Office of the Comptroller of the Currency
OCC 2013-29
Third-party lifecycle risk management from planning and diligence through termination.
50%
requirements ready
Requirements
5
Ready
0
Mapped controls
1
Mapped policies
1
Coverage
Each requirement uses the controls and policies already on record.
Requirement map
Requirements, controls and policies
TPR-01
Planning and risk assessment
Assess need, criticality and risk before engaging a third party.
TPR-02
Due diligence and selection
Evaluate financial, operational, security and compliance capability.
TPR-03
Contract controls
Define audit rights, performance, data, incident and termination obligations.
TPR-04
Ongoing monitoring
Monitor performance, control changes, incidents and concentration risk.
TPR-05
Termination and transition
Maintain exit, data return and continuity plans for service termination.