<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Why Vendor Cyber Monitoring Matters

author Michael Berman
2 min read
Mar 21, 2019

Vendor cyber breaches are shockingly common. A study released by the Ponemon Institute in November revealed that 59 percent of respondents in the U.S. and U.K. report that a third party caused a data breach.

That includes the 42 percent of organizations that experienced a vendor-related data breach in the past 12 months. Another 22 percent didn’t even know if they’d been exposed by a third-party data breach.

Consider these recent examples:

Corporations Services Company (CSC). Routine security monitoring detected unauthorized access to CSC’s network and systems in April 2018. The company, which serves over 3,000 financial institutions, said that a database with client information containing at least 5,600 individual’s names, Social Security numbers or credit/debit card information was stolen. The company has since added controls like two-factor authentication, more firewalls and longer employee passwords.

Scottrade Bank. More than 20,000 customers’ sensitive information was exposed when third-party vendor Genpact “uploaded a data set to one of its cloud servers that did not have all security protocols in place.” It was discovered by an outside researcher.

InTouch Credit Union. A third-party data analytics service was a victim of a ransomware attack. Member Social Security number and account information was exposed. As a result, the institution changed accounts and cards for all affected accounts and provided data monitoring for thousands of members.

No matter how strong a financial institution’s own cyber defenses are, it’s really only as strong as its weakest vendor.

Ongoing Vendor Monitoring: What to Look for

Ongoing monitoring of your vendors’ cybersecurity programs is critically important. This includes:

  • Ongoing monitoring of your vendors’ cybersecurity controls to detect vulnerabilities before there is an issue and take action if an issue is uncovered
  • Assessing your vendors’ ability to effectively identify and resolve incidents
  • Comprehensive documentation of activity regarding your vendors’ cybersecurity program
  • A system for recording incidents and resolutions regarding your vendors’ cybersecurity issues so you can document due diligence for regulators, seek remediation if a vendor has violated its service level agreement and uncover patterns
  • Ensuring a vendor’s cyber risk aligns with your institution’s appetite for cyber risk

Don’t assume your vendor is protecting your sensitive data. Make sure you are taking proactive steps to ensure vendors are up-to-date on the latest threats and addressing cybersecurity thoroughly.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Nrisk Regulatory Compliance Management News & Updates HMDA Risk Mortgage Lenders Ncomply Vendor Management Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Audits & Findings Company Culture OCC Regulatory Updates Audit Nverify Regulatory Compliance Exams FDIC Compliance Management Findings Nfindings NCUA Contract Management Employee Intranet Contract FRB Business Continuity Management FFIEC Findings Management Ncontracts manager Third-Party Vendors Vendor Risk Enterprise Risk Management ABA Bank Access Control Audit Findings Board Portal Call Report Due Diligence Efficiency Employee Engagement Exam findings FIEC Inc. 5000 Internal Audit Management Nboardportal Verify Wealth Management
4 Ways To Use Complaint Data To Improve Risk Management
Risk Management

4 Ways To Use Complaint Data To Improve Risk Management

Jun 16, 2020 3 min read
4 Features FIs Should Look for in a Cybersecurity Assessment Solution
Risk Management

4 Features FIs Should Look for in a Cybersecurity Assessment Solution

Apr 15, 2021 2 min read
Heightened Cybersecurity Risk – Is Your FI Prepared?
Risk Management

Heightened Cybersecurity Risk – Is Your FI Prepared?

Jan 21, 2020 3 min read