Assess whether the intrusion is still active (e9efe3)

Situation

The desk packet is fair-lending comparative files for an exam after a SAR the institution filed late after a wire already left. Federal intrusion-response lead in a bank in a fair-lending comparative-file exam has to name Pursue or Pursue with conditions for this US Federal Cybersecurity Threat Intel file.

Decision

Federal intrusion-response lead in a bank in a fair-lending comparative-file exam must choose Pursue / Pursue with conditions / Partner / No-bid using fair-lending comparative files for an exam after a SAR the institution filed late after a wire already left.

Hypotheses to test

• A SAR the institution filed late after a wire already left is noise around an already-controlled Cybersecurity Threat Intel process in a bank in a fair-lending comparative-file exam, given fair-lending comparative files for an exam.
• A SAR the institution filed late after a wire already left is the event in fair-lending comparative files for an exam that forces Pursue for federal intrusion-response lead under US Federal.
• Fair-lending comparative files for an exam shows a one-file miss after a SAR the institution filed late after a wire already left, not a Cybersecurity Threat Intel program failure.
• Fair-lending comparative files for an exam cannot decide the intrusion is still active yet after a SAR the institution filed late after a wire already left; hold is the only US Federal close a bank in a fair-lending comparative-file exam can defend.

Analysis required

• Normalize pricing and CPARS/QASP evidence that actually supports the intrusion is still active.
• Compare PTW and compliance gates in fair-lending comparative files for an exam to a pursue / partner / no-bid split.
• Test OCI and SAM.gov status before a bank in a fair-lending comparative-file exam commits.
• For this US Federal Cybersecurity Threat Intel file, read fair-lending comparative files for an exam against a SAR the institution filed late after a wire already left and write the one fact that would move the intrusion is still active for federal intrusion-response lead.

Recommendation

Choose Pursue / Pursue with conditions / Partner / No-bid on this US Federal / Cybersecurity Threat Intel packet (fair-lending comparative files for an exam after a SAR the institution filed late after a wire already left). Lead with the US Federal option fair-lending comparative files for an exam can support after a SAR the institution filed late after a wire already left, then the two facts that force it, then the Monday action for federal intrusion-response lead in a bank in a fair-lending comparative-file exam.