FFIEC IT Examination Handbook IS-II.C.20(b): II.C.20(b) Managed Security Service Providers (Information Security)

Where managed security service providers deliver security services, management remains responsible for the security of the institution's systems and information and oversees the effectiveness of the services provided.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Information Security booklet (September 2016) – FFIEC IT Examination Handbook

IS-I.A I.A Security Culture (Information Security)
IS-I.B I.B Responsibility and Accountability (Information Security)
IS-I.C I.C Resources (Information Security)
IS-II.A.1 II.A.1 Threats (Information Security)
IS-II.A.2 II.A.2 Vulnerabilities (Information Security)
IS-II.A.3(a) II.A.3(a) Supervision of Cybersecurity Risk (Information Security)
IS-II.A.3(b) II.A.3(b) Resources for Cybersecurity Preparedness (Information Security)
IS-II.B II.B Risk Measurement (Information Security)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All FFIEC IT Examination Handbook controls