Regulatory readiness
Engineered for Regulatory Readiness and Dependable Compliance
RemitSo's answers to the technology questions regulators and banks ask MSBs, from security and data protection to DR/BCP testing and operational resilience.
Due-diligence questionnaire
The questions banks and regulators ask
6 areas, 43 questions, each with RemitSo's answer.
-
Does the system come with a comprehensive, enterprise-wide, disaster recovery / business continuity program (DR/BCP)? Yes
If yes, does the DR/BCP contain:
- a.Defined roles & responsibilities?Yes
- b.Written recovery procedures?Yes
- c.Business impact analysis?Yes
- d.Offsite storage provisions?Yes
- e.Testing requirements, including documentation of lessons learned from DR/BCP tests?Yes
-
Does the system support incident response plans? Yes
If yes, does the plan provide for:
- a.Assessing the nature & scope of the incident, including documenting any systems containing customer information that may have been compromised?Yes
- b.Containing & controlling the incident to prevent further compromise?Yes
- c.Contacting appropriate law enforcement and regulatory representatives?Yes
- d.Preserving records and other evidence?Yes
- e.Customer notification?Yes
- f.Periodic employee awareness training?Yes
-
Does the system implement an internal audit program? Yes
If yes, does the scope of the internal audit program include
- a.Network security?Yes
- b.General IT-related controls?Yes
- c.Penetration testing?Yes
- d.Application development policies & procedures?Yes
- e.Disaster recovery / business continuity planning?Yes
- f.Information security program?Yes
- g.Compliance with applicable safeguarding customer information regulations?Yes
-
Does the system have provision to implement an information security program (ISP) to protect non-public information? Yes
If yes, does the ISP include:
- a.Written policies & procedures?Yes
- b.Employee training?Yes
- c.Monitoring?Yes
- d.Security at both the applicant and, if applicable, significant service providers?Yes
- e.Logical & physical security considerations?Yes
- f.Provisions for testing the effectiveness of keyYes
- g.controls through some type of audit, test, review, etc.?Yes
- h.Provisions for adjusting the program?Yes
-
Does system implements an ISP with respect to its application server infrastructure and controls ? Yes
If yes, does the ISP include:
- a.Security check of any internal application servers which contain customer information or critical data is stored, processed, or transmitted?Yes
- b.Does the security check test for internal application servers’ vulnerabilities?Yes
- c.Does the security check test for internal application servers validating appropriate access controls?Yes
- d.Does the security check test for internal application servers provide for penetration testing?Yes
-
Does system have provision to implement an ISP with respect to its customers website and associated web application security? Yes
If yes, does the ISP include:
- a.Written policies & procedures?Yes
- b.Monitoring?Yes
- c.Provisions for adjusting the program?Yes
- d.Security evaluation of the public facing website and web applications on which customer information is kept, processed, or transmitted?Yes
- e.Is security tested for vulnerabilities?Yes
- f.Is security tested for access controls?Yes
- g.Does security testing include penetration testing?Yes
More Questions
Book a demoBuilt by people who have helped MSBs for years.
The risk checks on every online transfer come from what they see every day.
- The person paying isn't the customer
- One bank account, several customers
- A disposable email address
- Sign-in from a high-risk location
- The same person signing up twice
- A name close to a sanctions list