<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Why Vendor Cyber Monitoring Matters

author Michael Berman
2 min read
Mar 21, 2019

Vendor cyber breaches are shockingly common. A study released by the Ponemon Institute in November revealed that 59 percent of respondents in the U.S. and U.K. report that a third party caused a data breach.

That includes the 42 percent of organizations that experienced a vendor-related data breach in the past 12 months. Another 22 percent didn’t even know if they’d been exposed by a third-party data breach.

Consider these recent examples:

Corporations Services Company (CSC). Routine security monitoring detected unauthorized access to CSC’s network and systems in April 2018. The company, which serves over 3,000 financial institutions, said that a database with client information containing at least 5,600 individual’s names, Social Security numbers or credit/debit card information was stolen. The company has since added controls like two-factor authentication, more firewalls and longer employee passwords.

Scottrade Bank. More than 20,000 customers’ sensitive information was exposed when third-party vendor Genpact “uploaded a data set to one of its cloud servers that did not have all security protocols in place.” It was discovered by an outside researcher.

InTouch Credit Union. A third-party data analytics service was a victim of a ransomware attack. Member Social Security number and account information was exposed. As a result, the institution changed accounts and cards for all affected accounts and provided data monitoring for thousands of members.

No matter how strong a financial institution’s own cyber defenses are, it’s really only as strong as its weakest vendor.

Ongoing Vendor Monitoring: What to Look for

Ongoing monitoring of your vendors’ cybersecurity programs is critically important. This includes:

  • Ongoing monitoring of your vendors’ cybersecurity controls to detect vulnerabilities before there is an issue and take action if an issue is uncovered
  • Assessing your vendors’ ability to effectively identify and resolve incidents
  • Comprehensive documentation of activity regarding your vendors’ cybersecurity program
  • A system for recording incidents and resolutions regarding your vendors’ cybersecurity issues so you can document due diligence for regulators, seek remediation if a vendor has violated its service level agreement and uncover patterns
  • Ensuring a vendor’s cyber risk aligns with your institution’s appetite for cyber risk

Don’t assume your vendor is protecting your sensitive data. Make sure you are taking proactive steps to ensure vendors are up-to-date on the latest threats and addressing cybersecurity thoroughly.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings OCC Regulatory Compliance Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Artificial Intelligence Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Third-Party Vendors & Compliance Risk: 10 High-Risk Compliance Situations
Risk Management

Third-Party Vendors & Compliance Risk: 10 High-Risk Compliance Situations

Jun 18, 2020 3 min read
Heightened Cybersecurity Risk – Is Your FI Prepared?
Risk Management

Heightened Cybersecurity Risk – Is Your FI Prepared?

Jan 21, 2020 3 min read
4 Ways To Streamline Your CMS
Banks

4 Ways To Streamline Your CMS

May 7, 2020 3 min read