US Interagency Sound Practices to Strengthen Operational Resilience

Section 4 Third-party risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience

US Interagency Sound Practices to Strengthen Operational Resilience 4e: Address key third-party concerns affecting resilience through due diligence, contract negotiation, ongoing monitoring and termination

What does 4e require?

Where a concern about a third party bears on the firm's resilience, the firm acts on it, whether through due diligence, contract negotiation, ongoing monitoring or ending the contract.

Maintained by Gerard Blokdyk

Other controls in Section 4 Third-party risk management (practices a to g) – US Interagency Sound Practices to Strengthen Operational Resilience

4a Identify and analyse third-party risk to critical operations and core business lines and prioritise the most significant dependencies
4b Formal agreements with third parties, with performance managed and monitored against service requirements and the tolerance for disruption
4c Periodic review of third parties' systems and controls reports and test results, with processes and benchmarks for monitoring their ability to deliver during disruptions
4d Verify that third parties have sound risk management and controls that identify and mitigate hazards to operations consistent with the tolerance for disruption
4f Identify risks from providers of public and critical infrastructure services such as energy and telecommunications, with processes to manage their disruption
4g Identify alternative third parties and assess substitutability of providers supporting critical operations and core business lines, including bringing a service in-house

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All US Interagency Sound Practices to Strengthen Operational Resilience controls