Regulations

With the new CCPA regulation that now requires credit unions to conduct annual cybersecurity audits, Vendor Management/Third Party Risk Management will also be responsible for "overseeing service providers and third parties to ensure they also comply with cybersecurity standards."

How is everyone preparing to address this? Would cybersecurity questions that are embedded within annual security questionnaires sufficient? And besides contractual language, what else could we do to provide proof of oversight?

Thanks in advance for any insights!

This message was posted by a user wishing to remain anonymous

We are currently in the middle of an NCUA audit and the required documents regarding cyber security is: 

Documentation demonstrating contracts with critical service providers address the timely notification of cyber incidents.