The New York State Department of Financial Services (NYDFS) recently released guidance that could reshape how financial institutions manage vendor and supply-chain risk. The letter states that third-party service provider (TPSP) risk management should be a central component of every entity’s cybersecurity programme. This sends a very important message—the old ways that banking and financial institutions treat third-party oversight as a compliance exercise are over. That’s because today’s financial instit ...