Due diligence requirements encompass all material aspects of the service provider relationship, such as the provider's financial condition, reputation (e.g., reference checks), controls, key personnel, disaster recovery plans and tests, insurance, communications capabilities and use of subcontractors. 4. Evaluate the process for entering into a contract with a service provider. Consider whether: The contract contains adequate and measurable service level agreements; Allowed pricing methods adversely affect the institution's safety and soundness, including the reasonableness of future price changes; The rights and responsibilities of both parties are sufficiently detailed; Required contract clauses address significant issues, such as financial and control reporting, right to audit, ownership of data and programs, confidentiality, subcontractors, continuity of service, etc.; Legal counsel reviewed the contract and legal issues were satisfactorily resolved; Contract inducement concerns are adequately addressed; and Contracts contain the following relative to MSSP engagements: Appropriate MIS reporting commensurate with risk; Agreed upon privileged access rights; Termination rights and appropriate renewal language; Timelines for service implementation and explicit responsibilities of the MSSP and the FI; The right to modify existing services performed under the contract; A security provision in accordance with the FI’s security program; and Ownership of data generated by proprietary security or third-party monitoring tools owned by the MSSP; Determine if the FI has a process to monitor that the MSSP is fulfilling their obligations outlined within the contract (e.g. Service Level Agreements (SLAs), Knowledge Performance Indicators (KPIs)/Knowledge Risk Indicators (KRIs)). 5. Evaluate the overall governance of the MSSP program. Appraise senior management support of the use of MSSPs; Review reports related to MSSP compliance with FI information security program; Assess changes to the information security program arising from the use of MSSPs; and Evaluate MIS reports provided to FI from MSSPs. 6. Evaluate the institution's process for monitoring the risk presented by the service provider relationship. Ascertain that monitoring addresses: Key service level agreements and contract provisions; Financial condition of the service provider;
Due diligence requirements encompass all material aspects of the service provider relationship, such as the provider's financial condition, reputation (e.g., reference checks), controls, key personnel, disaster recovery plans and tests, insurance, communications capabilities and use of subcontractors. 4. Evaluate the process for entering into a contract with a service provider. Consider whether: The contract contains adequate and measurable service level agreements; Allowed pricing methods adversely affect the institution's safety and soundness, including the reasonableness of future price changes; The rights and responsibilities of both parties are sufficiently detailed; Required contract clauses address significant issues, such as financial and control reporting, right to audit, ownership of data and programs, confidentiality, subcontractors, continuity of service, etc.; Legal counsel reviewed the contract and legal issues were satisfactorily resolved; Contract inducement concerns are adequately addressed; and Contracts contain the following relative to MSSP engagements: Appropriate MIS reporting commensurate with risk; Agreed upon privileged access rights; Termination rights and appropriate renewal language; Timelines for service implementation and explicit responsibilities of the MSSP and the FI; The right to modify existing services performed under the contract; A security provision in accordance with the FI’s security program; and Ownership of data generated by proprietary security or third-party monitoring tools owned by the MSSP; Determine if the FI has a process to monitor that the MSSP is fulfilling their obligations outlined within the contract (e.g. Service Level Agreements (SLAs), Knowledge Performance Indicators (KPIs)/Knowledge Risk Indicators (KRIs)). 5. Evaluate the overall governance of the MSSP program. Appraise senior management support of the use of MSSPs; Review reports related to MSSP compliance with FI information security program; Assess changes to the information security program arising from the use of MSSPs; and Evaluate MIS reports provided to FI from MSSPs. 6. Evaluate the institution's process for monitoring the risk presented by the service provider relationship. Ascertain that monitoring addresses: Key service level agreements and contract provisions; Financial condition of the service provider;