Vendor Management from a
Vendor’s Perspective
Agenda
•
•
•
•
•
•
Regulatory Updates and Trends
Examiner Trends
Technology and Solution Trends
Common Issues and Misconceptions
The Vendor Perspective
Best Practices for Effective Vendor Management
•
•
•
•
•
Experts in banking technology
A strong regulatory compliance knowledge base
Multi-layered approach to enterprise security
Multiple core processors and applications
Single point of contact for IT and regulatory guidance
Exclusive to the financial institution market
Over 500 financial institutions
99% client retention & renewal rate
SOC 2 Type II audited solutions
Most
Innovative
Solution
2011–2013
Regulatory Trends
• Increased Regulatory Scrutiny
• Examiners realize the trend in outsourcing more
• Solutions still have to be managed as if they were
created and managed in-house
• Increased focus on cyber security
• Institution
• Vendor
Regulatory Trends
• Institutions continue to increase the use and scope
of solution providers
• Increased findings from regulators on concerns they
find during vendor exams
• FFIEC Webinar on Cyber Security
• Cyber Security Toolkit
• FFIEC updates Appendix J
• FDIC FIL
• https://www.fdic.gov/news/news/financial/201
4/fil14013.pdf
FFIEC Update – Appendix J
• Third-party management
– Due Diligence
•
•
•
•
•
•
•
Right to audit
Subcontracting
Foreign-based service providers
BCP testing
Data governance
TSP updates
Security issues
– Contracts
– Ongoing Monitoring
• Third-party capacity
– Significant Technology Service Provider Continuity Scenarios
Appendix J – Continued
• Testing with third-party Technology Service Providers
– Testing Scenarios
• TSP outage or disruption
• FI outage or disruption
• Simultaneous cyber attacks
– Testing Complexity
• Cyber resilience
– Risks
•
•
•
•
•
Malware
Insider Threats
Data or Systems Destruction and Corruption
Communications Infrastructure Disruption
Simultaneous Attack in FI and TSP
FFIEC Outsourcing Technology Appendix D
Managed Security Services
• Network Boundary Protection
• Management of Intrusion Detection and Prevention for Networks and
Hosts
• Event Log Management and Alerting
• Anti-Virus and Web Content Filtering Services
• Patch Management and Security Software Management
• Security Incident Response and Management
• Data Leak Prevention
• Secure Messaging
• Information Security Consulting Services
MSSP Update
Critical considerations include…
• availability,
• integrity,
• and confidentiality…
…of Financial Institution Data.
The Compliance Process
Simplified
Examination Trends
•
•
•
•
Focus on Management “M” in CAMELS rating
Layered Defense to Security Threats
Vendor Management Focus
Business Continuity Planning not Disaster
Recovery
• Segmentation of duties and backup for key
personnel
• Oversight and Validation of IT
• Vendors having wrong or limited SOC reporting
Technology Trends
• We have to do more with less resources
• Leverage the cloud
• Core / third party applications
• Structure of services
• Hybrid/ Private / Public
• Heavy fintech focus on mobile and customer
relationship enhancement
• Increase leverage of solutions to assist in verifying
adherence to policies and procedures
The Vendor’s Perspective
• The difference between buying solutions and being
sold solutions
• Sales Ethics
• Technical Understanding vs High Level Functionality
• Multiple Decision Makers
– Technical
– Senior Level
– Tech Committee
• Request for Proposal
Common Issues and Misconceptions
• SOC 1,2 &3 vs Type 1 &2
• SOC 2 (and others)
• Vendor can define what services are reviewed
• Review Timing
• Third Party Providers / Contractors
• Lack of understanding outside of fintech companies
• Risk Assessments Not Completed
Best Practices
• Review Vendors at Least Annually
• Define Reporting Process
• Centralize Key Components of Contracts
• Renewal Dates
• Auto Renewal Dates
• Last Risk Assessment Review
• Risk Rate Vendors
• Inherent Risk
• Residual Risk
Risk Review Categories
•
•
•
•
•
•
•
•
Access to NPI – Core
Access to NPI – Non-Core
Access to confidential Information
Criticality of the service
Complexity and Availability of the Service
Concentration Risk
Cloud Based
Foreign Based
Reducing Inherent Risk
•
•
•
•
•
Is the Vendor Financial Institution Specific?
Do they have a user group?
How much verification information do you receive?
What type of Audit and Reporting do they have?
Automated systems vs manual processes /
spreadsheets
Best Practices for New Contracts
• Take control of the references you receive
–
–
–
–
•
•
•
•
•
Core Processor
Geography
Size
Ask for More
Ask the references the same questions
Increase your peer group
Attend user groups
Leverage your other vendor relationships
Fill out the risk assessment
Ask the hard questions
• Vendor
• When customers don’t renew, what are the reasons?
• What items are not included in proposal?
• How do you prioritize your enhancements?
• References
• What was unexpected vs. your expectation?
• When issues arise, how are they handled?
• How honest do you feel the company and sales rep
are?
Existing Vendors
• Ongoing Management
•
•
•
•
•
•
Annual Updates
Reporting / Verification of Adherence
Review of Business / Strategy Annually
User Group Conferences / Attendance
Updated Vendor Management Packet
Updated Risk Assessment
• Long-term Contracts Don’t Remove the Need for
Annual Review
Summary
• Vendor Management has heightened oversight
from examiners
• Senior Management and the Board need to be
involved
• Vendor Management will continue to grow in
importance as more solutions are outsourced
• It’s important to leverage peers and references in
the process
Questions?