Sources

Primary regulatory and standards sources underpin the control considerations. Product documents support only the specific examples attributed to them. URLs are provided below for source checking.

1. Federal Reserve, FDIC and OCC — final third-party risk-management guidance announcement, 6 June 2023. https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm
2. Federal Reserve — SR 23-4 and Interagency Guidance on Third-Party Relationships: Risk Management. https://www.federalreserve.gov/supervisionreg/srletters/SR2304.pdf
3. Federal banking agencies — Third-Party Risk Management: A Guide for Community Banks, May 2024. https://www.federalreserve.gov/publications/files/third-party-risk-management-guide-20240503.pdf
4. NIST — SP 1305, Cybersecurity Framework 2.0: Quick-Start Guide for Cybersecurity Supply Chain Risk Management, October 2024. https://csrc.nist.gov/pubs/sp/1305/final
5. HHS — Guidance on HIPAA & Cloud Computing. https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
6. NYDFS — Guidance on Managing Risks Related to Third-Party Service Providers, 21 October 2025. https://www.dfs.ny.gov/industry-guidance/industry-letters/il20251021-guidance-managing-risks-third-party
7. The IIA — Global Internal Audit Standards, issued 9 January 2024; Standard 7.1. https://www.theiia.org/globalassets/site/standards/globalinternalauditstandards_2024january9.pdf
8. IBM — OpenPages 9.1.x FastMap overview. Search-accessible documentation; direct page retrieval was restricted during research. https://www.ibm.com/docs/en/openpages/9.1.x?topic=fastmap-overview
9. ServiceNow — Integrated Risk Management entitlements, effective 9 May 2024. https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/other-document/entitlements/PROD14209.pdf
10. LogicGate — Risk Cloud API: Getting Started. https://www.logicgate.ai/developer/risk-cloud-api-getting-started/
11. First Horizon — Senior GRC Administrator employer posting, dated 9 April 2026. Search-indexed employer content; full-page text was browser-limited. https://recruiting.ultipro.com/FIR1007FTN/JobBoard/c005ef3e-175a-49c4-ba29-9f431f673944/OpportunityDetail?opportunityId=3d3259bf-0bb5-474b-8eb4-639fe8f63a6b
12. Verdantix — Riding The Wave Of Capability And Strategy Changes In The GRC Industry, 22 May 2026. https://www.verdantix.com/insights/blog/riding-the-wave-of-capability-and-strategy-changes-in-the-grc-industry
13. NIST — AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf