FFIEC IT Examination Handbook DAM-VI.A: VI.A Acquisition Policies, Standards, and Procedures (Development, Acquisition, and Maintenance)

What does DAM-VI.A require?

Enforced acquisition policies, standards and procedures give consistency and guard against buying what does not meet the need, fails to protect confidentiality, integrity, availability and resilience, breaches the Information Security Standards or the Bank Service Company Act or leaves contracts and licences inadequate for want of stakeholder involvement; they address requests for information, proposals and quotes, third-party due diligence that assesses relationship risk, reviews operational and internal controls, evaluates and selects with defined criteria and checks references, and the further elements the booklet lists.