The Interagency Guidelines Establishing Information Security Standards tell banks to exercise appropriate due diligence in selecting service providers, require safeguards by contract, and, where their risk assessment indicates, monitor providers by reviewing audits, test summaries or similar evaluations. The bank stays responsible for its customers.
This is general information, not legal advice. The text below follows the OCC version at 12 CFR Part 30, Appendix B.
The three duties
| Duty | Text in short | Vendor takeaway |
|---|---|---|
| Due diligence | Appropriate due diligence in selecting providers | Be ready to describe your program |
| Contract | Providers required to apply suitable safeguards | Expect security terms in the agreement |
| Monitoring | Where indicated by risk assessment, review audits, test summaries or comparable evaluations | Have shareable evidence |
The wider program around it
The guidelines also ask for board approval and oversight of the written information security program, a risk assessment that identifies foreseeable internal and external threats, and regular testing of key controls. They say tests should be conducted or reviewed by independent third parties or by staff who did not build or maintain the program.
Incident response in the guidelines
The supplement says an incident response program should assess the nature and scope of an incident, contain it, preserve evidence and notify customers when warranted. It says institutions should tell their primary federal regulator as soon as possible after learning of an incident involving sensitive customer information.
Where a service provider's systems are involved, the bank's contract should require the provider to notify the bank as soon as possible. The bank remains responsible for notifying customers and its regulator, though it may delegate the task to the provider.
How this connects to newer guidance
The 2023 interagency guidance goes into more detail on lifecycle, but these guidelines are the longer standing security standard. A vendor who can show independent testing and a clear notice process satisfies the questions that flow from both. See the post on what banks ask in due diligence.
Evidence a vendor can hand over
- Summary of the latest independent test, with scope.
- Your incident response plan and notification contacts.
- A statement of how often you scan code and dependencies, with sample output.
- Your subcontractor list.
Quick check
Does the bank hand off responsibility to the vendor?
No. The guidelines say the bank remains responsible for notifying customers and its regulator, even if it delegates the task.
Are independent tests required?
The guidelines say tests should be conducted or reviewed by independent third parties or staff who did not build or maintain the program.
Sources
- 12 CFR Part 30, Appendix B, Interagency Guidelines Establishing Information Security Standards
- Interagency Guidance on Third-Party Relationships, Federal Register, 9 June 2023
Last reviewed: 19 October 2026.
