.svg){kind=icon}
FileGrant
RemoteGrant
Connector
AIGrant
EmailGrant
SecretGrant
Key takeaways
- A bank data breach reaches every customer whose name, account number, transaction history or credit file ends up in the wrong hands.
- Stolen banking data rarely gets used right away. It circulates for months or years in underground markets, gets resold several times and turns into targeted fraud long after the original incident.
- In financial services and insurance, the human element is involved in 65% of breaches and third parties in 34% (Verizon DBIR 2026, 1,300 breaches in the sector).
- Inside banks, the share of documents outside IT control is structurally higher than senior management tends to assume, because performance reviews reward hitting targets and employees pick the fastest channel to get the job done.
- DORA and the GDPR converge on a requirement many banks still struggle to meet: knowing where their data actually is, including what sits outside the IT perimeter.
- FileGrant, CyberGrant’s file-centric platform, encrypts each document at creation, keeps access revocable after sharing and logs every open, giving CISOs and DPOs the evidence DORA and GDPR reviews ask for.
We asked Giancarlo Butti, a banking compliance and data governance specialist and the DORA lead on the Scientific Committee of Clusit, the Italian information security association, to analyze how Italian banks actually manage data and documents day to day. The result is a whitepaper you can download for free at the end of this article.
Before the CISO and DPO perspective, start with the person who holds the account.
If your bank gets breached, what actually happens to your data?
It depends on how many documents were out of control, for how long, and who took them.
The data a bank holds on each customer goes well beyond the account balance: identity documents, tax ID, full transaction history, payslips, tax returns, mortgage contracts, property appraisals and insurance policies. Together they make up a complete financial profile of a person. In financial services and insurance, personal data was compromised in 43% of the breaches analyzed in the Verizon DBIR 2026.
When that data surfaces in a breach, it rarely gets used right away. It enters a secondary market and is sold several times over months or years, so targeted identity fraud can arrive two years after an incident the customer never heard about.
If you suspect your banking data has been compromised, monitor your statements closely, enable transaction alerts, check periodically whether your email appears in known breach databases (haveibeenpwned.com is a starting point), and treat unusual requests to confirm personal data with suspicion, even when they appear to come from legitimate sources. Post-breach phishing is almost always more targeted than generic phishing, because the attacker already knows who you are.
Consumer protection starts well before any incident, though: it starts with how well the bank governs the documents it holds about you. If you’re responsible for that governance, the rest of this article is for you.
What questions should bank CISOs and DPOs ask about their documents?
Giancarlo Butti opens the whitepaper with a pointed question: why do bank employees systematically work around security policies, even when strict controls are in place?
His answer starts with how performance is measured. Reviews check whether targets were hit and ignore whether security policies were followed, so people route around the controls that slow them down. Three more questions from the whitepaper tend to be the hardest for bank CISOs and DPOs.
How many repositories outside IT control can you actually map?
Butti’s analysis documents something that rarely gets written down: the real distance between the data a bank believes it controls and the data it actually governs. Email, network shares, personal PCs, personal cloud storage, generative AI tools used without approved policies. Each one is a perimeter that shifted without anyone formally deciding it should.
The question the whitepaper leaves open is direct: how many of these repositories can you map with confidence today?
Classifying a document isn’t enough: what’s missing from your governance criteria?
There’s a difference between assigning a confidentiality level to a document and making sure that level holds over time, on every device and at every vendor that receives it. The whitepaper analyzes why that gap is much wider than it looks, and why eIDAS 2 and DORA are raising the bar on both fronts.
Are the retention periods you have in mind actually the right ones?
Banking retention periods can stretch to 50 years. Butti’s example is a 40-year mortgage: the contract and every linked document are generally kept for ten years after the relationship ends, so the initial retention horizon is 50 years, and each renegotiation moves it. The whitepaper asks a question that applies to any bank that has digitized its archives: who guarantees those documents will still be readable, intact and legally valid when they’re needed? Without a clear answer, the gap tends to surface in an audit, a dispute or a customer request.
How does FileGrant protect bank documents under DORA and GDPR?
The questions in the whitepaper converge on one point: protection can’t depend on users choosing the right channel, or on vendors handling documents correctly after delivery. As we explain in our article on why perimeter DLP no longer works, the file-centric model builds security into the document at creation: persistent encryption, a continuous audit trail and access revocation after sharing.
FileGrant is CyberGrant’s file-centric platform for protecting and sharing documents. It encrypts every file at creation with Lock&Go, CyberGrant’s patented encryption technology, controls who can open, edit or forward it, and keeps that control after the document leaves the corporate network. Access can be revoked even after download. Here is how it maps to the questions above.
Documents outside IT control. A file shared through FileGrant stays encrypted on the recipient’s device, on a personal PC or in a personal cloud folder. Anyone without permission sees only the metadata.
Governance that holds over time. Classification tags travel with the file and decide what can happen to it. Sharing can require a classification first, prior approval and a mandatory expiry date, and downloads can be restricted by tag.
Third parties. DORA requires banks to manage ICT third-party risk, and documents also travel to consultants, law firms and other counterparties. Every access to a shared file is logged with its IP address, and the sender can revoke access at any time.
Audit evidence for DORA and GDPR. The audit trail records opens, downloads and shares for every file and can be exported for reviews. Log retention can be set from three months to ten years.
Decades-long retention. Files are encrypted with CRYSTALS-Kyber, the quantum-safe algorithm standardized by NIST as FIPS 203, which protects documents that must stay confidential for decades against “harvest now, decrypt later” attacks.
Shadow AI. A file encrypted by FileGrant stays unreadable if someone uploads it to a public AI tool. AIGrant, CyberGrant’s private AI extension built into FileGrant, gives employees an on-premise assistant that answers questions on internal documents within the permissions they already hold.
FileGrant runs as a standalone document platform or alongside the systems the bank already uses. For files stored in SharePoint and OneDrive, CyberGrant Connector, the FileGrant extension, encrypts them in place without migration. Deployment is SaaS, on-premise or in an in-country cloud; on-premise, the encryption keys stay in the bank’s infrastructure. For the architecture behind this approach, read How zero trust file-centric security protects banking data; for the NIS2 side, see our guide to NIS2 secure file sharing requirements.
What’s inside the whitepaper?
Giancarlo Butti’s whitepaper goes into the detail behind all of these questions: the structural cause of workarounds, the full map of ungoverned repositories, a classification framework that goes beyond confidentiality, retention periods as dynamic attributes, the limits of digitization, and the regulatory overlap between DORA, the GDPR, eIDAS 2 and Banca d’Italia’s Circular 285. It is written for CISOs and DPOs who work in the same institution and often speak different languages about the same problems.
Frequently asked questions
What does a customer actually risk when their bank is breached?
Compromised banking data rarely gets used immediately. It typically enters underground markets and is resold over months or years, which makes it hard to connect a targeted attack to the original incident. The real risks are financial identity theft, targeted phishing from attackers who already know your details, fraudulent credit lines opened in your name and unauthorized access to digital services. In financial services and insurance, personal data was compromised in 43% of the breaches analyzed in the Verizon DBIR 2026. Monitoring statements closely, enabling transaction alerts and checking whether your email appears in known breach databases are basic self-defense measures.
Why do bank employees work around document security policies?
Because performance reviews measure whether targets were hit and ignore whether security policies were followed. Employees who choose the most convenient channel are responding rationally to those incentives, and Giancarlo Butti places the accountability with whoever designed the process. The practical answer is a set of tools where the fastest way to share a confidential document is also the secure one.
What is Shadow AI and why does it matter for bank data security?
Shadow AI is the use of generative AI tools outside approved corporate policies. When an employee uploads a confidential document to one of these tools, the content enters third-party systems outside IT control, with consequences for both security and GDPR compliance. A file encrypted by CyberGrant’s FileGrant stays unreadable if someone uploads it to a public AI tool. AIGrant, CyberGrant’s private AI extension, gives employees an on-premise alternative that answers questions on internal documents within the permissions they already hold.
What regulations govern digital document management in banks today?
DORA (EU Regulation 2022/2554), applicable from January 17, 2025, for digital operational resilience and ICT third-party risk; Banca d’Italia Circular 285 for data governance and operational continuity; GDPR (EU Regulation 2016/679) for personal data processing; eIDAS 2 (EU Regulation 2024/1183) and EU Implementing Regulation 2025/2532 for electronic signatures and qualified electronic archiving.
How does FileGrant work in a banking document security context?
FileGrant is CyberGrant’s file-centric platform for protecting and sharing documents. It encrypts every file at creation with Lock&Go and CRYSTALS-Kyber (NIST FIPS 203) and keeps control over who can open, edit or forward it, even after the document has left the corporate network. For a bank, that means an exportable audit trail of every access for DORA and GDPR reviews, access revocation after sharing, and quantum-safe protection for documents kept for decades. It runs as a standalone platform or alongside existing systems, in SaaS, on-premise or in an in-country cloud.
How can a bank keep control of documents shared with vendors and other third parties?
Third parties are involved in 34% of breaches in financial services and insurance (Verizon DBIR 2026), and DORA requires financial entities to manage ICT third-party risk as part of their ICT risk management. With CyberGrant’s FileGrant, a document sent to a vendor, law firm or consultant stays encrypted on their systems. The bank can set an expiry date, require approval before sharing, revoke access at any time and see every open with its IP address. If the vendor is breached, the attacker finds files that cannot be opened without active permissions.
Does FileGrant replace SharePoint or the bank’s document management system?
No. FileGrant works alongside the systems the bank already uses and protects documents when they are shared outside them. For files already stored in SharePoint and OneDrive, CyberGrant Connector, the FileGrant extension, encrypts them in place, without migration and without changing Microsoft permissions. Repositories, workflows and the Microsoft sign-in stay as they are; protection is added at file level.
Related reading
