Skip to content

Governance Response Memo (Capital One 2019)

Use this to respond to an audit or regulatory request focused on governance: roles, committees, reporting, escalation, and accountability.


Purpose

This memo provides a formal governance response to oversight, audit, or regulatory questions triggered by Capital One 2019. It explains governance design, escalation pathways, accountability, and board-level reporting so reviewers can evaluate whether leadership oversight is effective and durable.

Hallucinated writing examples

Scenario: In an illustrative period following the 2019 Capital One cloud breach and related enforcement and litigation tracks (time), the Capital One Bank (USA), N.A. — Chief Information Security Officer (role) prepares a governance response memo (type) for Office of the Comptroller of the Currency (Examiner) (audience).

GOVERNANCE RESPONSE MEMO

To: Office of the Comptroller of the Currency (Examiner)
From: Capital One Bank (USA), N.A. — Chief Information Security Officer
Date: November 20, 2020
Re: Governance Structure and Security Oversight — Response to Request (Post–July 2019 Incident; Consent Order)

Context: This memo responds to the examiner's request for a description of the Bank's security governance structure, roles, and oversight following the July 2019 cybersecurity incident and the Consent Order and Civil Money Penalty issued by the Office of the Comptroller of the Currency on August 6, 2020 (OCC NR 2020-98). The incident involved unauthorized access to customer data in our AWS-hosted infrastructure; the individual responsible was arrested on July 29, 2019 (United States v. Paige A. Thompson, U.S. District Court, W.D. Wash.). The Consent Order required the Bank to strengthen board and management oversight of cybersecurity, risk management, and reporting to the OCC. The following describes our governance structure as strengthened to meet those requirements.

Governance Model: The Board of Directors delegates oversight of technology and cybersecurity risk to the Board Audit Committee. The Committee receives quarterly reports on security program status, key risks, Consent Order progress, and key metrics. Reporting line: the Chief Information Security Officer reports to [designated executive]. Security leadership participates in [committee name] for operational risk. Charters and minutes are maintained; the Audit Committee charter (as of [date]) and org chart showing the security reporting line are attached.

Security Ownership: The Chief Information Security Officer is accountable for security strategy, policy, standards, and control implementation. Authority includes approval of security exceptions within policy limits and escalation to the Board for material risk acceptances. This structure was reinforced following the 2019 incident and is reflected in the Consent Order commitments.

Risk and Control Oversight: Risk and control issues are escalated via [defined path]. Material incidents and Consent Order milestones are reported to the Audit Committee. Risk acceptances require documented rationale and revisit dates. Policies and standards are approved by [authority]; the CISO organization maintains standards and updates them per [cadence]. Exceptions are requested through [process] and documented. Attached: policy approval record; last Committee meeting date and security briefing summary. The Bank is committed to maintaining clear accountability and evidence of oversight per the Consent Order.

Document-type guide: Governance Response Memo

Writing tips: Writing best practices — Governance Response Memo

© 2026 Yi Zhang. Licensed under the MIT License.
Last updated: 2026 April 17 9:37 AM