Vendor Management from a Vendor’s Perspective. Agenda Regulatory Updates and Trends Examiner...

Vendor Management from a Vendor’s Perspective

Agenda

• Regulatory Updates and Trends• Examiner Trends• Technology and Solution Trends• Common Issues and Misconceptions• The Vendor Perspective• Best Practices for Effective Vendor

Management

Exclusive to the financial institution market

Over 500 financial institutions

99% client retention & renewal rate

SOC 2 Type II audited solutions

• Experts in banking technology• A strong regulatory compliance knowledge base• Multi-layered approach to enterprise security• Multiple core processors and applications• Single point of contact for IT and regulatory

guidance

Most Innovative

Solution2011–2013

Regulatory Trends

• Increased Regulatory Scrutiny• Examiners realize the trend in outsourcing

more• Solutions still have to be managed as if

they were created and managed in-house• Increased focus on cyber security

• Institution• Vendor

Regulatory Trends

• Institutions continue to increase the use and scope of solution providers

• Increased findings from regulators on concerns they find during vendor exams

• FFIEC Webinar on Cyber Security• Cyber Security Toolkit• FFIEC updates Appendix J• FDIC FIL

• https://www.fdic.gov/news/news/financial/2014/fil14013.pdf

FFIEC Update – Appendix J

• Third-party management– Due Diligence

• Right to audit• Subcontracting• Foreign-based service providers• BCP testing• Data governance• TSP updates• Security issues

– Contracts– Ongoing Monitoring

• Third-party capacity– Significant Technology Service Provider Continuity

Scenarios

Appendix J – Continued

• Testing with third-party Technology Service Providers– Testing Scenarios

• TSP outage or disruption• FI outage or disruption• Simultaneous cyber attacks

– Testing Complexity

• Cyber resilience– Risks

• Malware• Insider Threats• Data or Systems Destruction and Corruption• Communications Infrastructure Disruption• Simultaneous Attack in FI and TSP

FFIEC Outsourcing Technology Appendix DManaged Security Services

• Network Boundary Protection• Management of Intrusion Detection and Prevention for

Networks and Hosts• Event Log Management and Alerting• Anti-Virus and Web Content Filtering Services• Patch Management and Security Software Management• Security Incident Response and Management• Data Leak Prevention• Secure Messaging• Information Security Consulting Services

MSSP Update

Critical considerations include…• availability, • integrity, • and confidentiality……of Financial Institution Data.

The Compliance Process Simplified

Examination Trends

• Focus on Management “M” in CAMELS rating• Layered Defense to Security Threats• Vendor Management Focus• Business Continuity Planning not Disaster

Recovery• Segmentation of duties and backup for key

personnel• Oversight and Validation of IT • Vendors having wrong or limited SOC

reporting

Technology Trends

• We have to do more with less resources• Leverage the cloud

• Core / third party applications• Structure of services• Hybrid/ Private / Public

• Heavy fintech focus on mobile and customer relationship enhancement

• Increase leverage of solutions to assist in verifying adherence to policies and procedures

The Vendor’s Perspective

• The difference between buying solutions and being sold solutions

• Sales Ethics• Technical Understanding vs High Level

Functionality• Multiple Decision Makers

– Technical– Senior Level– Tech Committee

• Request for Proposal

Common Issues and Misconceptions

• SOC 1,2 &3 vs Type 1 &2• SOC 2 (and others)

• Vendor can define what services are reviewed• Review Timing

• Third Party Providers / Contractors• Lack of understanding outside of fintech

companies• Risk Assessments Not Completed

Best Practices

• Review Vendors at Least Annually• Define Reporting Process • Centralize Key Components of Contracts

• Renewal Dates• Auto Renewal Dates • Last Risk Assessment Review

• Risk Rate Vendors• Inherent Risk• Residual Risk

Risk Review Categories

• Access to NPI – Core• Access to NPI – Non-Core• Access to confidential Information• Criticality of the service• Complexity and Availability of the Service• Concentration Risk• Cloud Based• Foreign Based

Reducing Inherent Risk

• Is the Vendor Financial Institution Specific?• Do they have a user group?• How much verification information do you

receive?• What type of Audit and Reporting do they

have?• Automated systems vs manual processes /

spreadsheets

Best Practices for New Contracts

• Take control of the references you receive– Core Processor– Geography– Size– Ask for More

• Ask the references the same questions• Increase your peer group• Attend user groups• Leverage your other vendor relationships• Fill out the risk assessment

Ask the hard questions

• Vendor• When customers don’t renew, what are the

reasons?• What items are not included in proposal?• How do you prioritize your enhancements?

• References• What was unexpected vs. your expectation?• When issues arise, how are they handled?• How honest do you feel the company and

sales rep are?

Existing Vendors

• Ongoing Management• Annual Updates• Reporting / Verification of Adherence• Review of Business / Strategy Annually• User Group Conferences / Attendance• Updated Vendor Management Packet• Updated Risk Assessment

• Long-term Contracts Don’t Remove the Need for Annual Review

Summary

• Vendor Management has heightened oversight from examiners

• Senior Management and the Board need to be involved

• Vendor Management will continue to grow in importance as more solutions are outsourced

• It’s important to leverage peers and references in the process

Questions?