<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Guarding Against Cyber Events: How Strong Are Your Vendor’s Protections?

author Michael Berman
3 min read
Mar 31, 2017

The FDIC Office of Inspector General’s (OIG) deep dive into the state of vendor management has revealed widespread deficiencies including business continuity planning, vendor management, contract management, internal controls and cybersecurity. This is part five of a five-part blog series that looks at the report's findings. 

Part 5: Cybersecurity

How well is your institution responding to cybersecurity events?

If your third-party contracts are structured like those at many financial institutions, your response may fall short of expectations due to lack of clarity.

That’s according to the FDIC’s Office of Inspector General’s evaluation Technology Service Provider Contracts with FDIC-Supervised Institutions, which focuses on business continuity planning and cyber incident response. In short, “often FI contracts with TSPs are dated and do not reflect FDIC and FFIEC efforts to strengthen cybersecurity.”

The OIG defines a security incident as “the attempted or successful unauthorized access, use, modification, or destruction of information systems or customer data.” Such incidents can cause systems to fail or result in the breach of confidential data.

Every financial institution (FI), and by extension their critical vendors, needs an incident response program that addresses the steps to take in the event of a potential incident. According to the OIG’s summary of the Interagency Guidelines, there must be procedures for:

  • “Assessing the nature and scope of an incident and identifying what customer information systems and types of customer information have been accessed or misused;
  • Taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information, for example, by monitoring, freezing, or closing affected accounts, while preserving records and other evidence;
  • Notifying its primary federal regulator as soon as possible when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information;
  • Notifying appropriate law enforcement authorities and filing a timely Suspicious Activity Report in situations involving federal criminal violations; and
  • Notifying customers when warranted.”

The Good and the Bad

While FIs have taken steps to address vendor incident response in contracts, these high-level efforts lack the necessary detail to make them truly effective.

For example, 86 percent of contracts directly addressed security, confidentiality and Gramm-Leach-Bliley Act privacy requirements by requiring the vendor to notify the FI of unauthorized intrusions of material impact, the OIG found. The bad news is contracts frequently didn’t address vendor responsibility for:

  • Assessing and responding to incidents;
  • Determining the potential effect on the institution or its customers; or
  • Reporting and notifying authorities.

While about half of FIs had performance standards for notifying the institution of the breach, few contracts went into detail on how a vendor would:

  • Assess the nature and scope of potential incidents, including information and systems accessed and the possible harm, inconvenience or misuse of data that could result;
  • Contain and control incidents to preserve evidence;
  • Provide detailed incident response and recovery metrics; and
  • Remedy the situation if it failed to meet response and reporting standards.

When FIs don’t spell out a vendor’s incident response program in the contract, they are exposing themselves to increased cyber and compliance risk. An FI needs to know the exact processes a vendor will use to assess, respond to and report potential incidents. They need to know that the efforts of critical vendors will support the FI’s goals of protecting information systems and data. A good incident response program can reduce the chances of a security incident disrupting operations or compromising customer information.

The consequences can be steep. It’s a tired refrain, but well worth repeating: Many of the biggest breaches in recent history have been the result of third-party vendors. FIs need to address cybersecurity both internally and externally in their vendor relationships to protect against growing threats.

The FFIEC developed a Cybersecurity Assessment Tool to analyze inherent risk and cybersecurity maturity levels. Ncontracts’ Ncyber gives you a shortcut through this 400+ page questionnaire, offering the FFIEC Cybersecurity Assessment Tool in a secure, easy-to-navigate format with embedded workflow tools that enable departments within your organization to easily cross-reference the data needed for a seamless, accurate assessment.

Don’t let cyber risks go unrecognized. Take steps to ensure your FI and its vendors are prepared to deal with cyber events by assessing risks and addressing those risks in written contracts.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply CRA Business Resiliency Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Nboardportal Verify integrated risk management
How to Respond When a Vendor Gets Hacked
Banks

How to Respond When a Vendor Gets Hacked

May 11, 2018 4 min read
The Lessons from Marriott’s Epic Data Breach
Risk Management

The Lessons from Marriott’s Epic Data Breach

Nov 30, 2018 3 min read
What Happens in New York Doesn't Stay in New York
Banks

What Happens in New York Doesn't Stay in New York

Mar 2, 2017 1 min read