Due diligence checklist, United States
Computer-Security Incident Notification Rule: what to ask a vendor
Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers. OCC, Federal Reserve and FDIC. Bank service providers notify the bank as soon as possible of an incident that disrupts service for four hours or more.
What it is
Bank service providers notify the bank as soon as possible of an incident that disrupts service for four hours or more.
Who it applies to
Applies to banks and mutuals and credit unions in the United States.
What to ask a vendor, and the evidence to request
| # | Ask the vendor for | Evidence to request |
|---|---|---|
| 1 | Notice to the institution as soon as possible after a computer-security incident likely to disrupt service for four hours or more | The incident notification clause and procedure: what counts as an incident, who is told, within what time, and a record of a past notification if one exists. |
In every case
- A named contact at the vendor responsible for this regime, and how the vendor tracks changes to it.
- Which named customers the vendor already serves under this regime, as references you may call.
This checklist is a starting point for a procurement team, not legal advice. Read it with the regulator's own page, your institution's policies and your legal and risk teams; the regime may have changed since the date on this document.
Next
- Every checklist, by country
- What a market scan is and how to run one
- Have Vederca run the procurement: the regime goes into the register as a must-have