# Sources

Primary regulatory and standards sources underpin the control considerations. Product documents support only the specific examples attributed to them. URLs are provided below for source checking.

1. **Federal Reserve, FDIC and OCC — final third-party risk-management guidance announcement, 6 June 2023.** `https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm`
2. **Federal Reserve — SR 23-4 and Interagency Guidance on Third-Party Relationships: Risk Management.** `https://www.federalreserve.gov/supervisionreg/srletters/SR2304.pdf`
3. **Federal banking agencies — Third-Party Risk Management: A Guide for Community Banks, May 2024.** `https://www.federalreserve.gov/publications/files/third-party-risk-management-guide-20240503.pdf`
4. **NIST — SP 1305, Cybersecurity Framework 2.0: Quick-Start Guide for Cybersecurity Supply Chain Risk Management, October 2024.** `https://csrc.nist.gov/pubs/sp/1305/final`
5. **HHS — Guidance on HIPAA & Cloud Computing.** `https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html`
6. **NYDFS — Guidance on Managing Risks Related to Third-Party Service Providers, 21 October 2025.** `https://www.dfs.ny.gov/industry-guidance/industry-letters/il20251021-guidance-managing-risks-third-party`
7. **The IIA — Global Internal Audit Standards, issued 9 January 2024; Standard 7.1.** `https://www.theiia.org/globalassets/site/standards/globalinternalauditstandards_2024january9.pdf`
8. **IBM — OpenPages 9.1.x FastMap overview.** Search-accessible documentation; direct page retrieval was restricted during research. `https://www.ibm.com/docs/en/openpages/9.1.x?topic=fastmap-overview`
9. **ServiceNow — Integrated Risk Management entitlements, effective 9 May 2024.** `https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD14209.pdf`
10. **LogicGate — Risk Cloud API: Getting Started.** `https://www.logicgate.ai/developer/risk-cloud-api-getting-started/`
11. **First Horizon — Senior GRC Administrator employer posting, dated 9 April 2026.** Search-indexed employer content; full-page text was browser-limited. `https://recruiting.ultipro.com/FIR1007FTN/JobBoard/c005ef3e-175a-49c4-ba29-9f431f673944/OpportunityDetail?opportunityId=3d3259bf-0bb5-474b-8eb4-639fe8f63a6b`
12. **Verdantix — Riding The Wave Of Capability And Strategy Changes In The GRC Industry, 22 May 2026.** `https://www.verdantix.com/insights/blog/riding-the-wave-of-capability-and-strategy-changes-in-the-grc-industry`
13. **NIST — AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile.** `https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf`