Open Banking Security
TPP Onboarding

Open Banking Security OPENBANK-4: Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

Operate Third Party Provider onboarding + directory integration + due diligence per national scheme + applicable regulation. Third Party Provider Onboarding must (a) verify TPP authorisation status via national directory (UK OBIE Directory + EU eIDAS + Brazil + Australian Accreditation + SAMA + similar), (b) maintain TPP eligibility verification ongoing through directory checks, (c) handle TPP certificate management + key rotation + revocation + (d) coordinate with TPP for testing + onboarding + change management. Due diligence + onboarding must (a) conduct TPP cybersecurity due diligence + (b) verify regulatory authorisation + insurance + operational capability + (c) document onboarding decision + ongoing oversight obligations. Concentration risk management must (a) monitor TPP concentration + critical-service identification + alternative arrangements + (b) coordinate with regulator on concentration concerns. Exit strategy and transition planning must (a) maintain TPP transition planning + data portability + service continuity + customer notification + (b) integrate with broader vendor exit management.

What else in your programme already covers this

This control maps to 130 controls across 60 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FFIEC IT Examination Handbook · 6 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-11 Business continuity planning and testing
  • FFIEC-12 Disaster recovery procedures
  • FFIEC-14 Critical service identification
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
  • NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

APRA CPS 234 · 4 controls

  • CPS234-14 Definition of Information Security Roles and Responsibilities
  • CPS234-15 Information Security Capability
  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

ASIS SPC.1-2009 - Organizational Resilience Standard · 3 controls

  • 4.3.2 Legal and Other Requirements
  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.2 Competence, Training, and Awareness

BS 65000:2014 - Guidance on Organizational Resilience · 3 controls

EASA Part-IS - Information Security in Aviation · 3 controls

FFIEC Cybersecurity Assessment Tool (CAT) · 3 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

ISO 27005 · 3 controls

ISO 31000 · 3 controls

ISO/IEC 23894:2023 · 3 controls

NIST Privacy Framework · 3 controls

  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-6 Protect-P Data Security (PR.DS-P)
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)

NIST SP 800-53 Rev 5 · 3 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

IEC 62351 - Power Systems Communication Security · 2 controls

  • 62351-12 Resilience and security recommendations for DER
  • 62351-13 Cyber-physical generation and storage resilience

ISO 37000:2021 - Governance of Organizations · 2 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 2 controls

ISO/IEC 27003:2017 · 2 controls

ISO/IEC 27031:2011 · 2 controls

ISO/IEC 38500:2024 - Governance of IT · 2 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 2 controls

  • 3.16 System and Services Acquisition
  • 3.17 Supply Chain Risk Management

O-RAN WG11 Security Specification · 2 controls

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture
  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OECD AI Principles · 2 controls

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

Protective Security Policy Framework (PSPF) Release 2024 · 2 controls

  • PSPF24-1 Security Culture, Governance, Risk Management
  • PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight

UK Open Banking Standard · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

AS9100D - Aerospace Quality Management System · 1 control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

Aged Care Quality Standards 2019 (repealed edition) · 1 control

Annex 11 to EU GMP - Computerised Systems · 1 control

COBIT 2019 · 1 control

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

ICH Q10 - Pharmaceutical Quality System · 1 control

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

ISO 20000-1 · 1 control

ISO 20400:2017 - Sustainable Procurement · 1 control

ISO 22320:2018 · 1 control

ISO 27019 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

ISO 28001:2007 Supply Chain Security Management · 1 control

ISO/IEC 25012:2008 - Data Quality Model · 1 control

ISO/IEC 27007:2020 · 1 control

  • 27007-5.4 Establishing the Programme Resources

ITIL 4 · 1 control

  • ITIL4-03 Capacity and availability management

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST SP 1800-32 · 1 control

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

  • OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

South Korea Cloud Security Assurance Program (CSAP) · 1 control

  • KRCSAP-1 CSAP Certification Tiers (IaaS, SaaS, DaaS, AI)

South Korea ISMS-P · 1 control

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • CERT-1 RRA Certification to EPA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 130 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Open Banking Security controls