Next regular BSP examination can open from Nov 19, 2026

Exam readiness

The first-day request list a BSP IT examiner works from, matched to evidence Northgate already holds. Weeks of screenshots become one binder, every record dated and hashed.

Ready

10 / 17

Ready, with a finding to disclose

5 / 17

Not held yet

2 / 17

First-day request list

Board-approved information security program and minutes

Circ. 982

Ready

GV-01 · DocumentBoard Risk Oversight Committee approved the FY2026 security program

CISO appointment, charter and reporting line

Circ. 982

Ready

GV-01 · DocumentCISO reports to the Board Risk Oversight Committee, not to IT

Information security policy, current version

Circ. 982

Ready

GV-01 · DocumentBoard-approved Information Security Policy v4.2, parsed into 10 testable statements

IT and cyber risk assessment

Circ. 982

Ready

ID-05 · DocumentAnnual IT and cyber risk assessment approved by the Risk Committee

Latest external VA/PT report and remediation tracking

Circ. 982

Ready

ID-03 · DocumentIndependent penetration test of internet and mobile banking ID-03 · ITSMEvery penetration test high is closed or formally risk-accepted

SOC coverage, detection rules and triage metrics

Circ. 982

Ready

DE-02 · EnterpriseThree shifts cover 24x7 with no gaps in 30 days; 218 rules enabled

Incident register and BSP notifications

Circ. 1019

Ready

RS-01 · ITSMAll 3 reportable incidents reached BSP within 2 hours (median 58 minutes)

Incident response exercise report

Circ. 1019

Ready

RS-01 · DocumentExecutives exercised the response plan in a ransomware tabletop

Fraud management system rules and calibration

Circ. 1140, 1213

Ready

DE-05 · Fraud management systemReal-time scoring on 6 of 6 channels, median decision 38 ms DE-05 · Fraud management system41 velocity, device and geolocation rules, calibrated 23 days ago

Customer authentication controls under AFASA

Circ. 1213

Ready, with a finding to disclose

PR-03 · Fraud management systemSMS one-time PIN is still the only factor on 2 of 6 channels PR-03 · Fraud management system24-hour hold after key account changes on all 6 channels

Transaction log retention and integrity

Circ. 1213

Ready, with a finding to disclose

PR-03 · Fraud management systemTransaction logs are tamper-evident and kept for 5 years

Privileged access inventory and vaulting

M-2026-034

Ready, with a finding to disclose

PR-01 · Privilege Cloud23 domain-privileged service accounts sign in outside the vault PR-01 · Privilege CloudAll 412 human administrators vaulted, with session recording

Outsourcing and cloud register with assessments

Circ. 1137

Ready

GV-03 · ITSMAll 38 material providers assessed on cycle, with a right to audit GV-03 · ITSMExit plans on file for all 5 material cloud services

Inventory of AI systems

M-2026-031

Ready, with a finding to disclose

GV-02 · ITSMAI register lists 8 systems; 7 route through the gateway

Backup and restore test results

Circ. 982

Ready, with a finding to disclose

RC-01 · Security Cloud99.7% backup success; immutability on every tier-one system RC-02 · Security CloudTwo tier-one systems have no restore test in 12 months

Signed Cybersecurity Control Self-Assessment

Circ. 1232

Not held yet

Drafted by rule on the CCSA page; waiting for the CISO's signature.

Annual IT Profile submission

Circ. 1232

Not held yet

No copy held. Upload the submitted IT Profile so it joins the binder.

Exam readiness

First-day request list

Search

Exam readiness

First-day request list