Answer:
The FFIEC issued a policy statement on November 28, 2000 titled "Risk Management of Outsourced Technology Services." This document, especially in Appendix A covers due diligence requirements. Get a copy of the policy statement here: http://www.fdic.gov/news/news/financial/2000/fil0081a.html
First published on BankersOnline.com 6/4/01