Outsourced Third Party (Vendor) Management

Outsourced Third Party (Vendor) Risk Management is a top priority with the regulators. Therefore, ensuring your Program is not only going to be effective but also meet with their expectations needs to be a priority for financial institutions. When you outsource, you are placing your confidential customer information in someone else's hands along with the availability and security of that information, but you still retain the responsibility for ensuring the integrity, confidentiality, availability and security of the information making this Program a crucial part of your overall Information and Cyber Security Program.

Demonstrating the importance of this Program, the OCC and the FRB both issued updated guidance relating to third party relationships in October and December of 2013, respectively while the FDIC reissued its Technology Outsourcing Informational Tools in April of 2014. Then on February 6, 2015, the FFIEC released an update to the Business Continuity Planning Handbook adding Appendix J: Strengthening the Resilience of Outsourced Technology Services. The update includes guidance on Third Party Management, Third Party Capacity, Testing with Third-Party Technology Service Providers, and Cyber Resilience. The FFIEC Cybersecurity Assessment Tool (CAT) also includes declarative statements relating to Outsourced Third Party Risk Management practices.

Susan Orr has assisted numerous institutions with developing their Outsourced Third Party Risk Management Program and will share her insights into developing an effective program in this webinar.

What You Will Learn

  • FFIEC agencies expectations for your Program
  • The latest guidance:
    • Appendix J of the FFIEC BCP Handbook
    • Appendix D of the FFIEC Outsourced Technology Services Handbook
    • FFIEC Supervision of Technology Service Providers, September 2012
    • FDIC April 2014 Tools to Manage Technology Providers Informational Brochures
    • OCC October 2013 Third Party Relationships
    • FRB December 2013 Guidance on Managing Outsourcing Risk
  • Classification and Risk Rating criteria
  • Required Program elements and essentials
    • Responsibilities
    • Needs Assessment
    • Due Diligence/Selection
    • Contracting
    • Risk Assessing
    • Oversight

Who Should Attend?

Senior Management, Information Security Officers, Compliance Officers, Risk Managers, IT Managers, Operations Managers.


Connection Error #D55. For immediate assistance, please use our online chat (lower right corner of this page).
   Live Plus Five (days) - $265   
   OnDemand Recording - $295   
   CD-ROM - $345   
   Live Plus Six (months) - $365   
   Premier Package - $395   
Additional Locations
Want your branches to participate? Facilities within your organization will be able to participate without the travel costs of coming to one location.
Each additional location adds $75 to your registration and can be entered on the next screen as you confirm your order.