Monetary Authority of Singapore Technology Risk Management Guidelines 3.4: 3.4 Management of Third Party Services

Third party services that are not outsourcing can still expose the FI and its customers when they are delivered through IT or hold customer information, because a failure or breach at the third party affects the FI. Before contracting or partnering, the FI should assess and manage its exposure to technology risks affecting the confidentiality, integrity and availability of IT systems and data at the third party, and on an ongoing basis it should ensure the third party exercises a high standard of care and diligence in protecting data confidentiality and integrity and in keeping systems resilient.