Posts about:
In its simplest form, vendor management is the process of overseeing third-party service providers who work for your organization, from beginning to end. This process can take many forms, but is most often composed of these five elements:
What is the vendor management definition of due diligence? It's certainly a pillar of vendor relationship management. If you are going to outsource, from bits of processes to entire services, due diligence is the practice that allows you to see trouble coming. You gather vendor due diligence documents when soliciting vendors to make sure you don't get yourself into a bad situation. You gather due diligence documents throughout the vendor contract to ensure the vendor is meeting their obligations and services are provided as expected.
The KEYS Conference is an annual Tandem user group and information security conference created to provide Knowledge Essential to Your Security. What you spend on the conference will be given back to you in knowledge, relationships, and practical skills you can take home and share with your own financial institution.
On November 14, 2019, the Federal Financial Institutions Examination Council (FFIEC) released an updated Business Continuity Management (BCM) booklet, as part of their IT Examination Handbook. This update appears to be a restructuring of the document to make it more organized, shorter, and better focused on the importance of recovery planning. At this time, we do not believe there are any significant changes in regulatory expectations.
At the ninth National Credit Union Administration (NCUA) open Board meeting for 2019, the Office of Examination and Insurance and the special advisor to the Chairman for cybersecurity briefed the Board on cybersecurity challenges and opportunities.
If you are a vendor manager at a bank or credit union, you may be familiar with checking OFAC, but have you ever paused to ask why? Who exactly is "OFAC?" Is checking vendors a best practice or is it a regulatory requirement? How frequently should you check your vendors?
This month, the National Credit Union Administration (NCUA) issued a Risk Alert (19-RISK-01) describing the increasing frequency of and losses related to business email compromise fraud schemes. This is the first Risk Alert issued by the NCUA in six years.
The concept of a multifactor authentication (MFA) risk assessment has recently become a topic of conversation in the information security community. Perhaps these discussions around an MFA risk assessment have led you to ask, "Am I required to perform an MFA risk assessment?"
If you are a credit union, you should expect to see the ACET during your next IT examination. The NCUA began piloting this new examination tool in 2018 with larger credit unions, but we anticipate it will be used in most credit union examinations in 2019. As you prepare for the ACET, here is a list of frequently asked questions for you to review.