<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Can Your Third-party Vendor Fend off Cyber Attacks?

author Michael Berman
1 min read
Jun 15, 2016

What do the Bangladesh central bank and your third-party vendors have in common? They need to be taking steps to protect themselves and customers from cyber attacks.

The threats are real. Earlier this year hackers stole $81 million from Bangladesh’s Federal Reserve Bank of New York account via the Swift international fund-transfer network—with aims of stealing $1 billion, American Banker reports. Other institutions have fallen victim, including those in Ecuador, Vietnam and the Philippines, Reuters reports. In May the FBI issued a private alert warning American institutions to be aware of a “malicious cyber group,” the news service says.

What does this have to do with your third-party vendors? Everything.

As a result of these attacks, the Federal Financial Institutions Examination Council (FFIEC) released a statement on June 7 highlighting best practices for cyber risk vulnerability management “to remind financial institutions of the need to actively manage the risks associated with interbank messaging and wholesale payment networks.”

One of the statement’s most common refrains: stay on top of third-party vendors. It’s mentioned five times in the five-page document.

FFIEC's BEST PRACTICES FOR VENDOR MANAGEMENT

What should institutions be doing? The statement recommends these five vendor management best practices.

  1. Adequately monitor vendors’ information security systems, practices and policies.
  1. Regularly verify that third-party testing of vendors’ information security systems is satisfactory.
  1. Ensure vendors are contractually obligated to report security incidents to the financial institution.
  1. Perform adequate initial and ongoing due diligence reviews of third party vendors. This includes reviewing all reports provided by vendors.
  1. Address business continuity planning and testing with third-party vendors. Vendors must be able to demonstrate their ability to “quickly recover and maintain payment processing operations,” the statement says.

While none of these requirements are new, the statement is an important reminder that proper vendor management is critical to limiting third-party risk and blunting the impact of growing cyber threats. Vendor management is far more than mitigating the risk of an examiner’s negative finding. Appropriate vendor management helps decrease the risk of major cyber security breaches.

Make sure you have a strong system for ensuring your vendors can detect and fend off cyber attacks—their IT practices are just as important as your own.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Enterprise Risk Management Vendor Risk ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
Can Improving the Customer Experience Aid Risk Management?
Risk & Compliance

Can Improving the Customer Experience Aid Risk Management?

Apr 4, 2018 1 min read
Misleading Vendor Marketing Costs Missouri Bank $5 Million
Risk & Compliance

Misleading Vendor Marketing Costs Missouri Bank $5 Million

Nov 21, 2017 2 min read
5 Tips for Better Contract Management
Risk & Compliance

5 Tips for Better Contract Management

Mar 17, 2015 2 min read