According to a report released last week by the New York Department of Financial Services (NYDFS), the financial industry has a long way to go in overseeing the cybersecurity capabilities of outside vendors who carry out critical banking functions.
Last week’s report follows a year of activity on that front. In a May 2014 report, the NYDFS concluded—based on a survey of over 150 banks—that the financial industry’s increasing reliance on third-party vendors could create critical cybersecurity risks. Following that report, the NYDFS conducted a second survey of 40 banks concerning how they address cybersecurity with respect to third-party vendors. The second survey resulted in last week’s report. As a result of its findings, the NYDFS is considering new regulation that would impact financial institution oversight of third-party vendors.
THE NYDFS REPORT’S FINDINGS REGARDING VENDORS AND CYBERSECURITY
Last week’s report on vendors focused on four critical areas:
1. due diligence processes;
2. policies and procedures governing relationships with third-party vendors;
3. protections for safeguarding sensitive data; and
4. protections against loss incurred by third-party failures.
According to the report, almost every institution surveyed conducted risk-based due diligence on vendors, classifying vendors with access to sensitive data as high-risk, and conducting cybersecurity risk assessments on those vendors. In addition, 90 percent of surveyed institutions require vendors to comply with cybersecurity standards. However, fewer than half of the institutions surveyed required on-site due diligence of vendors: only 46 percent required initial on-site due diligence of potential vendors; and even fewer—35 percent—required periodic on-site due diligence of even those vendors classified as high-risk.
A more complete analysis of the report can be found in our client alert, available here.