Financial services
Security for banks, credit unions, lenders, and advisors.
Multi-framework regulatory compliance for banks, credit unions, mortgage and lending companies, RIAs, and fintech: NY-DFS Part 500, GLBA, FFIEC guidance, PCI-DSS, and SOC 2, with encryption and key management expertise built serving Mastercard and other financial leaders.
At a glance
- Clients include
- Mastercard, UNFCU, October Three
- Frameworks
- NY-DFS 500, GLBA, FFIEC, PCI-DSS, SOC 2
- Specialty
- Encryption, HSM, tokenization
- Testing
- Required under NY-DFS 500.05
Regulatory context
Overlapping requirements, one documented program.
Financial institutions answer to more than one regulator and more than one framework at once. Examiners expect a risk assessment, a documented program, tested controls, and evidence. Boards expect the same in plain language.
Sidechain’s specialty is payment and financial data protection: encryption, key management, hardware security modules, and tokenization at Fortune 500 scale. We bring that depth to community banks, credit unions, mortgage lenders, and advisors that need the same controls without the headcount.
- Risk assessments and programs mapped to NY-DFS Part 500 and FFIEC guidance
- Penetration testing that satisfies 500.05 and examiner requests
- Encryption, key management, and tokenization for cardholder and account data
- Evidence packages for examinations and SOC 2 audits
- NY-DFS Part 500
- Cybersecurity program, risk assessment, penetration testing, MFA, and annual certification.
- GLBA Safeguards Rule
- Written information security program and risk assessment.
- FFIEC
- Examination guidance and the Cybersecurity Assessment Tool.
- PCI-DSS
- For card issuing, acquiring, and payment processing.
- SOC 2
- Customer and partner due diligence.
Services
What we do for financial services organizations.
Managed security
A documented program with 24/7 monitoring, endpoint and email protection, and monthly reporting examiners can read.
Learn moreEncryption & key management
Enterprise and cloud key management, HSMs, and tokenization for account and payment data.
Learn morePenetration testing
External, internal, application, and API testing with reporting mapped to regulatory requirements.
Learn moreAssessments & compliance
Cyber risk evaluations and gap assessments against NY-DFS Part 500, GLBA, and FFIEC guidance.
Learn morePrivate cloud & hosting
Secure hosting for key managers, PKI, and logging systems that should not share a tenant.
Learn moreBackup & recovery
Tested recovery for core systems, with retention aligned to regulatory requirements.
Learn moreOf the countless things on my team’s plate, managing encryption infrastructure isn’t a priority. I’m happy to let Sidechain handle all of that so my engineers can focus on what moves our business forward.
Sidechain’s team are great communicators, they know their products, and they’re knowledgeable. They’re also just nice people, the kind of people you want to work with.
We needed a pen test to satisfy our cyber insurance renewal. Sidechain scoped it, executed it, and delivered the report in under three weeks. Our carrier accepted it without question.
FAQ
Questions we hear from financial services leaders.
Can you help with our NY-DFS annual certification?
We support the program, risk assessment, testing, and evidence that underpin the certification. The certification itself is signed by your senior officer.
Do you work with core banking and payment vendors?
Yes. Our encryption and key management engineers have integrated with payment platforms, core systems, and HSM-dependent applications for years.
Talk with an engineer who knows your industry.
Tell us about your environment, your obligations, and your deadline. We respond within one business day.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon