Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBanks remain responsible for safe and sound operations and for complying with applicable law when they rely on outside providers. The practical answer is to assess each relationship according to its risks, test security and recovery capabilities with evidence, and keep oversight active from planning through exit. The Federal Reserve, FDIC, and OCC’s 2023 interagency guidance is the central supervisory baseline; it describes risk-management principles, not a new law or a universal vendor checklist.
Why third-party cybersecurity is still the bank’s responsibility
A technology provider may host data, process transactions, connect to bank systems, or support a service customers depend on. Those arrangements can expose the bank to security, operational, compliance, and customer risks even when the provider performs the work.
As an Amazon Associate I earn from qualifying purchases.
The agencies state in their June 6, 2023 Interagency Guidance on Third-Party Relationships: Risk Management: “A banking organization’s use of third parties does not diminish or remove a banking organization’s responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house.” In practice, outsourcing a service does not outsource the bank’s accountability for managing its risks.
The guidance replaced the agencies’ earlier general third-party guidance and calls for a risk-based approach. It does not require identical scrutiny for every supplier. Banks should maintain an inventory, periodically assess relationships, and increase the depth and rigor of oversight where the relationship presents greater risk, including when it supports a critical activity.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
How the supervisory framework stands in 2026
The 2023 interagency guidance sets out principles for managing third-party relationships across their life cycle. The agencies’ 2024 Third-Party Risk Management: A Guide for Community Banks is a companion resource, not a binding checklist. In a May 7, 2024 letter, the Federal Reserve said: “This guide does not have the force and effect of law and does not impose any new requirements on banking organizations.” It is aimed at community banks but may also be useful to other banks.
On September 11, 2026, the OCC announced proposed revised guidance coordinated with the Federal Reserve, FDIC, and NCUA. It would replace existing third-party-risk guidance and emphasizes tailoring practices to reasonably assessed relationship risk and prioritizing according to the magnitude and likelihood of potential harm. It remains a proposal, not final guidance. OCC Bulletin 2026-46 says the proposed guidance “will not set forth enforceable standards or prescriptive requirements.” The bulletin says comments are due 60 days after Federal Register publication; consult the Federal Register for the publication date and applicable deadline rather than assuming a calendar date.
Also on September 11, 2026, the OCC announced an interagency statement concerning risk-based supervision of certain services provided by core providers to community banking organizations. That development is relevant to community banks’ core-provider relationships; its specific supervisory factors should be taken from the statement itself.
Manage the relationship through five connected stages
The agencies describe a continuous life cycle. Governance, accountability, independent review, documentation, and reporting support every stage rather than sitting apart from the work.
| Stage | What the bank does | Cybersecurity focus |
|---|---|---|
| Planning | Define the business need, the provider’s role, and the arrangement’s risk. | Identify data and system access, dependencies, customer interaction, and whether the service supports a critical activity. |
| Due diligence and selection | Assess whether the provider is suitable for the specific service and risk. | Examine its security program, relevant control evidence, vulnerabilities, remediation, and recovery capability. |
| Contract negotiation | Translate the bank’s assessment into clear service expectations and workable information rights. | Establish how the bank can understand relevant systems and processes and obtain information needed to oversee the relationship. |
| Ongoing monitoring | Check that the provider continues to meet commitments and manage risk. | Review control quality and sustainability, changes in risk, incidents, findings, and service or recovery performance. |
| Termination | Plan how the relationship can end and how the bank can respond if the provider cannot perform. | Consider continuity, transition, and alternatives that limit disruption and preserve appropriate control of information and services. |
Start with the service, then decide how much oversight it needs
Risk tiering should reflect the actual activity and arrangement, not just the provider’s name or a generic label. Consider what the provider does, how it connects to the bank, what it can access, and how the service depends on other parties or technology.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
- Information and access: Does the provider handle sensitive information, including customer data, or have access to bank systems?
- Operational role: Does it process transactions or supply technology or business services the bank depends on?
- Customer and business impact: Could failure expose the bank to significant risk, materially affect customers, or significantly affect the bank’s financial condition or operations?
- Dependencies and concentration: Does the service rely on subcontractors, shared systems, or technology used across multiple providers? Would the bank have practical alternatives if service failed?
- Bank context: How do the bank’s size, complexity, risk profile, and the nature of this relationship affect the consequences and available oversight?
An activity’s criticality is context-specific: a service may be critical for one bank but not another. A “critical” label does not replace the underlying assessment. Use the assessment to set proportionate information requests, control reviews, monitoring frequency, escalation paths, and contingency planning.
What to examine before trusting a technology provider
Due diligence should examine the provider’s information-security program and how it aligns with the bank’s expectations for protecting confidentiality, integrity, and availability. The agencies’ guidance offers considerations to tailor to the service; it does not establish a universal checklist or make any single certification proof that a provider is safe.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Access and data: Identify which bank systems, information, customer data, or transactions the provider can reach. Ask how access is limited and protected.
- Safeguards: Understand relevant measures such as multifactor authentication, end-to-end encryption, and secure source-code management.
- Threat and vulnerability management: Ask how the provider identifies, assesses, and mitigates known and emerging threats and vulnerabilities.
- Technical practices and test evidence: Where relevant, examine data, infrastructure, application-security, and software-development practices, along with vulnerability and penetration-test results.
- Findings and remediation: Review deficiencies and corrective actions. Seek evidence that fixes are effective and sustainable, not merely promised.
- Continuity and recovery: Examine business-continuity and disaster-recovery plans, recovery time frames for activities and data, and the results of testing or actual disruption performance.
- Broader suitability: As relevant to the service, consider the provider’s financial condition, legal and regulatory compliance, experience, personnel, and overall risk management.
Evidence should help the bank judge whether controls fit the service and whether weaknesses are being addressed. A provider’s policy statements alone do not establish that controls work in operation; test results, findings, remediation records, and recovery exercises can give a more grounded view.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make contracts, monitoring, and exit plans operational
Set expectations in the contract
Contract terms should reflect the risk assessment and define workable service expectations. The bank should understand the provider’s relevant systems, processes, and interdependencies, and establish appropriate information rights so it can oversee performance and risk. The precise provisions depend on the arrangement; the guidance does not prescribe one contract form for every provider.
Monitor for change and signs of weakening controls
Monitoring can be periodic or continuous. Its frequency and depth should increase where relationship risk warrants it. The objective is to determine whether controls remain effective and sustainable, the provider continues to meet contractual commitments, and the original risk assessment still fits the relationship.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Escalation indicators include material or repeat audit findings, financial deterioration, security breaches, data loss, service interruptions, and compliance lapses. A bank should have a way to assess these signals, seek remediation where appropriate, and adjust oversight or contingency plans when risk changes.
Recommended Free Tools
Prepare for termination before it is urgent
Termination planning should consider how the bank would manage service continuity and transition if the relationship ends or the provider becomes unable to perform. The plan should be proportionate to the service’s importance and the bank’s dependencies; an exit option is only useful if the bank can execute it without losing control of essential operations or information.
Why supply-chain exposure belongs in cyber oversight
The OCC’s Cybersecurity and Financial System Resilience Report 2025 says supply-chain risk continues to evolve as threat actors exploit vulnerabilities in IT systems and third-party software used by many organizations. The OCC connects this threat context to assessing third-party risk and taking a comprehensive approach to operational resilience and supply-chain risk. This is a supervisory assessment of the threat environment, not a bank incident rate or a quantified estimate of loss.
For a bank, the implication is practical: oversight should account for dependencies beyond the direct provider, including shared technology and subcontractor exposure, as well as the bank’s ability to sustain or restore the service. Concentration and realistic alternatives matter alongside the provider’s individual security controls.
Turn the assessment into a proportionate oversight plan
- Inventory the relationship. Record the service, provider role, relevant access, data handled, dependencies, and business owners.
- Assess plausible harm. Consider customer impact, operational and financial consequences, exposure of sensitive information, and the effect of disruption.
- Set due-diligence depth. Request evidence relevant to the service, including control and test information, unresolved findings, remediation, and recovery capability.
- Translate risk into oversight. Define appropriate contract expectations, information rights, monitoring frequency, escalation routes, and contingency planning.
- Reassess as conditions change. Update the inventory and assessment when the service, access, dependencies, provider condition, or threat exposure changes, and plan for termination or inability to perform.
This approach follows the agencies’ risk-based framework without turning it into a universal score, mandatory certification threshold, or identical checklist for every supplier.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
