Japan FSA Cybersecurity Guidelines for Financial Institutions 2.6-B: 2.6 Third-party risk management: basic actions

Consider the whole supply chain when setting cyber strategy and plans and build a framework covering business processes including third parties; build what is needed to manage third-party cyber risk across the lifecycle and set a third-party risk policy; set up the organisation (a central function managing third parties, clear roles and coordination across departments) and internal rules; identify third parties and assess their risk from their role and importance in the business, handling of important information (personal information, trade secrets) and connection to internal systems (ease of external access), responding in proportion; keep a third-party register (name, products and functions, access level to own systems, type, sensitivity and location of data held or processed); include third parties handling incidents in incident response and contingency plans; before contracting, perform due diligence on predefined criteria (potential cyber risk and vulnerabilities, fulfilment of required security, past incidents and their handling), which may use third-party assurance or certification, and for critical third parties assess their cyber framework, incident response and contingency plans; specify by importance in contracts or SLAs the division of roles and responsibility, audit rights, subcontracting procedure, security measures, rules for their staff, incident handling and reporting, vulnerability assessments and reporting, handling and reporting of serious vulnerabilities, cyber exercises including joint ones, data location, storage, retention, transfer and disposal, termination conditions and exit arrangements, and external assessments (assurance reports, certifications); monitor continuously, according to risk, the cyber risk from third parties and their products and services and contract performance; and set an exit process (data disposal, cutting access). Third parties serving financial institutions should support them, and authorities may require reports from and inspect outsourcees where particularly necessary under the sector laws (for example Banking Act Articles 24(2) and 25(2)).