Expect questions on your information security program, how you manage systems, how much work you subcontract, operational resilience, incident reporting, insurance and financial condition. These come from the factors in the 2023 interagency third-party guidance that banks use to structure diligence.
This is general information, not legal advice. Individual banks vary.
The factors in the guidance
The guidance lists diligence factors including strategies and goals, legal and regulatory compliance, financial condition, business experience, key personnel and risk management. It then goes into topics that matter most to a software vendor.
| Topic | What the guidance points to | What to prepare |
|---|---|---|
| Information security | Program and controls such as multifactor authentication and encryption | Policy, MFA and encryption evidence |
| Information systems | Business processes and systems, especially where technology is a major component | Architecture overview, data flow |
| Resilience | Operational resilience and incident reporting | Recovery objectives, test results, notice plan |
| Subcontractors | Volume of subcontracted work and how you oversee it | Subcontractor list and oversight process |
| Other | Physical security, insurance, contracts with others | Insurance summary, key agreements |
Make answers checkable
A good answer names a control, says how often it runs, and points to evidence. "We scan dependencies on every pull request and block critical findings on reachable code" is checkable. "We take security seriously" is not.
Avoid describing an audit as finished if it is in progress, and never call a report a certification.
A short prep routine
- Collect your policies and the last test results you can share.
- Produce a current component inventory so subcontractor and software component questions have real answers.
- Write down your incident notification process with names and timing.
- Prepare a single page on where customer data lives and who can access it.
- Keep one owner and one shared folder so replies stay consistent across questionnaires.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the inventory and notice how each component carries a version and a vulnerability status, the kind of detail a bank reviewer asks for.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and compliance and evidence automation can produce a component inventory and keep evidence organized. A free scan is at gold.safeguard.sh/scan.
Quick check
Do banks ask for SOC 2 reports?
Many ask for independent assurance reports, but the guidance itself lists factors, not a required report. Offer what you honestly have and describe its scope.
What if we use many subcontractors?
Say so plainly and show how you oversee them. The guidance asks banks to look at the volume of subcontracted work and how you monitor it.
Sources
Last reviewed: 19 October 2026.
