Checklist: Top security questions to ask when choosing a lockbox provider

Secure payments continue to be top of mind for many companies as risks of fraud and data breaches are on the rise. According to a recent Strategic Treasurer survey, nearly one-third of corporations noted an elevated uptick in significant threats in 2022.¹

How can your corporation properly assess potential lockbox vendors to make sure you're gtting all the support you need from a product and security standpoint? Get started with the below checklist of questions. 

Checklist: Top security questions to ask

A company looking to add a lockbox vendor would likely evalutae a vendor through either a Request for Information (RFI) which is typically a request for high-level capabailites to determin if the vendor is a good fit for the company and can meet their objectives or a Request for Proposal (RFP) which is a detailed request for information about the company and its capabilities (inclusive of pricing). 

We've highlighted some of the top security considerations that a company may consider when choosing a lockbox provider:

• Are you subject to FFIEC audit?
• Do you have a robust third-party risk management process?
• Do you perform SSAE 18 SOC II Type 2 Audit annually?
• Are you PCI Certified/Compliant?
• Are you HIPAA compliant?
• Do your employees receive HIPAA Training? If so, how often?
• Do you provide third-party attestation?
• Do you perform Vulnerability – Penetration Security Assessments on your web applications?
• Do you utilize offshore data entry or other resources ?
• Can you share your Software Development Life Cycle Practices?
• Do you have employee/associate Confidentiality Agreements?
• What is your Business Continuity Plan (BCP), and can we see a copy?
• Please provide your Disaster Recovery Testing Results. Do you perform Annual Testing?
• Provide an overview of your Hiring – Transfer – Exit Procedures for employees.
• Do you have an employee security training program?
• Do you perform employee background checks? If so, how often?
• Are your processing locations equipped with cameras and/or video technology? What type of cameras/video technology are used?

Source: 1. Strategic Treasurer, "2022 Fraud & Security Survey General Report."