Shared Assessments Program

Shared Assessments was created by the Bank of America Corporation, The Bank of New York Mellon, Citi, JPMorgan Chase & Company, U.S. Bankcorp, and Wells Fargo & Company in collaboration with leading service providers and the Big 4 accounting firms to help financial services companies assess service providers. The goal of Shared Assessments is to streamline the process of selecting and maintaining a vendor by creating an industry-wide standard to which service providers must adhere. To that end, the BITS consortium created the Standardized Information Gathering questionnaire (SIG), which is used to assess how well service providers adhere to those procedures.

The Shared Assessments program is not a certification. The SIG simply allows vendors to do a self-assessment of their security controls and provide that to their financial-services clients. In conjunction with the SIG, the Shared Assessments program offers Agreed Upon Procedures (AUP), which are audit standards that an independent assessment firm can use when conducting an onsite audit of a managed service provider. The service provider can share the report with multiple financial services clients, alleviating the need for separate audits.

See also: IT controls, compliance audit

Learn more about Business partner and vendor security issues

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

FILE EXTENSION AND FILE FORMAT LIST File Extension and File Format List: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z #

RELATED CONTENT New vendor risk assessment tools address cloud computing Shared Assessments program unveils updated tools for assessing security of service providers, including cloud providers Don't forget the cleaning crew in your vendor management program Banks often overlook non-IT vendors in their vendor management program, putting their organization and customers' data at risk, experts say Vendor contract management: Regulatory guidance is risk-based Financial-services firms are subject to many requirements for managing vendor information security risks by contract. Learn how regulatory guidance is...