How Kyndryl is helping protect the financial services industry in the EU

1. Managing
risk

Kyndryl has developed a sophisticated supplier security assessment to help identify suppliers that pose higher risks. This assessment includes a robust due diligence process to analyze capabilities and identify any appropriate remediation before Kyndryl signs any contract with a supplier. A Subcontractor DORA Addendum helps ensure that appropriate DORA provisions are in place to assist Kyndryl’s services supporting the “critical or important functions” of financial entities.
 

2. Identifying critical
services

Kyndryl works closely with financial entity customers to identify which parts of its services support what DORA defines as “critical or important functions” of such customers. Typically, these efforts involve guiding customers in understanding the scope of services Kyndryl provides to determine which to prioritize for cybersecurity protection. An important outcome of these discussions is a shared understanding of the interdependency among IT services deemed “critical or important” to the customer’s business continuity. While under-characterizing “critical or important functions” or its acceptable impact tolerances poses obvious risks, over-characterizing these services as critical will dilute their importance.
 

3. Maintaining transparency and accountability

Customers look to Kyndryl to interact directly with subcontractors and suppliers. Anything other than a “one-stop shop” approach to financial entities dealing with secondary providers has the potential to become unwieldy and chaotic. Kyndryl remains contractually responsible for the subcontracted work that supports its services. We employ our decades of business and technical expertise — including serving more than 50% of the world’s largest banks by total assets, including six of the top 10 — to assess subcontractors in order to deliver the levels of service and security our customers require.