An OCC official says the move reflects the evolving nature of threats and more robust guidance from NIST and CISA.