About Us | Contact Us
View Cart

Sometimes Say Sometimes

By Dan Hadaway | Monday, March 22, 2021 - Leave a Comment

Another Manifesto


A supply-chain manifesto by the author of Never Say Never: A Password Manifesto!
Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . .


[Sssshh.  Turn out the lights.  Let’s lower our inner voices, as I have something to propose that might be a bit ahead of its time, like my article about password aging a decade ago.]

In 2013, I helped a bank being hammered by an exam finding that required them to rewrite their entire vendor management program.  A member of the committee that helped with the engagement was a lawyer who, being on the board of directors of a bank, was very concerned about the extra compliance work that was arising from the notion of “Information Technology.”

In grilling me about my business, he learned that I oversaw a company that was in the FFIEC’s technology service provider examination program, and that I was being examined (literally that week) on a two year cycle.  He was fascinated by this . . . that the federal government would be in my office examining us as if we were a bank.  Almost as if I was in a deposition, I answered his questions, as he continued to drill down as far as he could, given that I was not allowed to share what happened in my exams.

This lawyer actually followed the link I had provided in my training to the guidance on the TSP Examination Program, downloaded the PDF of that guidance, and came to the conclusion that . . . “given my connections in the industry” . . . we should try to lobby the FFIEC to exempt community-based banks from having to review vendors that were in the TSP exam program.  As far as he could tell, the federal government was doing everything that they were requiring community-based banks to do.

At the time, I’ll have to admit, I told him I would look into it, flattered that he thought I was “connected.”  But I never was able to find a good time to raise it with governmental people I know.  The idea died right there, in 2013, and didn’t resurface again until we wrote the “interim post-mortem review” on the SolarWinds Incident  (I still love how something can be “interim” and “post” at the same time!).

But when our post-mortem review process drilled into the management lessons and action items, we realized that one of the things bank management could do was lobby the FFIEC to streamline the vendor management process so that community-based banks would not have to spend time on any residual risk that wasn’t high or critical.

Assuming inherent risk is high in order to get into the FFIEC TSP Exam Program, we are proposing community banks be exempted from the Assurance and Insurance aspects of due diligence with vendors in the program.  Banks would still need to perform contract, financial, and business continuity aspects of this review.  And we would still want community banks to review the TSP ROE, the SOC User Entity Control Considerations, and the “inventory of subservience providers” that arises from a SOC 2 review.

I understand and agree with some of the pushback that examiners would give on this notion.  They will tell you that the agreement and relationship between bank and vendor is already very customized and that the FFIEC exam is for generic inherent risk and not custom residual risk.  As a risk manager, I understand that notion, but I submit to you that there are many vendors NOT in the FFIEC examination program and the assurance review for these vendors suffers due to duplication of efforts with TSP ROE holders.

And I submit that sometimes we need to say sometimes.  Sometimes duplication of effort only hurts the overall process.  That is one of the takeaways of the SolarWinds incident.

The parts of the relationship that are custom is the contract, the user entity control considerations and the business continuity arrangements.  We do produce one set of financial statements for one Client, and another for a different Client.  So why should our Clients review them with the FFIEC already does?

If as bankers we could focus on the parts of the relationship that is INDEED custom to the bank, we would understand the business continuity arrangements better.  We could incorporate their tests into our own better. We can follow the residual risk, not the inherent risk.

Sometimes, we need to say sometimes.  I agree that in some cases, we should review everything.  If an FFIEC TSP Exam report does indicate there are issues, we should follow that.

Of course community banks will need to continue reviewing their vendor contracts.  That’s where the customization is defined.

Therefore, and this is where I’m a bit shy . . . . I encourage each person who reads this article to share it with the person in your bank who is responsible for lobbying your congressman.

We can really make a difference in community banking on this one, it is very clear to me that the TSP examination program already covers assurance from enough angles.  The FFIEC should learn to say sometimes, sometimes.  If the vendor is not in the TSP examination program . . . definitely look at the assurance.  But if the vendor is in the TSP examination program, maybe community-based banks under a billion should be exempted.

[Okay, we can turn the lights back on.]


Original article by Dan Hadaway CRISC CISA CISM. Founder and Managing Partner, infotex

“Dan’s New Leaf” is a “fun blog to inspire thought in the area of IT Governance.”

 


same_strip_012513


 

Latest News
    Our Lead Non-Technical Auditor takes a look at the new AIO Guidance… Architecture, Infrastructure, and Operations (AIO) is the latest booklet released by the Federal Financial Institutions Examination Council (FFIEC) in their line of  IT Examination Handbooks. It is an update to their 2004 Operations booklet and, as the name implies, expands into the areas […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]
    Many organizations still fail to consider the unique risks posed by cloud computing… An article review. Last month thousands of Western Digital MyCloud device owners learned about the risks of cloud-based solutions the hard way: their data had been wiped remotely due to a flaw in the internet-facing component of their external hard drives. While […]
    infotex does not use Kaseya… We are protecting our Clients! Another blog post meant to inspire thought about IT Governance . . . . To all infotex managed security service Clients: As you may be aware there was a large ransomware attack recently that leveraged a remote management tool called Kaseya that is used by many […]
    While we’re not a news service, we often use current events to comment on trends and our services. This blog is intended to get people thinking about topics and trends in Technology Risk Management, through our article reviews, as well as through original blog articles about current events and our MSSP services (such as our […]
    PRESS RELEASE – FOR IMMEDIATE RELEASE BUSINESS NEWS Dan Hadaway and Sara Fultz co-wrote an article in the Spring 2021 issue of the Ohio Record, the Official Magazine of the Ohio Bankers League.  Find out on page 20 and 21 of the magazine how tabletop testing strengthens bank cybersecurity. You can read the article here! […]
    You’ve heard it from every MSSP you’ve met: the definition of a SIEM is in the eye of the beholder. But at infotex, we are not talking about the database – an asset whose definition is continuously evolving. We’re talking about the way three teams collaborate in an overall Technology Risk Monitoring process. And whether […]
    After the large number of high-profile breaches in the recent months, it is easy to become disconcerted about how to prevent such things from happening to your Bank. The answer to preventing a breach is a very complex one. infotex will explore this with you! The heightened level of awareness and extra protective tendencies that […]
    A follow-up on Dan’s 2008 Password Manifesto On the NIST Publication on Digital Identity Guidelines Another one of those Dan’s New Leaf Posts, meant to inspire thought about IT Governance . . . . In June 2017, NIST released a special publication on digital identity, NIST SP 800-63, that is starting to get the attention […]
    Another awareness poster for YOUR customers (and users).  Now that we have our own employees aware, maybe it’s time to start posting content for our customers! Download the large versions here: Awareness Poster (Portrait) Awareness Poster (Landscape)   You are welcome to print out and distribute this around your office. Interested in one of ours […]