IT Examiner School eBook May 2025

Internal Use Only

Evaluating Third-Party (Vendor) Risk Management

Internal Use Only

FFIEC Component Rating Areas of Coverage

The ability to monitor and assess service provider controls;

The adequacy of customer service provided to clients by service providers;

The ability of the service provider to maintain service levels that meet the requirements of the client.