Sarbanes-Oxley Act (SOX): Federal law that establishes requirements for financial reporting and corporate governance, including internal controls that may affect third-party relationships.
Federal Information Security Management Act (FISMA): Legislation that defines a comprehensive framework to protect government information, operations and assets against natural or human threats.
Gramm-Leach-Bliley Act (GLBA): Requires financial institutions to explain their information-sharing practices and protect sensitive data, including data shared with third parties.
Health Insurance Portability and Accountability Act (HIPAA): Establishes standards for protecting sensitive patient health information, including requirements for business associates and third-party vendors.
Foreign Corrupt Practices Act (FCPA): Anti-corruption law that prohibits the payment of bribes to foreign officials and requires proper accounting practices, affecting third-party due diligence.
Bank Secrecy Act (BSA): Requires financial institutions to assist government agencies in detecting and preventing money laundering, including monitoring third-party activities.
USA PATRIOT Act: Expands BSA requirements and establishes anti-money laundering programs, including due diligence requirements for third-party relationships.
Payment Card Industry Data Security Standard (PCI DSS): Security standard for organizations that handle credit card information, including requirements for managing third-party service providers.
NIST Cybersecurity Framework: Voluntary framework of computer security guidance for organizations to better manage and reduce cybersecurity risks, including third-party risk management.
FFIEC Guidance: Provides guidance for financial institutions on third-party risk management, including vendor due diligence and ongoing monitoring.
California Consumer Privacy Act (CCPA): State law that enhances privacy rights and consumer protection for California residents, affecting how organizations and their third parties handle personal data.
General Data Protection Regulation (GDPR): EU regulation that may apply when handling EU resident data, including specific requirements for third-party data processors.
OCC/FRB/FDIC Guidance: Regulatory guidance from federal banking regulators on managing third-party relationships and associated risks.
Uniform Commercial Code (UCC): Standardized set of laws governing commercial transactions, including contracts with third parties.
NY DFS Cybersecurity Regulation: New York's regulation requiring financial institutions to implement comprehensive cybersecurity programs, including third-party risk management.
SEC Cybersecurity Requirements: Securities and Exchange Commission requirements for cybersecurity risk disclosure and management, including third-party risks.
