The critical/non-critical distinction is not baked into all of this guidance as it is in other areas. What we really fall back on is what is the nature of the services being provided by the vendor and what background checks would be required if this was your employee performing this function in house. The person who delivers your printer paper, if they’re not being let into a part of the building where there is access to sensitive consumer information, they are not going to be subject to the same levels of scrutiny as if you are outsourcing payment processing or loan origination functions, where there is a real possibility of misuse of confidential information. There is no clear line. Try to follow this rule: If this is your employee would they need a criminal background check?
Note: This transcript has been edited from the January 2015 vendor management webinar for clarity and completeness.
Answered By: Ben Olson