Opening Scenario
Imagine a mid‑size regional bank that recently completed a routine OCC examination. The examiner asks to see who can view or edit the bank’s loan‑portfolio data in its new cloud‑based analytics platform. The compliance team scrambles through spreadsheets, IAM dashboards, and ad‑hoc queries, only to discover that several legacy service accounts still hold broad read/write rights. The examiner notes the lack of visibility into privileged access and warns that the institution could be at risk of a regulatory finding for insufficient least‑privilege controls.
The bank’s CDO realizes that without a systematic way to map, monitor, and enforce who sees what data, the organization will repeatedly fall short of the OCC’s expectations.
Thesis: The OCC’s 2024‑34 Bulletin on Data Governance: Access Management and Least‑Privilege Controls makes clear that banks must move from reactive, point‑in‑time checks to continuous, auditable visibility of data access, and must enforce least‑privilege principles in every system.
Problem
The regulatory landscape has shifted from generic IT security mandates to granular data‑access requirements. The OCC’s bulletin (published September 12 2024) outlines three core deficiencies that banks commonly exhibit:
- Opaque Access Trails – Many institutions rely on fragmented logs that do not provide a unified view of who accessed which data sets, when, and for what purpose. Without a consolidated audit trail, examiners cannot verify that access is appropriate.
- Over‑Privileged Identities – Service accounts, legacy admin groups, and “just‑in‑case” permissions remain in production environments long after the original business need has vanished. This inflates the attack surface and violates the principle of least privilege.
- Insufficient Governance Controls – Policies exist on paper but lack automated enforcement.
Manual reviews are infrequent, error‑prone, and cannot keep pace with rapid cloud migrations and third‑party data sharing. In practice, banks often rely on quarterly spreadsheet reconciliations that miss temporary access grants or forgotten service accounts. Those gaps expose banks to a range of risks: regulatory enforcement actions, increased audit remediation costs, and heightened exposure to data‑breach liability under the Gramm‑Leach‑Bliley Act. Moreover, the OCC expects banks to demonstrate continuous monitoring rather than periodic snapshots, echoing the agency’s broader focus on operational resilience.
The OCC bulletin itself emphasizes the need for a real‑time, auditable data‑access graph and cites specific expectations for banks to maintain immutable logs and to provide examiners with point‑in‑time reports. It also references the OCC’s broader supervisory guidance on operational risk, which requires documented risk‑based controls for all critical data environments. For example, the bulletin notes that banks must be able to generate a “who‑has‑access” report within 24 hours of an examiner request, and that any remediation actions must be tracked in a tamper‑evident system.
See the official bulletin for details: OCC Bulletin 2024‑34.
To meet these expectations, banks need more than a periodic review. They require an automated, continuously refreshed inventory of identities, permissions, and data assets, combined with a workflow that can automatically revoke access that no longer aligns with a documented business purpose. The cost of building such capability in‑house often outweighs the benefit, especially for midsize banks that lack dedicated security engineering resources.
The CoComply Approach
CoComply offers a unified platform that translates the OCC’s requirements into actionable controls. By ingesting IAM data from on‑premise directories, cloud providers, and SaaS applications, CoComply builds a real‑time data‑access graph that surfaces every permission, its owner, and the associated data assets. The platform then:
- Provides Visibility: Dashboards display who has access to each data domain, flagging orphaned accounts and dormant privileges for immediate review. The UI includes a time‑travel view that lets auditors see historical permission states, satisfying the OCC’s demand for point‑in‑time evidence. * Enforces Least‑Privilege: Policy engines automatically recommend role reductions based on actual usage patterns, and can enforce remediation through API‑driven de‑provisioning. The engine also supports risk‑scoring thresholds that align with the OCC’s risk‑based supervision model, allowing banks to prioritize high‑risk privileges for rapid action.
- Audits Continuously: Immutable logs are stored in a tamper‑evident ledger, enabling examiners to pull point‑in‑time reports that satisfy the OCC’s evidence‑of‑control expectations. CoComply integrates with popular cloud native security tools such as AWS IAM Access Analyzer, Azure AD Privileged Identity Management, and Google Cloud Asset Inventory. These integrations allow banks to ingest enriched metadata, apply risk‑scoring algorithms, and generate remediation playbooks that align with the OCC’s guidance on risk‑based oversight.
Beyond the core features, CoComply provides a library of pre‑built compliance templates that map directly to OCC bulletin language. For instance, the “Access Review” template automates the generation of a quarterly access certification package that includes a summary of privileged identities, a risk score, and a remediation timeline. The platform also supports automated evidence collection for the OCC’s required 24‑hour “who‑has‑access” report, pulling data from the graph and delivering it in a PDF that includes cryptographic hash verification.
Banks that embed CoComply into their data‑pipeline governance achieve the dual benefit of regulatory compliance and operational efficiency, turning a costly audit pain‑point into a competitive advantage. Real‑world deployments have shown a 40 % reduction in over‑privileged accounts within the first three months and a 30 % improvement in audit readiness scores. In one case study, a regional bank reduced the time to produce an examiner‑requested access report from six hours to under ten minutes, freeing compliance staff to focus on higher‑impact risk analyses.
CoComply also offers a proactive alerting engine that notifies data owners when a new permission is granted that falls outside of established policies. These alerts can be routed through existing security information and event management (SIEM) tools, ensuring that the bank’s security operations center remains aware of privilege escalations in real time. By aligning technical controls with the OCC’s supervisory expectations, CoComply helps banks demonstrate a mature, defense‑in‑depth posture.
Closing Insight
The OCC’s 2024‑34 Bulletin is more than a checklist; it signals a strategic shift toward data‑centric risk management. By adopting continuous access visibility and enforcing least‑privilege controls, banks not only avoid potential enforcement actions but also lay the groundwork for secure, agile data innovation. In a world where data is both a strategic asset and a regulatory liability, the banks that master disciplined access governance will thrive.
Tags: OCC, data governance, access visibility, least privilege, bank compliance, regulatory update