Assess whether the intrusion is still active from model-risk exam request list

Situation

Model-risk exam request list arrived with log sources that were not retained past 30 days for federal intrusion-response lead. That is a US Federal Procurement Contracting decision on the intrusion is still active in a financial institution responding to a FinCEN inquiry.

Decision

Federal intrusion-response lead in a financial institution responding to a FinCEN inquiry must choose Pursue / Pursue with conditions / Partner / No-bid using model-risk exam request list after log sources that were not retained past 30 days.

Hypotheses to test

• Log sources that were not retained past 30 days is noise around an already-controlled Procurement Contracting process in a financial institution responding to a FinCEN inquiry, given model-risk exam request list.
• Log sources that were not retained past 30 days is the event in model-risk exam request list that forces Pursue for federal intrusion-response lead under US Federal.
• Model-risk exam request list shows a one-file miss after log sources that were not retained past 30 days, not a Procurement Contracting program failure.
• Model-risk exam request list cannot decide the intrusion is still active yet after log sources that were not retained past 30 days; hold is the only US Federal close a financial institution responding to a FinCEN inquiry can defend.

Analysis required

• Compare PTW and compliance gates in model-risk exam request list to a pursue / partner / no-bid split.
• Test OCI and SAM.gov status before a financial institution responding to a FinCEN inquiry commits.
• Map FAR, Section L/M, and evaluator priorities in model-risk exam request list after log sources that were not retained past 30 days.
• For this US Federal Procurement Contracting file, read model-risk exam request list against log sources that were not retained past 30 days and write the one fact that would move the intrusion is still active for federal intrusion-response lead.

Recommendation

Choose Pursue / Pursue with conditions / Partner / No-bid on this US Federal / Procurement Contracting packet (model-risk exam request list after log sources that were not retained past 30 days). The follow-on Procurement Contracting action is what federal intrusion-response lead does next: implement the option, assign an owner, and log the missing fact.