Outsourcing a service would not, by itself, put that service beyond the cyber-risk approach described by banking regulators in October 2016. Their October 19 joint release said potential enhanced standards would apply to services third parties provide to covered firms. For technology suppliers, the important mechanism was the service relationship, not merely the bank's internal organization chart. [fed-cyber-release]

The advance notice published October 26 placed external dependency management alongside internal dependency management, governance, cyber-risk management, and incident response and resilience. Those headings give buyers and suppliers a concrete way to discuss where operational reliance sits. They do not establish new contract clauses, certify a vendor, or prove that bringing a service in-house would be safer or cheaper. [2016-25871]

The agencies also contemplated an additional, higher tier for sector-critical systems providing key financial-sector functionality. Our market reading is that a supplier evaluating the consultation would need to understand the function its service supports, rather than assume every contract faces identical treatment. Whether such differentiation would favor large vendors or make entry harder remained an open question, not a demonstrated competitive effect. [fed-cyber-release]

This remained a consultation by the Federal Reserve, FDIC and Office of the Comptroller of the Currency, not an adopted supplier mandate. The October announcement said the advance notice would precede a more detailed proposal; comments were due January 17, 2017. The notice and release supply complementary detail from the same policy chain. Neither measures switching costs, vendor concentration or the commercial outcome of the contemplated standards. [2016-25871][fed-cyber-release]

Source documents

  1. Enhanced Cyber Risk Management Standardshttps://www.govinfo.gov/content/pkg/FR-2016-10-26/html/2016-25871.htm
  2. Agencies issue advance notice of proposed rulemaking on enhanced cyber risk management standardshttps://www.federalreserve.gov/newsevents/pressreleases/bcreg20161019a.htm