Risk management issues in financial institutions

Financial institutions should ensure that they, the regulatory authorities, and the central bank, or their designated persons, can obtain relevant information on the operations performed by cloud service providers, including customer information and related system audit reports, as well as the right to conduct on-site inspections.

HRDA system servers and data are stored separately on GCP (Google Cloud Platform) and hicloud. The GCP region selected is asia-east-1 (Taiwan). Both GCP and hicloud comply with international security standards and have obtained the following relevant international certifications:

When a financial institution terminates or concludes an outsourcing arrangement, it must ensure a smooth transition to another cloud service provider or return the operations to in-house management. Additionally, it must ensure that the original outsourced cloud service provider deletes or destroys all retained data and keeps records of the deletion or destruction. (Please confirm with the vendor whether they agree to the data deletion mechanism after the termination of outsourced services.)

The HRDA platform provides an API to retrieve all data, and the system also offers a deletion feature that can erase all applicant-related data.

The financial institution should retain complete ownership of outsourced data. It must ensure that the cloud service provider, besides performing the entrusted tasks, does not have access to customer data and cannot use it beyond the scope of the outsourcing agreement.

The stored data does not include complete personal information. Access control is divided into three levels of varying strength, and clients configure the permissions themselves.

When financial institutions transmit and store customer data with cloud service providers, they should implement effective protection measures such as data encryption or tokenization. Additionally, they should establish a key management mechanism for encryption keys.

The HRDA system uses SSL for data transmission, and other security controls are primarily based on account passwords. Since the stored data does not include personal information, no additional auditing functionality is implemented.

Financial institutions have the ultimate supervisory responsibility over cloud service providers and must possess the professional expertise and resources to oversee the execution of entrusted operations by the cloud service provider. If necessary, they should consider engaging a professional third party to assist in the supervisory tasks.

Agree to global or third-party audits. The HRDA system’s data is stored on Google Cloud and hicloud data centers. The GCP data centers themselves comply with relevant standards and requirements.

Financial institutions should ensure operational risk management, assess the risks associated with the entrusted organization, and implement appropriate risk control measures.

Outsourcing risk assessment: The stored data does not include personal information, and the HRDA system currently implements access control for operations and manages information disclosure controls.

Financial institutions must either independently engage or jointly with other financial institutions using the same cloud service provider, commission an independent third party with information expertise to conduct an audit.

HRDA agrees to global or third-party audits for outsourcing verification.

The Blog

The financial institution should retain complete ownership of outsourced data. It must ensure that the cloud service provider, besides performing the entrusted tasks, does not have access to customer data and cannot use it beyond the scope of the outsourcing agreement.

When financial institutions transmit and store customer data with cloud service providers, they should implement effective protection measures such as data encryption or tokenization. Additionally, they should establish a key management mechanism for encryption keys.

Financial institutions should ensure operational risk management, assess the risks associated with the entrusted organization, and implement appropriate risk control measures.

Financial institutions must either independently engage or jointly with other financial institutions using the same cloud service provider, commission an independent third party with information expertise to conduct an audit.