From a GLBA standpoint, are banks ensuring that everytime they use a new appraiser or lawyer that they have a written contract with confidentiality provisions? For an appraiser, they only receive name and address- isn't this public information so no contract is required or does it become confidential because this is "customer" of our bank? Would appreciate clarity on this.

We perform a risk assessment on all service providers and generally require a confidentiality agreement. In the case of just name and address, that really does not constitute Non-Public Information, but you may still want to prevent them from using the data for any other purpose than the appraisal. With attorney's we generally stop with the confidentiality agreement and do not do other levels of review such as a SAS 70 or on-site visit because they carved out in the GLBA guidance as an entity that is held to a higher professional standard and thus does not have the same level of due dilligence.

Opinions expressed are my own and not those of my employer.