Financial

Financial Institutions Third-Party Risk Management Consulting Services | TruSight

Risk Management For Financial Institutions

Centris offers third-party risk management consulting services for assisting both financial institutions themselves (FIs) themselves and FI suppliers, partners, and other third-parties. Many of the top financial institutions in North America (i.e., American Express, Bank of America, JP Morgan Chase & Co., BNY Mellon, Wells Fargo, etc.) have implemented comprehensive and far-reaching third-party risk management reporting requirements for all of their suppliers, partners, and other related third-parties.

For FIs that have not fully adopted and implemented a structured, third-party risk management process, Centris can help. Additionally, for suppliers, partners, and other third-parties needing assistance in meeting today’s strict third-party vendor management practices, Centris can also assist.

“Design & Deploy” – Industry Leading Third-Party Risk Management Process

Core concepts included within Centris’ Design & Deploy methodology for third-party risk management for FIs include the following phases:

Framework Considerations
Scoping Considerations
Identification & Classification
Risk Assignment
Due-Diligence & On-Boarding
Continuous Monitoring
Follow-Up/Reporting and Corrective-Action
Off-Boarding
Training

Financial Institutions and TruSight – What You Need to Know

To assist in streamlining all critical third-party risk management efforts with the large and growing number of entities in their supply chain, an increasing number of financial institutions are using TruSight, a third-party assessment service created by a number of leading banks for the collective benefit of all financial institutions, their suppliers, partners and other third parties.

TruSight offers a Verified Best Practices Questionnaire (VBPQ), a Standard Assessment, and a Comprehensive Assessment for validating a third-party’s controls. The process has resulted in significant streamlining in terms of third-party risk management for both FIs and their respective suppliers, partners and other third parties.

Yet many of the challenges for these very suppliers, partners and other third parties is not having adequate information security, cybersecurity, data privacy, and operational specific policies and procedures in place. Documentation is a big part of complying with TruSight, and Centris can assist in helping suppliers, partners and other third parties develop all required policies and procedures.

With Centris our Design & Deploy TPRM solutions help organizations build comprehensive third party risk management programs for the financial, life sciences, healthcare, energy, critical infrastructure, manufacturing, retail, technology, and legal sectors.

TPRM Security, Privacy & Compliance Experts for the Financial Services Industry

At the core of any organization’s information security posture are comprehensive and well-written security policies and procedures. From access control to wireless security, there are dozens of InfoSec domains that require policies and procedures to be written, and Centris can assist. All of our information security policies and procedures are developed using industry leading standards and frameworks, ranging from NIST RMF to ISO 27000, and others. As a supplier, partner or other related third-party offering services to FIs, information security policies and procedures are a big – and necessary – component for third-party risk management compliance.

CENTRIS

Leaders in Security & Regulatory Compliance

Risk Strategies & Methodologies

Risk management planning reduces exposure to a wide-range of issues that could have detrimental effects on a business. Not knowing, planning, or responding to risks and related issues can leave an organization with few options in combating risks when they actually surface.

CENTRIS Advisory Methods

Strategic Planning & Integration

Every organization is moving towards a digitized business model, so isn’t it time to strategize on some of the most critically important elements for your business?

Explore CENTRIS Strategies

Regulatory Compliance Experts

Build scalable, adaptable, and efficient compliance solutions for increased organizational efficiency, while also improving core InfoSec, cybersecurity, operational and data privacy controls and best practices.

Regulatory Compliance For All Industries

How Centris Can Help with FI Third-Party Risk Management

The concept of third-party risk management has firmly taken root in every conceivable industry in North America, and that includes the broader financial services sector. Depending on your needs – an FI that needs to build a third-party risk management program, or a supplier that needs to comply with such requirements – Centris’ “Design & Deploy” TPRM services will get you up to speed in no time.

We have years of experience building comprehensive, transparent, and highly scalable third-party vendor management programs for FIs all throughout the globe. Additionally, we can help suppliers, partners, vendors – essentially, any entity – in complying with FI third-party vendor reporting mandates.

InfoSec & Cybersecurity Experts

Any type of meaningful FI third-party risk management program would not be complete without a discussion – and strict requirements – on the broader topic of information security and cybersecurity. Specifically, suppliers, partners and other third parties providing essential services to financial institutions should have in place a comprehensive cybersecurity program.

At Centris, we have years of experience developing highly customized cybersecurity programs using the NIST Cybersecurity Framework as the definitive guide. When developed correctly, organizations will quickly see the many benefits of a well-developed, actionable, and easy-to-implement cybersecurity program.

Data Privacy Experts

All financial institutions – and their suppliers, partners, and other third-parties – have strict compliance requirements for documenting how consumer data is collected, used, shared & disclosed, stored, protected, retained, and disposed of. At Centris, we help organizations build robust data privacy programs relating to strict third-party vendor management reporting mandates, while also helping to ensure the safety and security of consumer data.

Documentation Writing Professionals

Many times, organizations need robust documentation that goes well above and beyond standard information security policy development. At Centris, we call these “programs” – in-depth manuals that detail a specific plan or solution. Topics that come to mind are Business Continuity & Disaster Recovery Planning/Contingency Planning, Incident Response Programs, Insider Threat Programs, Supply Chain Plans, and much more. Centris has the knowledge and expertise for developing any type of program documentation needed for meeting third-party risk management – and regulatory compliance – reporting mandates.

Helping Plan for the Unthinkable

At Centris, we’ve perfected the art of tabletop exercises when it comes to efficient, comprehensive, real-world simulated testing for both Incident Response and Business Continuity & Disaster Recovery Planning/Contingency Planning.

Seamless Integration with Third-Party Risk Management Tools

Many of today’s leading financial institutions often integrate their third-party risk management activities with any number of commercially available software tools for helping better manage their overall TPRM initiatives. At Centris, we’ve worked with a large number of industry leading third-party risk & vendor management software tools, often working side-by-side with our clients in setting up, configuring, and even helping maintain and monitor such tools.

How Centris Can Help with FI Third-Party Risk Management

We can design & deploy a rock-solid TPRM program for your organization.
We’re experts at developing all required TPRM documentation (i.e., policies, etc.).
We can integrate our services with any number of TPRM software solutions.
We can help monitor your security controls.

"59% of organizations have experienced a data breach due to third-party risk management, and yet management of these risks remains siloed and ineffective."
- Gartner