Due Diligence and Ongoing Monitoring

If there is reliance on vendor service and they have access to confidential/sensitive data, or are interacting with your customers then you should definitely be performing due diligence on such vendors to gain assurance that data is protected and that in the event there is a disruption on the vendors side, they are set up with backup etc. to support interruption in service.  In due diligence you would still want to evaluate their BCDR program, InfoSec policy, ensure they have adequate insurance coverage, are financially sound to support such services.  They will have physical access to your facility, so you want to ensure vendor is conducting background checks on their employees etc. If there is customer impact/interaction, then assessing their complaint policies etc. also become important.  Then there is their operational and physical security policies that would provide assurance on what controls are in place for transportation/transit.

Performance monitoring should also be in place to ensure established SLA's are achieved and issues are tracked and monitored. 

Hello all,

We are about to start a service with Brinks to pick up deposits from our customers. My question is:

Does having a deposit slip with the customers cash (with customer Name, account # and address) constitute a NPI.  I personally don't think this is an NPI, but we are having an internal debate.  If having a deposit slip constitutes NPI, then we automatically put this vendor in High-risk category, and our due diligence requirement increases.

All inputs will be helpful. 

If there is reliance on vendor service and they have access to confidential/sensitive data, or are interacting with your customers then you should definitely be performing due diligence on such vendors to gain assurance that data is protected and that in the event there is a disruption on the vendors side, they are set up with backup etc. to support interruption in service.  In due diligence you would still want to evaluate their BCDR program, InfoSec policy, ensure they have adequate insurance coverage, are financially sound to support such services.  They will have physical access to your facility, so you want to ensure vendor is conducting background checks on their employees etc. If there is customer impact/interaction, then assessing their complaint policies etc. also become important.  Then there is their operational and physical security policies that would provide assurance on what controls are in place for transportation/transit.

Performance monitoring should also be in place to ensure established SLA's are achieved and issues are tracked and monitored. 

Hello all,

We are about to start a service with Brinks to pick up deposits from our customers. My question is:

Does having a deposit slip with the customers cash (with customer Name, account # and address) constitute a NPI.  I personally don't think this is an NPI, but we are having an internal debate.  If having a deposit slip constitutes NPI, then we automatically put this vendor in High-risk category, and our due diligence requirement increases.

All inputs will be helpful. 

If there is reliance on vendor service and they have access to confidential/sensitive data, or are interacting with your customers then you should definitely be performing due diligence on such vendors to gain assurance that data is protected and that in the event there is a disruption on the vendors side, they are set up with backup etc. to support interruption in service.  In due diligence you would still want to evaluate their BCDR program, InfoSec policy, ensure they have adequate insurance coverage, are financially sound to support such services.  They will have physical access to your facility, so you want to ensure vendor is conducting background checks on their employees etc. If there is customer impact/interaction, then assessing their complaint policies etc. also become important.  Then there is their operational and physical security policies that would provide assurance on what controls are in place for transportation/transit.

Performance monitoring should also be in place to ensure established SLA's are achieved and issues are tracked and monitored. 

Hello all,

We are about to start a service with Brinks to pick up deposits from our customers. My question is:

Does having a deposit slip with the customers cash (with customer Name, account # and address) constitute a NPI.  I personally don't think this is an NPI, but we are having an internal debate.  If having a deposit slip constitutes NPI, then we automatically put this vendor in High-risk category, and our due diligence requirement increases.

All inputs will be helpful. 

Hello all,

We are about to start a service with Brinks to pick up deposits from our customers. My question is:

Does having a deposit slip with the customers cash (with customer Name, account # and address) constitute a NPI.  I personally don't think this is an NPI, but we are having an internal debate.  If having a deposit slip constitutes NPI, then we automatically put this vendor in High-risk category, and our due diligence requirement increases.

All inputs will be helpful. 

If there is reliance on vendor service and they have access to confidential/sensitive data, or are interacting with your customers then you should definitely be performing due diligence on such vendors to gain assurance that data is protected and that in the event there is a disruption on the vendors side, they are set up with backup etc. to support interruption in service.  In due diligence you would still want to evaluate their BCDR program, InfoSec policy, ensure they have adequate insurance coverage, are financially sound to support such services.  They will have physical access to your facility, so you want to ensure vendor is conducting background checks on their employees etc. If there is customer impact/interaction, then assessing their complaint policies etc. also become important.  Then there is their operational and physical security policies that would provide assurance on what controls are in place for transportation/transit.

Performance monitoring should also be in place to ensure established SLA's are achieved and issues are tracked and monitored. 

I would echo this as well, as we also use the same criticality level of Critical, Significant and Non-Essential. I wonder if we utilize the same GRC tool, Quantivate, for this purpose. 

If so, I would love to connect and share best case practices and pain points as my organization is looking to mature our program. Thank you.

Original Message:
Sent: 06-14-2023 11:43 AM
From: Cheryl Turner
Subject: Armored Transportation and Cash Vault

Original Message:
Sent: 6/13/2023 4:33:00 PM
From: Anonymous Member
Subject: RE: Armored Transportation and Cash Vault

This message was posted by a user wishing to remain anonymous

Hello all,

We are about to start a service with Brinks to pick up deposits from our customers. My question is:

Does having a deposit slip with the customers cash (with customer Name, account # and address) constitute a NPI.  I personally don't think this is an NPI, but we are having an internal debate.  If having a deposit slip constitutes NPI, then we automatically put this vendor in High-risk category, and our due diligence requirement increases.

All inputs will be helpful.