The guidelines highlight eight security measures that banks should consider and adopt if appropriate. The information security program also should include training for bank staff and regular testing of the key controls, systems, and procedures. The nature and frequency of the tests should be determined by the bank's risk assessment. To ensure objectivity, tests should be conducted or reviewed by third parties or staff who are independent of those who develop or maintain the security programs. Oversee Service Provider Arrangements.
Banks also ave an obligation to oversee their service providers.
Banks that use service providers should exercise appropriate due diligence in selecting them, including conducting a review of the measures taken by the service providers to protect customer information. The contract between the bank and the service provider must require the provider to implement appropriate measures designed to meet the objectives of the guidelines. Wherever indicated by a bank's risk assessment, the bank should monitor its service providers to confirm they are implementing the agreed-upon security measures. As part of this monitoring, a bank should review audits, summaries of test results, or other equivalent evaluations of its service providers. Adjust the Program.