My IT department remembers reading something from the FDIC in regards to Shareware and Freeware programs. They can't find it now and have asked for my help. This is not my area, but do any of you know about such guidance? I appreciate your help. Thanks

See the section in the FFIEC IT Information Security exam booklet called Software Development and Acquisition. It runs from page 63 to 66, and talks about the care one should take in knowing the developer of the software. That would eliminate the use of freeware and shareware whose authors aren't known and where the code cannot be examined.

Link to the booklets: http://www.ffiec.gov/ffiecinfobase/html_pages/It_01.html

Thank you - that is exactly what they were looking for.

The FDIC released an FIL in 2004 titled “Risk Management of Free and Open Source Software” (FIL-114-2004). You can access it here.

Hope this helps some.

Thanks,
Russ