OpenClearOpenClear's controls rely on the people using it to do their part: a bank, its business customers, and whoever runs OpenClear. These are those parts, the complementary user entity controls (CUECs). Each is filed under the NIST SP 800-53 Rev. 5.1.1 control it carries out, so it can be mapped onto a bank's or a customer's own control inventory. It isn't legal advice (Compliance).
Inventory version 1.0. The same list is in cuecs.json and cuecs.csv; the spreadsheet's last two columns are blank, for your own control id and owner.
Reading the inventory
- Id:
<party>-<NIST control>-<nn>.Bis the bank,Cthe business customer,Hwhoever runs OpenClear (the bank, when it hosts OpenClear itself). Ids never change, and a withdrawn one is never reused. - NIST: the 800-53 Rev. 5 control or enhancement the CUEC carries out. Exports also give
it as NIST's OSCAL id (
AC-2(1)isac-2.1), and list related controls. - Evidence: how OpenClear can show the CUEC operating.
- automated: OpenClear's own data shows whether it operates; a test can attest to it for a period.
- assisted: OpenClear supplies the evidence (a report, an export, a recorded review); a person judges it.
- attested: outside what OpenClear can see; a person attests, and may attach evidence.
- CSF 2.0: the NIST Cybersecurity Framework 2.0 subcategories that NIST's own mapping links to the CUEC's 800-53 control (by subcategory).
- Check: the test that produces the evidence. Each is on the Controls page, keeping a test history from which an automated CUEC can be attested for a period.
The bank
| Id | NIST | CSF 2.0 | CUEC | What OpenClear does | Evidence | Check | How often | Where |
|---|---|---|---|---|---|---|---|---|
| B-AC-2-01 | AC-2 Account Management Related: AC-2(3), PS-4, PS-5 |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Provision and remove staff. Approve each staff member's access before adding them, change it when their job changes, and deactivate them in OpenClear (or in the bank's identity provider) by the bank's own deadline when they leave. | OpenClear grants only what a person's security group allows, records every membership change in the action log, and stops a deactivated person signing in or using a token at once. | assisted | dormant_accounts (live) |
Per event; reviewed quarterly | Users → Export (with last sign-in); user. and membership. in the action log |
| B-AC-2(1)-01 | AC-2(1) Automated System Account Management Related: AC-2, PS-4 |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Keep the identity provider in step. When staff sign on through the bank's identity provider, keep its group mapping and SCIM provisioning in step with the bank's directory, so someone disabled there is disabled in OpenClear. | OpenClear applies SCIM deactivations and group changes as they arrive, and refuses a sign-on the identity provider refuses. | assisted | scim_sync (live) |
Continuous; reviewed quarterly | Settings → Sign-on; scim.* in the action log |
| B-AC-6(7)-01 | AC-6(7) Review of User Privileges Related: AC-2, AC-6 |
PR.AA-05 | Review staff access. At least quarterly, review each staff member's security group, customer scope and account access, remove what's no longer needed, and record the review. | OpenClear exports every membership with its group, scope, account access and last sign-in, and records each change. | assisted | access_review (live) |
Quarterly | Users → Export; the access review record (CT3) |
| B-AC-6-01 | AC-6 Least Privilege Related: AC-6(5), AC-2 |
PR.AA-05 | Give the least access a job needs. Decide who holds admin permissions and keep them few; use customer scope and per-account access where a role is narrower than the whole bank; don't give day-to-day deciders admin permissions. | OpenClear checks every request against the person's permissions, scope and account access. | assisted | privileged_accounts (live) |
Quarterly | Settings → Security groups; Users → Export |
| B-AC-5-01 | AC-5 Separation of Duties Related: AC-6 |
PR.AA-05 | Separate conflicting duties. Design security groups so no group combines conflicting duties, then move segregation of duties from warn to enforce. | OpenClear checks groups against the bank's conflict rules, refuses a breach under enforce (ERR_SOD_VIOLATION) and logs it under either mode, and never lets whoever presented an item decide it. | automated | segregation_of_duties (live) |
Continuous | Settings → Segregation of duties; Controls; sod.violation in the action log |
| B-AC-3(2)-01 | AC-3(2) Dual Authorization Related: AC-5 |
PR.AA-05, PR.DS-10, PR.IR-01 | Use dual control on decisions. Turn on dual control for pay/return decisions where the bank's policy needs a second person, and staff it so a checker is available before every cutoff. | OpenClear holds a recommended decision until a different person approves it, and records both. | automated | dual_control (live) |
Continuous | Settings → Decisions; decision histories in the evidence export |
| B-CM-3-01 | CM-3 Configuration Change Control Related: AC-3(2), CM-5 |
ID.RA-07, PR.PS-01, DE.CM-01, DE.CM-09 | Approve rule and model changes. Have a second admin approve every change to matching rules and scoring models, and approve only changes the bank has assessed. | Under enforce, OpenClear holds a rule or model change until another admin approves it, and records both people. | automated | two_person_changes (live) |
Per change | Settings → Changes; the evidence export's changes |
| B-CM-4-01 | CM-4 Impact Analyses Related: CA-2, CM-3 |
ID.RA-07, PR.PS-01 | Replay before changing rules. Before approving a matching-rule or model change, replay recent presented-item files through it at Model risk and review the variance report. | OpenClear's replay runs the real matching code in a dry run that's rolled back, and keeps the report. | automated | change_impact_replay (live) |
Per change | Settings → Model risk; control runs in the evidence export |
| B-IA-2(1)-01 | IA-2(1) Multi-factor Authentication to Privileged Accounts Related: IA-2, AC-6(5) |
PR.AA-01, PR.AA-03 | Second factor for admins. Make everyone who can change who may do what sign in with a security key or passkey, or only through the bank's identity provider with a second factor there. | OpenClear supports FIDO2 security keys and passkeys, and SSO-only sign-in per bank, and reports admins without either. | automated | admin_mfa (live) |
Continuous | Controls → Admins use a second factor |
| B-IA-2(2)-01 | IA-2(2) Multi-factor Authentication to Non-privileged Accounts Related: IA-2 |
PR.AA-01, PR.AA-03 | Second factor for staff. Require a second factor (a security key or passkey, or the bank's identity provider) of everyone who can decide exceptions or change data; a bank under New York DFS Part 500 (500.12, from November 2025) requires it of every person who signs in. | OpenClear supports FIDO2 security keys and passkeys, and SSO-only sign-in per bank. | automated | staff_mfa (live) |
Continuous | Users → Export; Settings → Sign-on |
| B-IA-2(2)-02 | IA-2(2) Multi-factor Authentication to Non-privileged Accounts Related: IA-2, IA-8 |
PR.AA-01, PR.AA-03 | Second factor at the identity provider. Have the bank's identity provider (and any customer's the bank allows) require a second factor for everyone who signs in to OpenClear through it. | People who sign in through single sign-on are exempt from OpenClear's own security-key requirement, which relies on this; a connection can be set to refuse a sign-in the provider doesn't report as multi-factor. | assisted | — | Yearly | Settings → Sign-on (Require the identity provider to report MFA) |
| B-IA-2(2)-03 | IA-2(2) Multi-factor Authentication to Non-privileged Accounts Related: IA-2, IA-8 |
PR.AA-01, PR.AA-03 | Second factor in online banking. Have the online banking site that shows OpenClear inside its pages sign its users in with a second factor. | An embedded session is started by the online banking site for a user it has already signed in, so it's exempt from OpenClear's own security-key requirement. | attested | — | Yearly | Settings → Embedding in online banking |
| B-IA-5(1)-01 | IA-5(1) Password-based Authentication Related: IA-5, AC-7 |
PR.AA-01, PR.AA-03 | Set the password policy. When password sign-in is on, set the password policy (length, character rules, lockout) to the bank's own standard. | OpenClear enforces the bank's password policy and locks an account after repeated failures. | automated | password_policy (live) |
On change; reviewed yearly | Settings → Password policy; tenant.* in the action log |
| B-IA-5-01 | IA-5 Authenticator Management Related: IA-9 |
PR.AA-01, PR.AA-03 | Look after integration credentials. Rotate API client secrets at least yearly (or use key pairs), keep them in the bank's secret store, and revoke a client when its system is retired. | OpenClear shows each secret only once, stores only its hash, supports private_key_jwt, and reports secrets over a year old. | automated | api_client_secrets (live) |
Continuous | Settings → API clients; Controls → Integration secrets rotated |
| B-MA-4-01 | MA-4 Nonlocal Maintenance Related: AC-2 |
— | Grant support access with care. Grant the platform's support staff access only for a stated reason and period, approve write access only when it's needed, and review each grant. | OpenClear gives support staff no access to a bank except what the bank grants, under their own name, ending on time. | automated | support_access_review (live) |
Per event | Settings → Support access; support_access.* in the action log |
| B-IA-12-01 | IA-12 Identity Proofing Related: AC-2 |
PR.AA-02 | Verify customers' administrators. Verify who a business customer's administrators are, and their authority to act for the customer, before giving them access or letting the customer manage its own people. | OpenClear gives a customer's people access only through the bank, or through administrators the bank has set up. | attested | — | Per event | Customers → People; customer.* in the action log |
| B-AC-2-02 | AC-2 Account Management Related: IA-12 |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Let customers manage themselves with care. Let a customer manage its own people or sign-on only after verifying its administrators, and make sure each customer that manages its own people has one. | OpenClear limits a self-managing customer to its own people, accounts and the roles the bank offers. | automated | customer_self_service (live) |
Continuous | Controls → Customer self-service |
| B-IA-8-01 | IA-8 Identification and Authentication (Non-organizational Users) Related: IA-2(2) |
PR.AA-01, PR.AA-03 | Set how customers sign in. Decide how each business customer's people must sign in (password policy, second factor, the customer's own identity provider) and set it. | OpenClear enforces each customer's password policy, second factors and sign-on connection. | automated | customer_mfa (live) |
On change; reviewed yearly | Customers → Sign-on; Customers → Password policy |
| B-PL-1-01 | PL-1 Policy and Procedures | GV.OC-03, GV.PO-01, GV.PO-02, GV.OV-01, GV.SC-03, ID.IM-01, ID.IM-02, ID.IM-03 | Cover OpenClear in written policies. Cover positive pay in the bank's cybersecurity policies (vendor management, incident response and notification, access control) and its written information security program, and approve them each year (23 NYCRR 500.3; for Massachusetts residents' information, 201 CMR 17.03). | OpenClear's controls and CUECs say what it does and what it relies on the bank for. | attested | — | Yearly | docs/compliance/controls.md; docs/compliance/cuecs.md |
| B-CA-2-01 | CA-2 Control Assessments | ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03 | Support the annual certification. Keep the evidence exports and host attestations that support the bank's annual cybersecurity certification (for New York DFS, by April 15, 23 NYCRR 500.17(b)) for five years. | OpenClear's evidence export is signed, and its host attestations are recorded. | attested | — | Yearly | Settings → Controls → Export evidence |
| B-CM-8-01 | CM-8 System Component Inventory | ID.AM-01, ID.AM-02, PR.PS-01 | Inventory OpenClear. List OpenClear and its host in the bank's asset inventory, with an owner, the data's classification and a recovery time before the decision cut-off (23 NYCRR 500.13). | OpenClear lists the outside services turned on, and the evidence export records the version running. | attested | — | Yearly | Settings → Controls; docs/compliance/tprm.md |
| B-RA-3-02 | RA-3 Risk Assessment | GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-05, ID.RA-01, ID.RA-03, ID.RA-04, ID.RA-05, ID.IM-01, ID.IM-02, ID.IM-03, DE.AE-06, DE.AE-07, RS.AN-08 | Know which accounts are consumer accounts. Identify each account on OpenClear that is a consumer account under Regulation E, and apply the bank's Regulation E procedures to it alongside positive pay, and meet any duty under the CFPB's personal financial data rights rule (12 CFR 1033) for it through the bank's own interfaces. | OpenClear protects business and consumer accounts the same way, and its decision history shows when an item was shown, decided and by whom. | attested | — | Yearly | Customers → Accounts; docs/compliance/nacha.md (Regulation E) |
| B-RA-3-01 | RA-3 Risk Assessment | GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-05, ID.RA-01, ID.RA-03, ID.RA-04, ID.RA-05, ID.IM-01, ID.IM-02, ID.IM-03, DE.AE-06, DE.AE-07, RS.AN-08 | Assess positive pay risk. Include OpenClear in the bank's risk assessment and in the information security program's yearly report to the board (12 CFR 364 App. B III.F), and set each customer's services and default dispositions from it. | OpenClear applies each customer's services and default dispositions as set. | attested | — | Yearly | Customers → Positive pay settings |
| B-RA-3-03 | RA-3 Risk Assessment | GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-05, ID.RA-01, ID.RA-03, ID.RA-04, ID.RA-05, ID.IM-01, ID.IM-02, ID.IM-03, DE.AE-06, DE.AE-07, RS.AN-08 | Keep the check-fraud controls positive pay doesn't provide. Keep account opening and monitoring, kiting detection and stop payments in the bank's own program and the core. | OpenClear catches checks that weren't issued, altered amounts and payees, duplicates and a check cashed at a branch, but sees nothing of how an account was opened or of money moving between accounts. | attested | — | Yearly | The bank's fraud program |
| B-SI-12-02 | SI-12 Information Management and Retention Related: AC-2 |
ID.AM-07, ID.AM-08 | Offboard customers that leave. When a customer leaves the bank or stops positive pay, set its last service day in OpenClear, stop the core sending its items, and keep the records the bank must keep in the core, which is the system of record. | OpenClear ends the customer's sign-in and refuses its accounts' items after the last service day, and deletes its data 90 days later with a signed certificate, unless it's on legal hold. | attested | — | Per event | Customers → a customer's Offboarding; Customers → Deleted customers |
| B-SI-12-03 | SI-12 Information Management and Retention Related: PT-2, AC-3 |
ID.AM-07, ID.AM-08 | Keep custom fields to what positive pay needs. Define custom fields on customers and accounts only for what the service needs (identifiers, codes), never a taxpayer id, a password or personal data with no use here; mark a field shown to the customer only when the customer should see it; and review the fields yearly. | OpenClear limits fields to 25 per kind, records every definition and value change with before and after, shows a customer only fields marked for it, says what not to store on the page where fields are defined, and warns while a required field is empty. | attested | — | Yearly | Settings → Custom fields; the action log |
| B-RA-3-04 | RA-3 Risk Assessment Related: SI-4 |
GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-05, ID.RA-01, ID.RA-03, ID.RA-04, ID.RA-05, ID.IM-01, ID.IM-02, ID.IM-03, DE.AE-06, DE.AE-07, RS.AN-08 | Screen for sanctions where the money moves. Screen accountholders, people cashing checks, payees where the bank's risk assessment calls for it, and inbound IAT parties for OFAC sanctions in the core, teller and ACH systems. A pay decision in OpenClear isn't an OFAC clearance. | OpenClear doesn't screen for sanctions. It shows the payee as issued, as read from the image and as typed at a branch, so a bank can check one when it has reason to. | attested | — | Yearly | docs/compliance/fincen-ofac.md |
| B-SC-28-01 | SC-28 Protection of Information at Rest Related: MP-4 |
PR.DS-01 | Protect downloads on the bank's devices. Encrypt laptops and portable media that hold OpenClear exports, decision files or check images, and keep such files off unmanaged devices (201 CMR 17.04(5)). | OpenClear records each export and download in the action log. | attested | — | Yearly | The bank's device management |
| B-RA-3-05 | RA-3 Risk Assessment Related: CA-7, CM-4 |
GV.RM-06, GV.RM-07, GV.SC-03, GV.SC-09, GV.SC-10, ID.AM-05, ID.RA-01, ID.RA-03, ID.RA-04, ID.RA-05, ID.IM-01, ID.IM-02, ID.IM-03, DE.AE-06, DE.AE-07, RS.AN-08 | Govern the scoring model. Before turning fraud scoring on, inventory the bank's model under its model-risk or AI policy, tier it and name an owner; while it's on, review its metrics, champion/challenger record and replays at least yearly, and turn it off if they degrade. | OpenClear keeps scoring off until the bank turns it on, activates a model only after 200 of the bank's own decisions, learns only from decisions people made, and shows each model's metrics and how it was chosen. | attested | — | Yearly | Settings → ML models; docs/compliance/ai-rmf.md |
| B-SI-12-01 | SI-12 Information Management and Retention Related: MP-6 |
ID.AM-07, ID.AM-08 | Set retention and disposal. Decide how long positive pay records (issued checks, items, images, decisions) are kept and how they're disposed of, and at exit obtain the host's record that the bank's data was deleted (12 CFR 364 App. B II.B.4, III.C.4). | OpenClear keeps a bank's business records until the bank leaves; then, after the bank is told and a wait, it deletes them and signs a certificate whose action-log hash lets the bank check its final export is complete. | attested | — | Yearly, and at exit | Settings → Data export; the deletion certificate |
| B-CA-7-01 | CA-7 Continuous Monitoring Related: SI-4 |
ID.RA-01, ID.RA-07, ID.IM-01, ID.IM-02, ID.IM-03, DE.CM-01, DE.CM-02, DE.CM-03, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Act on control status. Watch control status (the Controls page, the API, or control.status.changed in the SIEM) and investigate a WARN or FAIL by the bank's own deadline. | OpenClear tests its controls hourly and raises a security event when one changes. | automated | control_response (live) |
Continuous | Settings → Controls; control.status.changed security events |
| B-CA-7-02 | CA-7 Continuous Monitoring Related: CA-2, SI-4 |
ID.RA-01, ID.RA-07, ID.IM-01, ID.IM-02, ID.IM-03, DE.CM-01, DE.CM-02, DE.CM-03, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Run the anomaly-capture test. Turn on the daily anomaly-capture test, and investigate any synthetic fraud it misses. | OpenClear's anomaly-capture test runs injected fraud through the bank's live rules in a dry run and records what was caught. | automated | anomaly_capture (live) |
Daily | Settings → Model risk; Controls → Synthetic fraud caught |
| B-AU-6-01 | AU-6 Audit Record Review, Analysis, and Reporting Related: AU-6(1), SI-4 |
PR.PS-04, DE.AE-02, DE.AE-03 | Review security events and the action log. Send OpenClear's security events to the bank's SIEM (or read them through the API), alert on the ones that matter to the bank, and review the action log for unusual activity. | OpenClear records every state-changing action in a signed, hash-chained log, and delivers security events in order and at least once. | automated | event_delivery (live) |
Continuous | Settings → Security event forwarding; Controls → Security events delivered |
| B-AU-11-01 | AU-11 Audit Record Retention Related: SI-12 |
PR.PS-04 | Keep the evidence. Take an evidence export at least quarterly and keep it, with the action log's archives, for as long as the bank's retention schedule requires, in storage the bank controls; under New York DFS Part 500 (500.6), keep decision records five years and security events three, in the bank's SIEM, since OpenClear keeps security events 30 days by default. | OpenClear's evidence export is signed, so it can be checked years later without OpenClear. | assisted | evidence_export (live) |
Quarterly | Settings → Controls → Export evidence |
| B-SI-4-01 | SI-4 System Monitoring Related: IR-4 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Decide every exception in time. Staff the exception queue so every exception is decided, by the customer or the bank, before its deadline. | OpenClear raises exceptions with their deadline, reminds before the cutoff, and applies the default disposition to anything left undecided. | automated | sla (live) |
Daily | Controls → Decisions and imports on time |
| B-SI-4-02 | SI-4 System Monitoring Related: RA-3 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Monitor incoming ACH credits for fraud. Run, and review at least yearly, the bank's own risk-based process to identify incoming ACH credits initiated by fraud, as the Nacha Rules require of every RDFI from 2026. | OpenClear's ACH positive pay monitors debits only and isn't that process; its evidence export summarizes debits, exceptions and returns for the bank's fraud-monitoring file. | attested | — | Yearly | Settings → Controls → Export evidence (ach_monitoring) |
| B-IR-6-03 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Treat an unauthorized consumer return as a notice of error. When a consumer account's ACH debit is returned as unauthorized through OpenClear, treat it as the consumer's notice under Regulation E and meet the investigation, provisional-credit and reporting times in 12 CFR 1005.11. | OpenClear records the decision, its reason, who made it and when, with notes and images, in the evidence and data exports. | attested | — | Yearly | Exceptions; Settings → Controls → Export evidence |
| B-IR-6-04 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Return late unauthorized consumer debits on time. For a consumer debit reported unauthorized after OpenClear's decision, return it by the opening of the sixth banking day after the bank finishes reviewing the signed Written Statement of Unauthorized Debit. | OpenClear decides debits before they post; a late claim is the bank's, through its core. | attested | — | Yearly | The bank's core and procedures |
| B-IR-6-05 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Name incident contacts. Name at least one incident contact in OpenClear, with the CEO and CIO as the fallback, keep them current, and confirm them each year. | OpenClear sends the service provider's incident notices to them, and warns while there are none or they're a year old. | automated | incident_contacts (live) |
Yearly | Settings → Incident contacts |
| B-IR-6-06 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Notify the FDIC within 36 hours. Decide whether an incident involving OpenClear is a notification incident and, if so, notify the FDIC supervisory office as soon as possible and within 36 hours of that determination (12 CFR 304.23). | OpenClear's incident notice gives the bank the facts and when it was told, recorded with its acknowledgement. | attested | — | Per event | Settings → Incident contacts (notices received) |
| B-IR-6-07 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Notify New York DFS within 72 hours. A bank supervised by New York DFS notifies DFS within 72 hours of determining that a cybersecurity incident occurred at OpenClear's host, and updates DFS with material new information (23 NYCRR 500.17(a)). | OpenClear's incident notice gives the bank the facts and when it was told. | attested | — | Per event | Settings → Incident contacts (notices received) |
| B-IR-6-08 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Report check fraud to FinCEN, and keep SARs out of OpenClear. Decide and file suspicious activity reports for check fraud by the bank's own procedure, using OpenClear's records as supporting documentation (with the key term FIN-2023-MAILTHEFT where it applies), and never record in OpenClear that a SAR was or wasn't filed (31 CFR 1020.320(e)). | OpenClear keeps the victim-side facts a narrative needs (as issued, as presented, images, decisions, branch attempts) and has no field for a SAR; customer users and support staff can read notes and reasons. | attested | — | Per event | docs/compliance/fincen-ofac.md |
| B-IR-6-02 | IR-6 Incident Reporting Related: AU-11 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Obtain and keep Written Statements of Unauthorized Debit. Obtain a Written Statement of Unauthorized Debit from a customer who reports a consumer ACH debit as unauthorized, as the Nacha Rules require, and keep it for the period they set. | OpenClear shows customers the bank's own statement form (Markdown, HTML or a PDF) and warns while a bank that returns consumer debits has none published. | assisted | wsud_form (live) |
Yearly | Settings → Unauthorized debit statement |
| B-SI-3-01 | SI-3 Malicious Code Protection Related: SI-4 |
PR.DS-01, PR.DS-02, PR.DS-10 | Scan files for malware. Use commercially standard malware detection on the computers and systems that send files to OpenClear, and on files staff download from it. | OpenClear accepts only the file types it reads, re-encodes images, and can check every upload with ClamAV and VirusTotal's hash lookups, refusing malware and quarantining a file found later (both optional). | attested | — | Yearly | Settings → Outside services (malware scanning); file.malware_detected in the action log |
| B-CA-3-03 | CA-3 Information Exchange Related: SA-9 |
ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10 | Put loss allocation in the positive pay agreement. Agree in writing with each positive pay customer the cut-off, the default decision, that undecided items follow it, the customer's duty to send issue files before checks are presented and to review exceptions, and how loss falls if it doesn't (UCC 4-103), and have counsel confirm it under the state's UCC. | OpenClear records the settings the agreement names, and for each item when it was raised, shown, decided and by whom. | attested | — | On change; reviewed yearly | Customers → Default decision; Settings → Decision cut-off |
| B-CA-3-04 | CA-3 Information Exchange Related: SI-4 |
ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10 | Return checks in time. Set cut-offs so the core can send every return before the midnight deadline and Regulation CC's expeditious-return time (12 CFR 229.31(b)), and give notice of nonpayment for returns of $5,000 or more (229.31(c)) from the core. | OpenClear keeps each check's decision deadline within its midnight deadline, counted from the day it was presented, and flags a decision sent after it. | automated | return_deadline (live) |
Daily | Settings → Decision cut-off; Controls → Checks decided within their return deadline |
| B-SI-4-03 | SI-4 System Monitoring Related: CP-2 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Tell OpenClear the bank's banking days. Record the days the bank is closed, and whether it opens on the Federal Reserve's holidays, so deadlines follow the bank's banking days. | OpenClear counts a check's return deadline in the bank's banking days. | attested | — | Yearly | Settings → Decision cut-off |
| B-AU-11-02 | AU-11 Audit Record Retention Related: SI-12 |
PR.PS-04 | Keep decision records for disputes. Keep exception, decision and image records at least as long as UCC claims can be brought (at least a year, UCC 4-406(f)), plus any litigation hold. | OpenClear keeps every decision, its revisions and the action log, signed, and exports them. | attested | — | Yearly | Settings → Controls → Export evidence; Settings → Data export |
| B-CA-3-01 | CA-3 Information Exchange Related: SI-7 |
ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10 | Connect the core. Agree and document the interface with the core system (presented items in, decisions out), and confirm decisions are applied in the core before its cutoff. | OpenClear delivers decisions through the decision outbox, retries, and reports a late or failing delivery. | automated | decision_delivery (live) |
Daily | Settings → Decision delivery; Controls → Decisions and imports on time |
| B-SI-7-01 | SI-7 Software, Firmware, and Information Integrity Related: SI-10, CA-3 |
ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-02, DE.CM-09 | Reconcile presented items. Reconcile each presented-items file OpenClear loads (its item count and total) against what the core sent, and investigate a difference. A posted-check layout that names the file's trailer does this for you; reconcile the files without one yourself. | OpenClear stores each file with its SHA-256 and a signature, and reports the items and total it loaded. A file read by a posted-check layout with a trailer is refused whole, and raised as a security event, when its lines don't add up to the trailer. | assisted | file_reconciliation (live) |
Daily | Bulk uploads; the file's details |
| B-CA-3-02 | CA-3 Information Exchange Related: SA-9 |
ID.AM-03, PR.DS-01, PR.DS-02, PR.DS-10 | Agree reverse positive pay in writing. Before putting a customer's account on reverse positive pay, agree it in writing with the customer, including that every check they don't return by the cut-off is paid, and keep the agreement. | OpenClear puts an account on reverse positive pay only as a protected change, and lists the accounts on it and those put on it in the last 30 days. | assisted | reverse_accounts_agreed (live) |
On change | Customers → an account's Check review |
| B-CP-2-02 | CP-2 Contingency Plan Related: SI-4 |
ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04, PR.IR-02, PR.IR-03, RC.RP-03, RC.CO-04 | Set the teller fallback. Decide what the teller platform does when OpenClear doesn't answer a verification in time (for example, decline above an amount), configure it in the teller platform, and train tellers on it. | OpenClear answers a verification quickly and says plainly when a check can't be cashed, but can't enforce what a teller does when it can't be reached. | attested | — | Yearly | The teller platform; docs/guides/teller.md |
| B-CP-2-01 | CP-2 Contingency Plan Related: CP-4 |
ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04, PR.IR-02, PR.IR-03, RC.RP-03, RC.CO-04 | Plan for an outage at the cutoff. Include positive pay in the bank's business continuity plan: what happens to exceptions and decisions if OpenClear or the core is unavailable at the cutoff, and who decides by hand. | OpenClear applies each account's default disposition to undecided exceptions, and keeps the decisions to send once the core is back. | assisted | default_dispositions (live) |
Yearly | Customers → Positive pay settings |
| B-CP-2-03 | CP-2 Contingency Plan Related: CP-4 |
ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04, PR.IR-02, PR.IR-03, RC.RP-03, RC.CO-04 | Exercise the cutoff outage plan. Exercise B-CP-2-01's plan at least yearly, including getting pay and return decisions to the core before the return deadline without OpenClear, check the bank's recovery objectives against the host's, and record the result. | OpenClear shows the host's recovery objectives and last restore test on the Controls page. | assisted | recovery_objectives (live) |
Yearly | Controls → Recovery objectives stated |
| B-AT-3-01 | AT-3 Role-based Training | PR.AT-01, PR.AT-02 | Train the deciders. Train staff who decide exceptions (fraud red flags, return deadlines and reasons, when to call the customer) before they get access, and each year. | OpenClear shows the information a decision needs, but can't judge whether the person deciding has been trained. | attested | — | Yearly | The bank's training records |
| B-IR-6-01 | IR-6 Incident Reporting Related: IR-4, IR-8 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Handle incidents involving OpenClear. Include OpenClear in the bank's incident response plan, keep the bank's incident contacts current with whoever hosts it, and report incidents involving it as the bank's rules require, notifying customers and the FDIC as 12 CFR 364 App. B Supplement A requires even when the unauthorized access was at the host. | OpenClear's action log, security events and evidence export reconstruct who did what, and when. | attested | — | Yearly | The bank's incident response plan |
| B-SA-4-01 | SA-4 Acquisition Process | GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-08, ID.RA-09, ID.IM-03, DE.CM-06 | Check accessibility against the bank's obligations. Compare OpenClear's accessibility statement with the bank's own ADA and policy obligations, and report any barrier the bank's staff or customers meet. | OpenClear checks WCAG 2.2 A and AA automatically on every build, and states what isn't yet checked. | attested | — | Yearly | docs/compliance/accessibility.md |
| B-SA-9-02 | SA-9 External System Services | GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-02, ID.AM-04, DE.CM-06 | Write OpenClear into the third-party policy. Assess OpenClear and its host under the bank's third-party service provider policy before use and periodically, with a contract covering access controls and multi-factor sign-in, encryption, notice of cybersecurity events affecting the bank or unauthorized access to its customers' information, representations and warranties, and deletion at exit (23 NYCRR 500.11; 12 CFR 364 App. B III.D; 201 CMR 17.03(2)(f)). | OpenClear supplies the controls, CUECs, host attestations, security metrics and evidence export a contract and an assessment rely on. | attested | — | Yearly | docs/compliance/tprm.md; docs/compliance/nydfs.md |
| B-SA-9-03 | SA-9 External System Services | GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-02, ID.AM-04, DE.CM-06 | Tell the FDIC about the service relationship. Notify the FDIC of the relationship with OpenClear's host within 30 days of the contract or the first service, whichever is first (Bank Service Company Act § 7(c)). | OpenClear's documentation names the services it performs, for the notice to describe. | attested | — | Once, and on change | The bank's records |
| B-SA-11-01 | SA-11 Developer Testing and Evaluation | ID.RA-09, ID.IM-01, ID.IM-02, ID.IM-03, PR.PS-06 | Evaluate OpenClear as an externally developed application. Review OpenClear's security evidence (the ASVS crosswalk, the threat model, advisories and each release's security metrics) each year and before a major upgrade (23 NYCRR 500.8). | OpenClear publishes them with each release. | attested | — | Yearly | docs/compliance/asvs.md; docs/security/threat-model.md; the release notes |
| B-SA-9-01 | SA-9 External System Services Related: SR-6 |
GV.OC-05, GV.SC-04, GV.SC-05, GV.SC-06, GV.SC-07, GV.SC-08, GV.SC-09, GV.SC-10, ID.AM-02, ID.AM-04, DE.CM-06 | Assess the outside services turned on. Assess each outside service the bank turns on (email and SMS providers, cloud OCR, object storage, identity providers, a hosting provider) as a third party, and review it each year. | OpenClear turns no outside service on by itself, and shows which ones are on. | assisted | outside_services (live) |
Yearly | Settings; docs/compliance/tprm.md |
| B-SC-8-01 | SC-8 Transmission Confidentiality and Integrity Related: SC-8(1), CA-3 |
PR.DS-02 | Secure the bank's integrations. Point webhooks and decision delivery at HTTPS endpoints on the bank's systems, and check each webhook's signature before acting on it. | OpenClear signs every webhook, and delivers only to a public HTTPS address. | assisted | integration_tls (live) |
On change | Settings → API clients and webhooks |
The business customer
| Id | NIST | CSF 2.0 | CUEC | What OpenClear does | Evidence | Check | How often | Where |
|---|---|---|---|---|---|---|---|---|
| C-AC-2-01 | AC-2 Account Management Related: PS-4, AC-2(3) |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Manage the customer's own people. When the customer manages its own people, add only people it has approved, change their role when their job changes, and deactivate them the day they leave. | OpenClear keeps a customer's people to its own accounts and to the roles the bank offers, and records every change. | assisted | customer_dormant_users (live) |
Per event; reviewed quarterly | People; the customer's action log |
| C-AC-2-02 | AC-2 Account Management Related: PS-4 |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Tell the bank about joiners and leavers. When the bank manages the customer's people, tell the bank promptly when someone joins, changes role or leaves. | OpenClear removes a person's access as soon as the bank deactivates them. | attested | — | Per event | The customer's own records |
| C-AC-2(1)-01 | AC-2(1) Automated System Account Management Related: IA-2(2), PS-4 |
PR.AA-01, PR.AA-05, PR.DS-10, DE.CM-01, DE.CM-03 | Run the customer's identity provider. When the customer's people sign on through its own identity provider, require a second factor there and disable leavers there. | OpenClear accepts only the customer's verified email domains from its identity provider, and applies SCIM changes as they arrive. | assisted | customer_sso (live) |
Continuous | Sign-on (customer) |
| C-AC-6(7)-01 | AC-6(7) Review of User Privileges Related: AC-2 |
PR.AA-05 | Review the customer's access. At least quarterly, review who in the customer can see and decide its items, and remove what's no longer needed. | OpenClear lists the customer's people with their role, accounts and last sign-in. | assisted | customer_access_review (live) |
Quarterly | People → Export |
| C-AC-5-01 | AC-5 Separation of Duties Related: AC-6 |
PR.AA-05 | Separate issuing from deciding. Where the customer's size allows, keep apart the people who issue checks or upload issue files and the people who decide exceptions. | OpenClear never lets the person who submitted an item decide its exception. | automated | customer_sod (live) |
Quarterly | People |
| C-IA-2-01 | IA-2 Identification and Authentication (Organizational Users) Related: IA-2(2), IA-5 |
PR.AA-01, PR.AA-03 | Protect sign-in. Sign in with a security key or passkey, or through the customer's identity provider, and never share credentials. | OpenClear supports FIDO2 security keys and passkeys, and the customer's own identity provider. | automated | customer_mfa (live) |
Continuous | People; Security |
| C-IA-5-01 | IA-5 Authenticator Management Related: IA-9 |
PR.AA-01, PR.AA-03 | Look after the customer's API credentials. Rotate the customer's API client secrets (or use key pairs), keep them out of source code and shared drives, and revoke a client when its system is retired. | OpenClear shows each secret only once, stores only its hash, and supports key pairs. | automated | customer_api_client_secrets (live) |
Continuous | API clients (customer) |
| C-SI-7-01 | SI-7 Software, Firmware, and Information Integrity Related: SI-10 |
ID.RA-09, PR.DS-01, PR.DS-02, PR.DS-10, PR.PS-02, DE.CM-09 | Send every issued check. Send OpenClear every check the customer issues, and every void, before the check can be presented, complete and accurate (serial, amount, date, and payee where the bank matches payees). | OpenClear matches presented items against what the customer sent, and raises an exception for anything that differs. | assisted | — | Every issue run | Issued items; uploads |
| C-SI-10-01 | SI-10 Information Input Validation Related: SI-7 |
PR.DS-10 | Correct rejected rows. Review each upload's result and correct or resubmit any rejected rows the same business day. | OpenClear validates every row, rejects what it can't match on, and says why. | assisted | rejected_rows (live) |
Every upload | Uploads → result |
| C-SI-4-02 | SI-4 System Monitoring Related: IR-6 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Review statements promptly. Examine bank statements and paid items with reasonable promptness, and report any unauthorized or altered item to the bank at once (UCC 4-406). | OpenClear shows each exception with its deadline, and records what the customer saw and decided. | attested | — | Monthly | The bank's statements; Exceptions |
| C-SI-4-01 | SI-4 System Monitoring Related: IR-4 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Decide exceptions every day. Review exceptions every business day, decide each before its deadline, and return anything not recognized. | OpenClear raises exceptions with their deadline, reminds before the cutoff, and applies the default disposition otherwise. | automated | customer_decision_timeliness (live) |
Daily | Exceptions |
| C-AC-3-01 | AC-3 Access Enforcement | PR.AA-05, PR.DS-10, PR.IR-01 | Keep ACH authorizations current. Keep the ACH debit authorizations (who may debit each account, and up to how much) current, and revoke one when the relationship ends. | OpenClear raises an exception for an ACH debit no authorization covers. | assisted | stale_ach_authorizations (live) |
Quarterly | ACH authorizations |
| C-IR-6-01 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Report fraud at once. Report suspected fraud or an unauthorized debit to the bank at once, and complete the bank's statement of unauthorized debit when the bank asks for one (the Nacha Rules require it for consumer accounts). | OpenClear shows the customer the bank's statement form, and returns the debit when the customer decides to. | attested | — | Yearly | Unauthorized debit statement; Exceptions |
| C-SC-28-01 | SC-28 Protection of Information at Rest Related: MP-4, SI-12 |
PR.DS-01 | Protect what's downloaded. Treat reports, exports and check images downloaded from OpenClear as confidential: store them encrypted, share them only with those who need them, and delete them when no longer needed. | OpenClear limits downloads to the customer's own accounts and records each export. | attested | — | Yearly | The customer's own records |
| C-AT-2(3)-01 | AT-2(3) Social Engineering and Mining Related: AT-2 |
PR.AT-01 | Train against fraud and social engineering. Train the people who issue checks and decide exceptions on check fraud and social engineering, such as fake requests to change payment details or to pay an item. | OpenClear shows the information a decision needs, but can't judge whether the person deciding has been trained. | attested | — | Yearly | The customer's training records |
| C-CM-4-01 | CM-4 Impact Analyses | ID.RA-07, PR.PS-01 | Test integration changes. Test changes to the customer's own integration (issue-file exports, API clients) in the sandbox before using them in production. | OpenClear's sandbox runs the same API and file formats as production. | attested | — | Per change | The customer's change records |
Whoever runs OpenClear: the bank when it hosts OpenClear itself, or its hosting provider
| Id | NIST | CSF 2.0 | CUEC | What OpenClear does | Evidence | Check | How often | Where |
|---|---|---|---|---|---|---|---|---|
| H-SC-28(1)-01 | SC-28(1) Cryptographic Protection Related: SC-28, SC-12 |
PR.DS-01 | Encrypt storage at rest. Encrypt the database, file storage (check images, uploads, archives) and backups at rest, and record how in OPENCLEAR_STORAGE_ENCRYPTION_ATTESTATION. | OpenClear encrypts stored secrets itself (AES-256-GCM) and shows the host's statement on the Controls page. | assisted | storage_encryption (live) |
On change; reviewed yearly | Controls → Disk and database encryption |
| H-SC-12-01 | SC-12 Cryptographic Key Establishment and Management Related: SC-13 |
PR.DS-01, PR.DS-02 | Manage the keys. Generate the signing keys and the field-encryption key outside the image, keep them in a secret store, restrict who can read them, and rotate them on the host's schedule. | OpenClear refuses to start in production with development keys, versions its encryption key and re-encrypts on rotation. | assisted | key_age (live) |
Yearly | Controls → Production settings |
| H-SC-8(1)-01 | SC-8(1) Cryptographic Protection Related: SC-8, SC-23 |
PR.DS-02 | Serve only over HTTPS. Terminate HTTPS with a current certificate and modern TLS in front of OpenClear, and never serve it over plain HTTP. | OpenClear sets secure, SameSite cookies and a strict Content Security Policy. | automated | transport_security (live) |
Continuous | scripts/edge_check.py |
| H-SC-7-01 | SC-7 Boundary Protection Related: SC-5 |
PR.DS-01, PR.DS-02, PR.DS-10, PR.IR-01, DE.CM-01 | Lock down the origin. Let only the edge network reach OpenClear, keep the database and storage off the internet, and record how the origin is locked down. | OpenClear checks edge headers come from trusted ranges, and accepts an edge secret. | automated | edge (live) |
Continuous | Controls → Edge network set up |
| H-CM-6-01 | CM-6 Configuration Settings Related: CM-2 |
PR.PS-01, DE.CM-09 | Run with production settings. Run production with production settings: real keys, no development defaults, and the scheduled control tests on. | OpenClear checks its own settings at startup and on the Controls page. | automated | production_safety (live) |
Continuous | Controls → Production settings |
| H-CP-9-01 | CP-9 System Backup Related: CP-4, CP-10 |
PR.DS-01, PR.DS-10, PR.DS-11, PR.IR-03, RC.RP-03 | Back up and test restores. Back up the database and file storage, encrypted and kept apart from the primary, with at least one copy immutable or offline behind sign-in separate from production; state how long backups are kept; and test a clean restore at least yearly. | OpenClear's database migrations upgrade and downgrade, and its action log verifies after a restore. | attested | — | Daily; restore tested yearly | The host's backup records |
| H-CP-2-01 | CP-2 Contingency Plan Related: CP-4 |
ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04, PR.IR-02, PR.IR-03, RC.RP-03, RC.CO-04 | State recovery objectives. State the installation's recovery time and recovery point objectives, record them and each restore test's date in OpenClear's settings, and give the banks the restore tests' results. | OpenClear shows them on every bank's Controls page, and warns when they're missing or the test is over a year old. | automated | recovery_objectives (live) |
Yearly | Controls → Recovery objectives stated |
| H-SI-2-01 | SI-2 Flaw Remediation Related: RA-5 |
ID.IM-01, ID.IM-02, ID.IM-03, PR.PS-02 | Apply updates. Apply OpenClear releases, and operating system, database and dependency patches, within the host's patching deadlines. | OpenClear publishes versioned releases with a changelog, and shows the running version. | assisted | software_currency (live) |
Monthly | /openapi.json version; CHANGELOG.md |
| H-RA-5-01 | RA-5 Vulnerability Monitoring and Scanning Related: SI-2 |
GV.SC-10, ID.RA-01, ID.RA-08, ID.IM-01, ID.IM-02, ID.IM-03 | Scan for vulnerabilities. Scan the servers, container images and database for vulnerabilities, and fix what's found within the host's deadlines. | OpenClear's source and dependencies are public for anyone to scan. | attested | — | Monthly | The host's scan records |
| H-AC-6(5)-01 | AC-6(5) Privileged Accounts Related: IA-2(1), AC-2 |
PR.AA-05 | Limit administrative access to the host. Limit access to the servers, database and secret store to named administrators using a second factor, and log it. Platform staff reach a bank's data only through the bank's support access grants. | OpenClear gives platform staff no way into a bank except a grant the bank makes. | assisted | platform_staff (live) |
Quarterly | Support access; the host's access records |
| H-AU-9(2)-01 | AU-9(2) Store on Separate Physical Systems or Components Related: AU-11, AU-6 |
PR.DS-10 | Keep logs off the host. Send the installation's security events and logs to a system the application's administrators can't change, and keep action-log archives in write-once storage. | OpenClear signs and chains the action log, and delivers security events to the installation's destination. | automated | event_delivery (live) |
Continuous | Controls → Security events delivered |
| H-SI-4-01 | SI-4 System Monitoring Related: CA-7 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03, PR.DS-01, PR.DS-02, PR.DS-10, DE.CM-01, DE.CM-06, DE.CM-09, DE.AE-02, DE.AE-03 | Watch that it's running. Monitor /health, the job queue and the scheduled jobs, and alert someone when they stop. | OpenClear reports its health and each scheduled job's last run. | assisted | scheduled_jobs (live) |
Continuous | /health; Controls |
| H-IR-6-01 | IR-6 Incident Reporting Related: IR-4, IR-8 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Notify banks of incidents. Issue an incident notice in OpenClear (Platform → Incidents) to each affected bank as soon as possible after determining an incident that has disrupted or degraded its service, or is likely to, for four hours or more (12 CFR 304.24), or a cybersecurity event affecting its systems or data (23 NYCRR 500.11(b)(3)), and follow the runbook's Incidents section. | OpenClear emails each bank's incident contacts, shows the notice until the bank acknowledges it, and records both. | attested | — | Per event | Platform → Incidents; the host's incident records |
| H-IR-6-02 | IR-6 Incident Reporting Related: IR-4 |
PR.IR-03, RS.MA-01, RS.MA-02, RS.MA-03, RS.MA-04, RS.AN-06, RS.AN-07, RS.CO-02, RS.CO-03, RC.CO-03 | Notify banks of unauthorized access to their customers' information. Notify each affected bank as soon as possible of unauthorized access to its customer information, whether or not it disrupted the service, with what the logs show was reached (12 CFR 364 App. B Supplement A). | OpenClear's action log records who viewed check images and who exported data, so the reach can be shown. | attested | — | Per event | Platform → Incidents; the bank's action log |
| H-PS-3-01 | PS-3 Personnel Screening | — | Screen the host's staff. Screen everyone with access to the installation or to banks' data before granting it, as the banks' contracts require (12 CFR 364 App. B III.C.1.e). | OpenClear gives platform staff no way into a bank except a grant the bank makes, and logs what they do. | attested | — | On hire | The host's personnel records |
| H-IR-8-01 | IR-8 Incident Response Plan Related: IR-4 |
ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04, PR.IR-03, DE.AE-03, DE.AE-08, RS.MA-01, RS.MA-05, RS.AN-08, RC.RP-01, RC.RP-02, RC.RP-04, RC.RP-06 | Keep an incident response plan. Keep an incident response and recovery plan for the installation (roles, decisions, communications with the banks, root cause), and test it each year. | OpenClear's runbook has an Incidents section to build the plan on. | attested | — | Yearly | RUNBOOK.md (Incidents) |
| H-AT-2-01 | AT-2 Literacy Training and Awareness Related: AT-2(3) |
PR.AT-01 | Train the host's staff. Give everyone with access to the installation security awareness training, including social engineering, at least yearly. | OpenClear limits platform staff to what their role allows and logs what they do. | attested | — | Yearly | The host's training records |
| H-CA-8-01 | CA-8 Penetration Testing Related: RA-5 |
ID.RA-01, ID.IM-01, ID.IM-02, ID.IM-03 | Test penetration yearly. Have a qualified party penetration-test the installation at least yearly, and share the summary with the banks. | OpenClear's security metrics, advisories and ASVS crosswalk are published with each release. | attested | — | Yearly | The test report |
| H-MP-6-01 | MP-6 Media Sanitization Related: SI-12 |
— | Delete a bank's data when it leaves. When a bank leaves, offboard it in OpenClear (Platform → the bank's Offboarding) as the contract says, send the bank the signed deletion certificate, and tell it how long the host's backups keep copies. | OpenClear tells the bank to take its final export, deletes every row and file of the bank after a wait and two operators' approval, and signs a certificate of what was deleted. | attested | — | Per event | Platform → the bank's Offboarding; the deletion certificate |
| H-CM-4-01 | CM-4 Impact Analyses Related: CM-3 |
ID.RA-07, PR.PS-01 | Announce maintenance. Announce scheduled maintenance and upgrades to each bank beforehand, as a maintenance notice in OpenClear, so they aren't incidents under 12 CFR 304.24(b). | OpenClear sends maintenance notices the same way as incident notices. | attested | — | Per event | Platform → Incidents |
Built from docs/compliance/cuecs.md in the OpenClear repository. Last changed October 28, 2026.