Cybersecurity Risk Freeze Model for Banking System Changes

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Financial institutions lack a structured technique for evaluating and communicating cybersecurity risks associated with changes to their digital banking systems, leading to potential increases in risk levels above a prescribed threshold, despite the motivation to implement new features.

Innovation Solution

A change management methodology that calculates cybersecurity risk levels for proposed changes, incorporating them with existing risk levels, and freezes changes if they exceed a threshold, using a computational model to manage and reduce risks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If new features and system changes are implemented to improve digital banking functionality, then adaptability and versatility improve, but cybersecurity risk level increases

Engineering Contradiction:

Improvedigital banking functionalityVSAvoidcybersecurity risk level

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by calculating and assessing cybersecurity risk levels before changes are implemented. The system evaluates the cybersecurity risk level of proposed changes against existing risk levels and thresholds, preventing high-risk changes from being deployed. This proactive risk assessment ensures that functionality improvements do not compromise security, resolving the contradiction between adaptability and security risk.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If cybersecurity risk assessment and freeze protocols are implemented, then system security improves, but change implementation time increases

Engineering Contradiction:

Improvesystem securityVSAvoidchange implementation time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies parameter changes by establishing quantitative cybersecurity risk level thresholds that determine whether changes proceed or are frozen. The system calculates numerical risk levels and compares them against predefined thresholds, enabling automated go/no-go decisions. This parameter-based approach streamlines the security assessment process, maintaining high security standards while reducing subjective delays and expediting safe changes.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260023549A1Cybersecurity risk and feature freeze model

Publication Date: 2026.01.22 TRUIST BANK

AI summary

A change management methodology for a bank's systems and applications which includes an evaluation of cybersecurity risk as a decision factor. The method includes calculating a cybersecurity risk level associated with non-security-driven changes to applications and systems in the bank's computing environment and, when the risk level of any change exceeds a threshold, freezing the change until the risk level can be reduced to a lower level. A cybersecurity risk calculation model computes a risk level for a proposed change to a system or application based on numerous factors. The risk level associated with the proposed change is combined with an existing risk level status of the system or application, and the business unit with which it is aligned. The aggregate risk level leads to a decision which is used as a go/no-go checkpoint in the change management methodology.