The Office of the Comptroller of the Currency (OCC) assessed a $60 million civil money penalty against Morgan Stanley Bank, N.A. and Morgan Stanley Private Bank, N.A. on October 8, 2020. The OCC said the banks’ oversight of the 2016 decommissioning of two U.S. Wealth Management data centers had weaknesses in hardware risk assessment, vendor management and tracking customer data on retired equipment.
Why did the OCC fine Morgan Stanley?
The OCC identified weaknesses in the banks’ controls for decommissioning data-center hardware. Its findings covered the assessment of risks before equipment was retired, the selection and oversight of outside vendors, and the inventory of customer data on the devices.
The OCC described the practices as unsafe or unsound and said they resulted in noncompliance with 12 CFR Part 30, Appendix B, the Interagency Guidelines Establishing Information Security Standards. The $60 million civil money penalty was assessed against both banks and, according to the OCC, would be paid to the U.S. Treasury. OCC release, October 8, 2020
What happened during the data-center decommissioning?
The underlying work took place in 2016 and involved two U.S. Wealth Management data centers. The OCC said the banks did not effectively assess or address risks associated with decommissioning the hardware and did not maintain an appropriate inventory of customer data stored on the retired devices.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems#1 Best Overall
- Save valuable floor space: 6U wall mount server cabinet Dimensions: 13.78" H x21.65" W x17.72" D.Maximum mounting depth is 14.2"
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access. Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punch-out panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
The OCC also faulted the banks’ handling of third parties. Its findings said the banks did not adequately assess risks posed by vendors, including subcontractors, did not perform adequate due diligence when selecting the vendor, and did not adequately monitor the vendor’s work. The consent order records the Comptroller’s findings, but says the bank “neither admits nor denies” them. OCC Consent Order 2020-058
How did the 2019 incident relate to the case?
The consent order says similar vendor-management control deficiencies appeared in 2019 during decommissioning of wide area application services devices. The 2019 work was distinct from the 2016 data-center decommissioning, but the OCC cited it as another instance involving similar weaknesses.
Rank #2
- Save valuable floor space: 12U wall mount server cabinet Dimensions: 24.25" H x21.65" W x17.72" D. MAXIMUM MOUNTING DEPTH is 14.2".
- Keep critical network equipment secure: glass door and side panels are lockable to prevent unauthorized access; Front door can be installed on either side of the front of the cabinet to satisfy your door swing orientation preference
- Easy equipment configuration: Fully adjustable mounting rails and numbered U positions, with square holes for easy equipment mounting with top and bottom punchout panels for easy cable access
- Durability: Made of high quality cold rolled steel holds up to 110lb (50kg) (Easy Assembly Required)
- PCI & HIPPA and EIA/ECA-310-E compliant
According to the order, potentially impacted customers were notified in connection with the 2016 incident at the OCC’s direction. Potentially impacted customers were voluntarily notified in relation to the 2019 incident. The order does not establish how many customers were affected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What controls does the case highlight?
The order describes shortcomings at several stages of decommissioning. For organizations retiring equipment that may hold customer information, the sequence of control concerns is:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sturdy:4u server rack is construct from cold rolled steel, with a weight capacity of 110lbs(50kg); Electrostatic powder coat prevents rust and corrosion,quality finish
- Direct use:Open and use, not having to assemble it.Network rack can be placed flat or mounted on the wall,also can be installed vertically under the table
- Design Features:maximum mounting depth of 14 in,cables can be fixed on the side panel;Open frame server rack achieves effortless inspection, replacement and assemble
- Installation:wall mount network rack is easy to install,with instructions or videos for reference;Equipped with multiple accessories, suitable for different needs
- Application:EIA/ECA-310-E Compliant;wall mounted 4u rack fits all 19" racks and cabinets to hold various IT, network, and AV equipment;wall mount rack available in 4U, 6U, and 8U to choose
- Before the work: assess hardware-decommissioning risks and identify what customer data may be on the equipment.
- When selecting vendors: assess risks from the vendor and its subcontractors, and perform due diligence before engaging them.
- During the work: monitor vendor performance rather than relying only on selection-stage checks.
- After the work: maintain an appropriate inventory of customer data on retired devices and address customer notification when warranted.
These are operational lessons drawn from the OCC’s findings, not a prescribed vendor, product or technical procedure. The order establishes the penalty and findings, but does not establish the banks’ present remediation status or whether the matter has since been closed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
