FFIEC IT Examination Handbook IS-I.C: I.C Resources (Information Security)

Management provides, and the board oversees, adequate funding for the information security program, staffed by sufficient personnel whose technical and managerial skills, including knowledge of technology standards, practices and risk methodologies, match the institution's size, complexity and risk profile, with oversight of third-party providers that supplement those capabilities commensurate with the sensitivity and criticality of what they support.