Open Banking Security
TPP Onboarding

Open Banking Security OPENBANK-4: Third Party Provider (TPP) Onboarding, Directory Integration, Due Diligence

Operate Third Party Provider onboarding + directory integration + due diligence per national scheme + applicable regulation. Third Party Provider Onboarding must (a) verify TPP authorisation status via national directory (UK OBIE Directory + EU eIDAS + Brazil + Australian Accreditation + SAMA + similar), (b) maintain TPP eligibility verification ongoing through directory checks, (c) handle TPP certificate management + key rotation + revocation + (d) coordinate with TPP for testing + onboarding + change management. Due diligence + onboarding must (a) conduct TPP cybersecurity due diligence + (b) verify regulatory authorisation + insurance + operational capability + (c) document onboarding decision + ongoing oversight obligations. Concentration risk management must (a) monitor TPP concentration + critical-service identification + alternative arrangements + (b) coordinate with regulator on concentration concerns. Exit strategy and transition planning must (a) maintain TPP transition planning + data portability + service continuity + customer notification + (b) integrate with broader vendor exit management.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 116 controls across 54 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FFIEC IT Examination Handbook · 6 controls

  • FFIEC-03 Risk appetite and tolerance for IT risk
  • FFIEC-11 Business continuity planning and testing
  • FFIEC-12 Disaster recovery procedures
  • FFIEC-14 Critical service identification
  • FFIEC-18 Ongoing monitoring and assessment
  • FFIEC-20 Exit strategy and transition planning

NIST Cybersecurity Framework 2.0 · 6 controls

  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
  • NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
  • NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
  • NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations
  • NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

  • 27557-1 Scope
  • 27557-3 Terms and definitions
  • 27557-6.4 Privacy risk treatment
  • 27557-6.6 Recording and reporting
  • 27557-7.3 Risk-based privacy program implementation

APRA CPS 234 · 4 controls

  • CPS234-14 Definition of Information Security Roles and Responsibilities
  • CPS234-15 Information Security Capability
  • CPS234-16 Assessment of Related Party and Third Party Capability
  • CPS234-20 Information Asset Classification

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 4 controls

  • IM8-DAT.2 Data Protection
  • IM8-DSS.2 Service Reliability Standards
  • IM8-RES.4 Resilience Testing
  • IM8-TPM.4 Supply Chain Risk Management

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-37 Service Provider Management Policy
  • CPS230-46 Ongoing Risk Management of Each Material Arrangement

ASIS SPC.1-2009 - Organizational Resilience Standard · 3 controls

  • 4.3.2 Legal and Other Requirements
  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.2 Competence, Training, and Awareness

BS 65000:2014 - Guidance on Organizational Resilience · 3 controls

  • BS65000-RM-01 Resilience Journey
  • BS65000-RM-02 Integrated Approach
  • BS65000-RM-03 Leadership and Culture

EASA Part-IS - Information Security in Aviation · 3 controls

  • IS.D.OR.210 Information Security Risk Treatment
  • IS.I.OR.210 Information Security Risk Treatment
  • IS.I.OR.220 Information Security Risk Management

FFIEC Cybersecurity Assessment Tool (CAT) · 3 controls

  • CAT-D1-2 Risk management
  • CAT-D5-4 Resilience planning and testing
  • CAT-ML-2 Evolving

IEC 60601-1 - Medical Electrical Equipment Safety · 3 controls

  • 60601-1.4.1 General requirements
  • 60601-1.4.2 Risk management process
  • 60601-1.5.1 General requirements for testing

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

  • IEC62304-4.1 Quality Management System
  • IEC62304-5.1 Software Development Planning
  • IEC62304-7.4 Risk Management of Software Changes

ISO/IEC 23894:2023 · 3 controls

  • ISO23894-5.1 Leadership and Commitment
  • ISO23894-5.2 AI Risk Management Integration
  • ISO23894-5.5 Framework Evaluation

NIST Privacy Framework · 3 controls

  • NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring
  • NISTPF-6 Protect-P Data Security (PR.DS-P)
  • NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)

NIST SP 800-53 Rev 5 · 3 controls

IAIS Insurance Core Principles (ICPs) · 2 controls

  • ICP-16 Enterprise Risk Management for Solvency Purposes
  • ICP-8 Risk Management and Internal Controls

IEC 62351 - Power Systems Communication Security · 2 controls

  • 62351-12 Resilience and security recommendations for DER
  • 62351-13 Cyber-physical generation and storage resilience

ISO/IEC 27003:2017 · 2 controls

  • ISO27003-6.1 Actions to address risks and opportunities
  • ISO27003-8.3 Information security risk treatment

ISO/IEC 27031:2011 · 2 controls

  • 27031-8.1 Exercising and Testing
  • 27031-B High availability embedded systems

O-RAN WG11 Security Specification · 2 controls

  • ORANWG11-1 O-RAN Threat Model, Risk Management, and Security Architecture
  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OECD AI Principles · 2 controls

  • OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection
  • OECDAI-5 Data Governance, Training Data Quality, Privacy, and Bias Mitigation

Protective Security Policy Framework (PSPF) Release 2026 · 2 controls

  • PSPF24-1 Security Culture, Governance, Risk Management
  • PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight

UK Open Banking Standard · 2 controls

  • OB-API.4 MI Reporting Specification
  • OB-OPS.1 API Availability Requirements

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-82 Part A Compliance

API 1164 · 1 control

  • API1164-21 TSA Pipeline Security Directive Alignment

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-8.1 Operational Planning and Control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-20 Multi-factor authentication (Essential)

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-4 Risk Management

Annex 11 to EU GMP - Computerised Systems · 1 control

COBIT 2019 · 1 control

  • COBIT-BAI04 Managed availability and capacity

FBI CJIS Security Policy · 1 control

  • CJIS-19 Supply Chain Risk Management

ICAO Annex 17 - Aviation Security (AVSEC) · 1 control

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)

ICH Q10 - Pharmaceutical Quality System · 1 control

IEC 62443 · 1 control

  • IEC62443-21 Supply chain risk management for critical components

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • ISO-15189-5.6 Risk management

ISO 20400:2017 - Sustainable Procurement · 1 control

  • ISO-20400-4.5 Key considerations for sustainable procurement

ISO 22320:2018 · 1 control

  • ISO-22320-4.3 Risk-based approach

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-SA-04 Security Risk Treatment Planning

ISO/IEC 20000-1:2018 · 1 control

  • ISO20000-03 Capacity and availability management

ISO/IEC 25012:2008 - Data Quality Model · 1 control

  • ISO-25012-4.13 Availability

ISO/IEC 27007:2020 · 1 control

  • 27007-5.4 Establishing the Programme Resources

ISO/IEC 27019:2024 · 1 control

  • ISO27019-21 Supply chain risk management for critical components

ITIL 4 · 1 control

  • ITIL4-03 Capacity and availability management

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST SP 1800-32 · 1 control

NRF Cybersecurity and Data Privacy Framework (National Retail Federation) · 1 control

  • NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model

OECD Recommendation on Artificial Intelligence (2024 Update) · 1 control

  • OECDAI24-3 Frontier Model Risk Management, Capability Disclosure, and Independent Evaluation

Singapore AI Governance Framework · 1 control

  • AIGF-1.1 Risk Management and Internal Controls

South Korea Cloud Security Assurance Program (CSAP) · 1 control

  • KRCSAP-1 CSAP Certification Tiers (IaaS, SaaS, DaaS, AI)

South Korea ISMS-P · 1 control

  • ISMSP-MS-02 Risk Management

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 1 control

  • CRM-3 Risk Management Framework

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • CERT-1 RRA Certification to EPA

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 116 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Open Banking Security controls