Why it matters
Analysis: update control crosswalks and evidence ownership before treating the release as a new remediation mandate. The useful test is whether existing incident response, recovery and third-party evidence can be retrieved and explained under the revised mapping.
What remains uncertain
Banks are not required to use the OCC work program as their own assessment tool. A mapping change does not establish that a particular bank’s controls are sufficient.