Title of Report [omit “Audit of”]

November 2007 Report No. AUD-08-002 Examination Procedures for Assessing Selected Controls Related to the Protection of Customer and Consumer Information at Multi-regional Data Processing Servicers (MDPS) AUDIT REPORT Report No. AUD-08-002 November 2007 Examination Procedures for Assessing Selected Controls Related to the Protection of Customer and Consumer Information at Multi-regional Data Processing Servicers (MDPS) Results of Audit Background and Purpose of Audit The FDIC has taken a number of proactive steps in its oversight of TSPs in the MDPS program. During our audit, the FDIC hosted the 2007 FFIEC MDPS FDIC-insured financial institutions are Supervisory Strategy Meeting, enhanced its monitoring of TSPs in the MDPS increasingly outsourcing their critical program, and conducted a number of outreach initiatives. Importantly, FDIC information technology services to examiners use FFIEC and FDIC examination guidance when assessing security Technology Service Providers (TSP). Frequently, these outsourcing controls related to the protection of customer and consumer information at TSPs arrangements involve the collection, in the MDPS program. Additionally, as part of each examination, the examiners processing, and storage of customer and considered the risk assessment of security controls prepared by the TSP in consumer information on behalf of response to the interagency guidelines. However, the risk assessments for ...