from aggregated data. Collection of granular data is recognized as a best practice, and it governs data collection strategies at most financial, commercial and telecommunication companies today. It is facilitated by advances in data storage and data access software. Once collected, however, the same data might be used in aggregated form for any number of purposes, such as calculating regional summary statistics, or peer group benchmarks for industry subgroups. “Tick” (or trade-level) data is a good example: data on each trade enables analysis at the most granular level (trade detail), as well as at aggregated levels (end-of-day, quarter by quarter, year over year, etc.). |
|
Last Updated on Tuesday, 24 November 2009 12:44 |
|
Could costs be reduced by collecting smaller volumes of aggregated data, rather than larger volumes of granular data? |
E-mail |
|
To the contrary, it is actually easier, both for regulators and financial firms, if data are collected in the same forms in which they are generated originally. Once data reporting processes are standardized, the least costly and least burdensome way to report transaction data is with the equivalent of an electronic “cc” automatically attached to each trade confirmation message. A requirement that firms aggregate data prior to transmission would actually increase the burdens on firms. |
|
Last Updated on Thursday, 26 November 2009 20:01 |
|
How would the creation of the NIF affect jobs? |
E-mail |
|
The NIF can be expected to increase the efficiency and productivity of financial firms. As required upgrades to IT systems, needed to standardize reporting, are implemented across the industry, there would be increases in operational efficiency. This would likely lead to a decrease in demand for lower-skill jobs involved with routine collection and manipulation of financial data, and an increase in demand for higher-skill and higher paying jobs involved with systems integration and the development of analytic tools and software. |
|
Last Updated on Friday, 27 November 2009 07:42 |
|
How would the NIF affect the commercial data vendors? |
E-mail |
|
By establishing and maintaining reference databases for financial entities and financial instruments and making these available to the public, the NIF would subsume a function currently carried out by commercial data vendors. For these vendors, the maintenance of reference databases constitutes an expensive necessity, rather than a substantial commercial opportunity. The standardization of reference databases would lower costs for the financial data vendors, allowing them to focus their resources on higher-value activities. |
|
Last Updated on Friday, 27 November 2009 07:46 |
|
What burdens would the NIF place on small banks and small financial entities? |
E-mail |
|
Small banks and financial firms already largely rely on off-the-shelf software and services from third-party data and systems vendors for portfolio management. Consequently, the NIF should not impose significant new operational burdens on small banks. In addition, the public reference databases maintained by the NIF would provide benefits to all market participants, particularly those too small to maintain or purchase their own substitute services. In this way, the NIF would help level the playing field for institutions of all sizes. |
|
Last Updated on Friday, 27 November 2009 07:47 |
|
If the U.S. adopts this approach while other jurisdictions do not, how would the competitiveness of U.S. financial markets be affected? |
E-mail |
|
We believe that the creation of the NIF would put the U.S. at a competitive advantage vis-a-vis other jurisdictions. By helping to reduce the threat of hidden systemic risks, the NIF would increase investors' confidence in the U.S. markets. |
|
Last Updated on Friday, 27 November 2009 07:49 |
|
How large would the National Institute of Finance become? |
E-mail |
|
The National Institute of Finance must have the analytic and computational resources needed to measure and monitor systemic risk throughout the financial system, investigate disruptions and changes in risk patterns, and conduct the long-term research needed to support effective systemic risk regulation. The only definitive way to gain a clear picture of system-wide risk will be through large-scale scenario analysis of the financial system and by modeling, at a fine level, how the system responds to a wide-range of shocks. The computational resources needed would be roughly in line with the current, non-classified, high performance computing facility at the Oak Ridge National Laboratory. The staffing and budget for the NIF, when it is fully functioning, would be a substantial fraction of those at existing financial regulatory agencies, such as the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, or the Securities and Exchange Commission. |
|
Last Updated on Friday, 27 November 2009 08:03 |
|
Is such a large data collection effort feasible? |
E-mail |
|
While data volume was once a serious practical concern, the low cost and high performance of modern data processing and storage systems render this concern largely obsolete. The volumes of data handled by the NIF will be comparable to those handled today routinely by existing government agencies such as the National Weather Service. |
|
Last Updated on Friday, 27 November 2009 08:45 |
|
How would the costs of the NIF get paid for? Would it require higher taxes? |
E-mail |
|
As proposed, the NIF would be funded through assessments on the financial institutions that report data to the NIF. Reporting institutions would realize efficiencies from the use of centrally maintained and universally accepted data standards. As proposed, the NIF would not increase the burdens on U.S. taxpayers, nor increase the federal deficit. |
|
Last Updated on Friday, 27 November 2009 18:12 |
|
|
Why would the NIF be funded with non-appropriated funds? |
E-mail |
|
There is a well established precedent in the federal government that agencies involved in the regulation and monitoring of financial firms and markets are funded through assessments placed on the regulated firms. Funding the NIF in this way yields three principle benefits. The first is that the taxpayers would not be burdened with paying the budgetary costs for the NIF. The second is that financial firms will realize significant reductions in operating expenses as a result of the standardization of data systems that will be a core responsibility of the NIF. It would not be fair for the taxpayers to absorb the cost for this effort and then have the financial firms reap all of the financial benefits. The third is that Congress has recognized that attracting the special skills needed to perform this work requires being able to pay salaries that are above the standard civil service pay scale. Funding the NIF with non-appropriated funds makes it possible to pay more competitive salaries. |
|
Last Updated on Friday, 27 November 2009 18:12 |
|
The NIF proposal is ambitious. Is this too much to bite off all at once? |
E-mail |
|
The NIF will not begin its work in a vacuum: it will build on a large base of established work related to data systems and analytics which are important to understanding systemic risk. Indeed, a substantial part of the NIF's development process will involve the integration of existing operational and prototype systems that have already been created in the regulatory, academic, financial and information technology communities. Leveraging these existing efforts will help to ensure the efficient, effective, and timely operation of the NIF. |
|
Last Updated on Thursday, 26 November 2009 19:57 |
|
Does the government have any track record of success in data collection efforts like the NIF? |
E-mail |
|
The Interactive Data Project of the Securities and Exchange Commission (SEC) and the modernized Call Report system of the Federal Financial Institutions Examination Council (FFIEC) are two examples of existing initiatives that require financial firms to submit data in standardized formats. Both are both widely viewed as successful initiatives that were implemented sensibly, in stages, without imposing undue or unreasonable burdens on reporting firms. The NIF would build on the expertise and experience regulators have developed through initiatives such as these. |
|
Last Updated on Friday, 20 November 2009 07:26 |
|
Can the government really do this? |
E-mail |
|
The effort and level of expertise required to establish and maintain the National Institute of Finance will be comparable to those needed for existing large-scale federal entities such as the National Weather Service, Oak Ridge National Laboratory, or Lawrence Livermore National Laboratory. The capacity to develop and maintain the NIF lie well inside the demonstrated capabilities of the U.S. Federal government. |
|
Last Updated on Friday, 20 November 2009 07:16 |
|
Which functions of the NIF would be outsourced to third parties? Which functions would be maintained in-house? |
E-mail |
|
Every operating organization – whether government agencies, businesses, and not-for-profit entities—faces the question of whether to perform an activity “in-house” or whether to “outsource” it. The federal government has well established policies and procedures for making such decisions. The one key distinction for the federal government is that certain things which are “inherently government functions” may not be outsourced. These established policies and procedures would be applied by the NIF to determine the most efficient way to perform its responsibilities and which things should be done “in-house” and which, if any, would be “outsourced.” |
|
Last Updated on Wednesday, 09 December 2009 18:04 |
|
Would the NIF provide information only to regulators? Or would the NIF also provide information to firms and to the public? |
E-mail |
|
The government has well established rules and procedures for distinguishing confidential and non-confidential information. The details of portfolio holdings of individual firms, or of contracts between firms, are proprietary business confidential information; this highly sensitive information would be accessible only to financial regulators and their agents with appropriate clearance, working on authorized tasks. The NIF would publish "reference data," including, for example, unique identifiers for corporate entities and securities issuances, or standardized formats for describing financial contracts. In addition, the NIF would publish certain aggregated statistical information about the state of the financial system, as part of its role in informing Congress, the Executive Branch agencies, and the general public. |
|
Last Updated on Friday, 27 November 2009 08:43 |
|
Would financial institutions outside of the NIF have access to the data? |
E-mail |
|
Financial entities and other institutions (beyond regulatory agencies specifically identified in legislation) would only have access to aggregated data that is deemed public under rules and guidelines established by the NIF. |
|
Last Updated on Friday, 27 November 2009 09:08 |
|
Would the NIF redistribute confidential transaction data from one bank to another? |
E-mail |
|
No. Business confidential information reported by financial institutions to the NIF would not be released to other firms, or to the public. Sensitive business confidential information reported by financial institutions would be accessible only by authorized regulatory personnel carrying out authorized regulatory functions, in accordance with strict data security safeguards. |
|
Last Updated on Friday, 27 November 2009 09:09 |
|
How would access to the data be controlled? |
E-mail |
|
Access to the data contained within the Federal Financial Data Center would be controlled by formal policies and procedures, enforced by access control rules that determine the type of data accessible by various functions and users. These access control policies would be implemented in compliance with current federal standards and best practices. Automated and manual access controls would be a primary focus of the security design and implementation. The development stage would identify the expected users and all possible access privileges to support the processing requirements. Identification controls would be developed to ensure that only authorized users could access the system. Role-based access controls would inventory privileges and entitlements, and would package these into various role groups that would then be assigned carefully to internal and external users based on their responsibilities. |
|
Last Updated on Friday, 27 November 2009 09:15 |
|
Can data security be maintained? |
E-mail |
|
Yes. The U.S. Federal Government has a long-standing and excellent track record in maintaining the security of sensitive financial, military, intelligence and census data. The NIF will adhere to the same data security standards. |
|
Last Updated on Tuesday, 29 September 2009 11:31 |
|
How would security be designed and managed to ensure: (1) the adequacy of the initial security and (2) the maintenance of security at a high level through the life of the NIF program? |
E-mail |
|
The design, assessment, mitigation and risk control processes of the security systems would be in compliance with both the Federal Information Security Management Act (FISMA) and with the guidelines provided by the National Institute of Standards and Technologies. These standards and guidelines are designed to ensure the creation and maintenance of secure systems for the most sensitive U.S. government data. The system would not be implemented without the successful completion of a comprehensive security test and evaluation (ST&E) that determines the adequacy of the designed controls. The system's security would be assessed annually through FISMA-required self-assessment, and every three years through the more rigorous ST&E process. |
|
Last Updated on Friday, 27 November 2009 09:20 |
|
Can the NIF be made secure? |
E-mail |
|
Establishing the NIF as a secure institution is entirely feasible. The anticipated level of risk and associated security requirements are comparable with the security requirements for existing financial entities and secure government facilities and are well within current practices. |
|
Last Updated on Friday, 27 November 2009 11:13 |
|
How will the NIF be made secure? |
E-mail |
|
Considering the sensitivity of the data and the program’s high profile, security will be a high priority. Securing the NIF will require the successful completion of: (1) an independent risk assessment that includes vulnerability testing to evaluate the application’s safeguards against hackers, and (2) an independent security audit prior to implementation that evaluates and tests manual and automated controls within critical control areas that include, but not limited to: access, authentication, accountability, data integrity, and communication. |
|
Last Updated on Friday, 27 November 2009 11:12 |
|
What measures will be used to minimize the risk of access by hackers? |
E-mail |
|
The NIF's Federal Financial Data Center (FFDC) will include preventive hardware and software controls that will minimize the risk of intrusion and damage by hackers (e.g., software and hardware firewalls, role based access controls, intrusion detection systems). Operating the FFDC under best practices, engaging in periodic risk assessments and continuous penetration testing will routinely assess the NIF's processing environment to determine if control upgrades are needed. Incident response controls would identify possible intrusions and quickly initiate automated and manual procedures to prevent or minimize exposure of data and resources. |
|
Last Updated on Friday, 27 November 2009 11:26 |
|
How will data integrity be managed within the NIF application environment? |
E-mail |
|
The NIF's Federal Financial Data Center will be governed in compliance with the Federal Information Security Management Act (FISMA) of 2002. This act defines standards, guidelines and information security requirements for all federal agencies. Included under the regulations and practices are activities designed to ensure the integrity and authenticity of the data. In addition to FISMA, the data will also be subject to the appropriate securities and financial sector regulations. |
|
Last Updated on Friday, 27 November 2009 13:26 |
|
How would the NIF assure that the data it collects are accurate? |
E-mail |
|
Data integrity is not a new challenge. Financial institutions across the marketplace already perform data validation on a daily basis. A variety of techniques are available, including data filtering, tolerance checks, cross-source comparison, and rule-based decision-tree methodologies. This optimal mix of data-validation mechanisms will be determined largely according to the particular type, source, frequency, and scope of the data involved. |
|
Last Updated on Tuesday, 10 November 2009 13:14 |
|
|