According to research by IDG, UK enterprises tend to leverage more third-party applications that US companies. Yet the FS-ISAC Third-Party Software Security Working Group, does not contain European members, and none contributed to the “Appropriate Software Security Control Types for Third-Party Service and Product Providers” whitepaper. This presentation will outline why it is time for European financial institutions to formally acknowledge the risk associated with third-party software and create guidance which the industry can follow. It will also provide insight into how the controls were developed in the US and offer tips for successfully creating similar guidelines.