<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

4 areas of focus for evaluating cloud-based vendors

author Michael Berman
2 min read
Jun 16, 2022

Cloud adoption has been ramping up for the last several years, with financial institutions even migrating some core processes to the cloud and developing cloud-native apps. Post pandemic, bankers are accelerating those plans, especially as they look to further digitize the experience.

In fact, a recent survey found that almost half of bankers say that Covid encouraged them to increase spending on cloud projects. Last year, financial institutions spent $36 million on cloud projects, and it’s expected to increase from 1% to as high as 10% over the next couple of years.

An often-confusing term, many individuals believe that “the cloud” is this mysterious place where data floats and can simply appear at the press of a button. But the cloud is a real place, and it’s often many places through multiple data centers.

Simply put, the cloud is buying space on someone else’s infrastructure (or data center) to store and/or process data which you can then access via the Internet. Sometimes these computers are used exclusively by one institution, known as a private cloud. Other times, several clients use the same computers at a data center, known as a shared cloud.

The cloud can provide tremendous value, as noted by increased spending. But there are also risks that must be carefully considered.

Like any other third-party IT vendor, the cloud faces all the same risks, including cyber risk, reputation risk, and operational risk. Additionally, it’s growing popularity is gaining the attention of regulators. Regulators are looking closely to see that institutions are aware of cloud risk and taking steps to mitigate or lower risk.

Related: Download out whitepaper on assessing third parties and measuring what matters
Guarding Against Cybersecurity Threats: Assessing Third Parties 

When evaluating cloud-based vendors, financial institutions should adhere to their existing vendor management cyber guidance, paying special attention to:

Compliance.

Ensure the provider follows privacy laws. Specific responsibilities for data protection must be defined and communicated, often in the service level agreement of the contract.

Cyber.

There should be clearly defined procedures for responding to and reporting security incidents and notifying customers and regulators of any breaches.

Data security.

Access to cloud data should be defined and restricted. Audit logs should be maintained to monitor and detect changes. Data should be encrypted at all times—both at rest and during transmission. When using shared clouds, an institution’s data must be segregated from other client data.

Country risk.

All cloud data should be housed in the United States. If a vendor won’t tell you where data is stored, find another vendor.

Read also: Outsource Marketing Activities? Make Sure You Have a Vendor Management Program

 

With the right vendor management solution, you can spend less time focusing on onboarding vendors and monitoring risks and more time serving your customers.
Vendor Management Buyer's Guide | Ncontracts

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Vendor Risk Management
Risk Management

Vendor Risk Management

Oct 31, 2018 1 min read
3 Elements of a Vendor Cyber Monitoring Program
Banks

3 Elements of a Vendor Cyber Monitoring Program

Jul 9, 2019 2 min read
7 essential steps for successful vendor management
Risk & Compliance

7 essential steps for successful vendor management

Oct 20, 2015 2 min read