Custody/Wallet Security Due Diligence Points

Conducting a deep and efficient due diligence process is critical when evaluating custody and wallet providers (custodial or custodial).

A process that includes "kicking the tires" - assessing the security and overall posture of the counterparty, the solution at hand.

We've detailed key (not all) points below that should be addressed in the due diligence / third-party risk assessment.

These points address Web3 *and Web 2.0 topics, as the due diligence should be holistic and address the entire attack surface.

Relevant for all operation types - TradFi, Custody, CeFi, DeFi, Staking, etc.

DDQ (Due Diligence Questionnaire):

1. Provide documentation and an architecture diagram of your custody/platform.

   1. Including supported assets, chains, and protocols.

   2. Internal and external facing interfaces - web, mobile, API, etc. based.

2. Provide your organization’s written information security policy.

   1. Including all custody/digital asset topics and controls.

3. Does top management periodically review the information security program and policy?

4. Does your organization conduct ongoing risk assessments for its various functions?

5. Are employees and personnel (internal, external) subject to screening/background checks, and do they have terms and conditions of employment defining their information security (and custody protection related) responsibilities?

6. Provide your written business continuity plan and current setup/status.

   1. Including backup, BCP, and DRP for client assets, data, and ongoing operations - custody-related.

   2. How you conduct backups and how the client conducts backups as well.

7. Provide your incident response/crisis management playbook.

8. Does your organization have a vulnerability management program? Please provide relevant documents.

   1. Does your organization document and manage all security vulnerabilities in a central location/system?

9. Please provide documentation regarding your 3rd party/vendor risk management program.

10. Does your organization conduct internal and external penetration tests? Please provide the latest documents, especially for custody-related systems and components.

11. Does your organization have a system aggregating logs from endpoints, databases, servers, SaaS, and custody systems/components?

    1. What real-time alerts/updates do clients receive - security, technical, fraud, compliance, and transaction/asset movement related?

12. Are system logs and alerts monitored and analyzed on an ongoing basis? Is it a 24-7 function?

13. How do you ensure that “double spending”, and double/withdrawals don’t occur?

14. Please provide documentation regarding your Digital Assets Withdrawal Interface and API.

    1. Including performance, volume, and rate limiting.

15. Provide documentation regarding authentication, authorization, whitelisting, etc., for the movement of digital/custody assets, including monitoring, audit trail, and enforcement.

16. Provide information regarding custody private keys security, integrity, and monitoring.

17. Please provide your data protection/encryption and privacy policy.

18. Does your organization encrypt data at rest in databases and servers?

19. Does your organization enforce multi-factor authentication across all systems?

20. Is there a separation of development, testing, and production environments?

21. Is there a defined secure software/hardware development lifecycle (SSDLC) process? Internal and external (outsourced) development.

22. Information regarding the provider's insurance coverage - internally, for clients, and third parties.

23. Additional topics include key management and transaction signing methods - MPC, Multisig, and more.

Feel free to contact us - keep safe and secure!