Due Diligence and Ongoing Monitoring

I think this depends on whether or not your third party is a regulated entity- many are not. If that is the case our TPRM will look to see if the functional business unit using that vendor has appropriate citations and controls that are rated effective ... More

A regulation-by-regulation checklist per vendor isn't necessary if you do two things. First, assess compliance risk by product or service. Second, understand how the vendor participates in that product. Then, for each compliance risk in the product's ... More

$1.9 Billion More

Review your contract first. What does it say about the right to audit? I would start with that and then push back, "as we are providing you with confidential data; we need to ensure how you are safeguarding that data". Then if you can leverage your ... More

I am meeting with my compliance team on Friday and will bring this up. What size is your institution? More