This webinar is presented in partnership with TTS-Bank.
SBS Instructor: Jon Waldman
Description: Each of our regulators say this in a similar way, we must understand the security controls of a third party “to the same extent” as we understand our own internal controls. This is challenging, as some of our vendors share few details about controls. Our industry currently relies heavily on the new SSAE18 Audit Report and the Service Organization Control (SOC)2 reports provided by vendors. What are the differences between these two reports, and which should we be requesting? And once we obtain them, how do we understand the security controls to the “same extent” as our own?
We will explore the different types of SOC reports provided by vendors and highlight the best items that should be requested from vendors. Each of these reports serves a different purpose and will provide different value to your institution. In addition to what reports to ask for, we will explore them in detail to highlight what to look for and how to fill in the gaps to ensure your understanding security to the “same extent”.
What You Will Learn
- Third Party Management best practices
- Fourth Party Management assistance
- Updated Regulatory Expectations
- Existing Regulatory Review
- SSAE16 vs SSAE18 standard changes
- SOC1, SOC2, SOC3 Audits
- SOC Reports Type 1 and Type 2
- Other items useful in vendor reviews
- Detailed due diligence and contract questions
Target Audience: Information Security Officer, IT Manager, Risk Officer, Internal Auditor, CFO, and Executives looking to understand the risk around Vendor Management.
2.5 CE Credits
Hacker Hour webinars are a series of free webinars hosted by SBS CyberSecurity. Unlike paid webinars, Hacker Hours are aimed to meet on a monthly basis to discuss cybersecurity issues and trends in an open format. Attendees are encouraged to join the conversation and get their questions answered. SBS will also offer products and services to help financial institutions with these specific issues.