FFIEC IT Examination Handbook AIO-III.E: III.E Oversight of Third-Party Service Providers (Architecture, Infrastructure, and Operations)

What does AIO-III.E require?

Management identifies the internal and external roles and responsibilities for AIO activities, oversees the activities third-party providers perform on its behalf so that all risks are identified and addressed under contracts and SLAs, knows the providers' data destruction processes including those of cloud providers with SLAs requiring destruction that prevents unauthorised disclosure, reviews independent audit or assurance reports of the providers' ability to meet AIO needs safely and soundly, and reports to the board on the effectiveness of outsourced AIO activities and issues found through third-party risk management.