Earlier this month, Benjamin Lawsky, Superintendent of Financial Services for the New York State Department of Financial Services (NYDFS), released a report finding “significant potential” vulnerabilities for cyber theft of banking system information systems due to the banks’ use of less secure third-party vendors. NYDFS conducted a survey of 40 banking organizations – including many of the largest institutions it regulates – about the cyber security standards those firms have in place for third-party vendors that provide a broad-range of services to the banking system, such as check/payment processing, trading and settlement operations, and data processing. These third-party firms often have access to a financial institution’s information systems, providing a potential point of entry for hackers. Yet the report found that fewer than one-third of the banking institutions surveyed required their vendors to report cyber security breaches and fewer than half performed any on-site assessments to confirm that third-party vendors met the minimum requirements of information security.

These findings will likely result in new NYDFS regulations to strengthen cyber security standards for financial institutions’ third-party vendors. In the NYDFS press release, Superintendent Lawsky said: “A bank’s cyber security is often only as good as the cyber security of its vendors. Unfortunately, those third-party firms can provide a backdoor entrance to hackers who are seeking to steal sensitive bank customer data. We will move forward quickly, together with the banks we regulate, to address this urgent matter.”

In addition to the lack of breach notification or on-site assessments, key findings in the NYDFS report included the following:

• Approximately one in five banks surveyed do not require third-party vendors to represent that they have established minimum information security requirements. Additionally, only one-third of the banks require those information security requirements to be extended to subcontractors of the third-party vendors.
• Nearly half of the banks do not require a warranty of the integrity of the third-party vendor’s data or products (e.g., that the data and products are free of viruses).

NYDFS is in the process of conducting a similar cyber security survey of the insurers it regulates and also expects to impose higher cyber security standards for third-party vendors providing services to insurance companies.