A practical starting point for your vendor review
Choosing an IT partner involves more than comparing a service list. Your bank needs to understand the proposed work, who is accountable and the information available to assess the relationship. Use this page to prepare your questions and request the material relevant to your institution.
TimbukTech at a glance
- Business: TimbukTech Inc., a local business technology provider.
- Offices: Canton, Macomb and Washington, Illinois.
- Published service areas: local IT service, network security and compliance solutions.
- Public resources: guidance on vulnerability scanning, compliance management, managed detection and response, technology planning and tabletop exercises.
- Next step: a conversation about your institution, its locations and the scope you want to evaluate.
Read the bank IT service overview · Contact details and office locations
Information to request for your proposed engagement
| Review area | Questions to bring |
|---|---|
| Scope and staffing | What is included? Who owns the relationship? How will the team work with our IT staff and other providers? |
| Security and access | What access is needed, how is it controlled, and what information will be handled? |
| Service and incidents | What support and escalation commitments apply? How are operational and security incidents coordinated? |
| Continuity | What continuity and recovery information can be provided for the services in scope? |
| Subcontractors | Which other providers are involved, and what responsibilities do they have? |
| Assurance and insurance | What current insurance information, independent reports, certifications or references are available and relevant? |
| Reporting and transition | What reporting will we receive, and how are onboarding, change and termination handled? |
Download the evaluation checklist
The team can discuss the information available for your request and how it should be shared. Availability of a particular report or certification should be confirmed directly; this overview does not represent an independent assurance report. Please agree on a secure exchange process before sending sensitive documents.
The interagency guide for community banks provides context for a bank’s third-party review. Your institution determines the due diligence appropriate to the relationship.