10 Security Questions to Ask a Web Agency Before Building a Bank or Financial Website
10 Security Questions to Ask the Agency Building Your Bank's Website
The first thing to ask the agency that will build a website for your bank or financial institution is how access, data, code, and continuity are secured. The 10 questions below cover certifications, secure development, access management, personal data, third-party components, security testing, incident management, continuity, and the contract.
A finance website is a trust product. But it's also software that connects to forms, campaign data, and internal systems. That makes the agency part of your institution's supply chain, and it should be evaluated accordingly.
The table below summarizes the 10 questions, what a good answer looks like, and the document you can ask the agency for. For general agency selection criteria, see our article How to Choose a Web Design Agency.
10 security questions to ask the agency
# | Question | What a good answer looks like | Document you can ask for |
|---|---|---|---|
1 | Which security certifications do you hold, and what is their scope? | The certification covers the processes of the team that will run the project | Certificate and scope description |
2 | How do you run your secure development process? | Code review, security checks, and testing steps are defined | Process summary |
3 | Who can access the source code and environments? | Principle of least privilege, multi-factor authentication, access logs | Access authorization list |
4 | How do you handle personal data and institutional data? | Data minimization, a KVKK-compliant contract, clear data location | Draft data processing agreement |
5 | How do you manage third-party components? | A component inventory exists, security updates are tracked | Component inventory |
6 | Is security testing done, and who does it? | Testing before launch and at regular intervals, findings are closed | Test summary (without sensitive detail) |
7 | What do you do in a security incident, and how quickly do you notify us? | A defined process, with the notification time written into the contract | Incident response process, [SLA] |
8 | How are backup and continuity ensured? | Backup, restore testing, and a continuity plan exist | Continuity plan summary |
9 | Are you ready for our institution's supplier audit processes? | There's a process for responding to audit and document requests | Previous audit experience (general) |
10 | What happens to code, access, and documentation when the contract ends? | Handover and access-closure steps are written down | Handover and exit clauses |
Why should you make security a separate criterion for a bank website?
A good design and a good user experience are not enough for a finance website; the institution must also be able to trust the agency's processes and access. The agency gets access to source code, test environments, form data, and sometimes internal systems. If this access isn't managed, risk can extend from the agency's office to the institution's network.
That's why security questions should be asked at the proposal stage, and the answers reflected in the contract.
What should you ask about the organization and its processes?
The first three questions (1, 2, and 6) show whether the agency manages security as a process.
Certifications are a starting point, but their scope matters: ISO 27001 covers the information security management system, and ISO 12207 covers software life cycle processes. Ask whether the certification covers the team and environments that will run the project. For questions on secure development and security testing, look at how concrete the answer is: instead of "we care about security," ask for steps, owners, and outputs.
What should you ask about access and data?
Questions 3, 4, and 5 show how the agency touches the assets that belong to you.
For access, expect the principle of least privilege, multi-factor authentication, and access logs. If personal data is involved, the roles under KVKK (Türkiye's data protection law), namely data controller and data processor, need to be clearly written into the contract; for legal details, get your legal counsel's opinion. On third-party components, ask about inventory and update tracking: on corporate sites, risk sometimes comes less from the code itself than from a component nobody is monitoring. Before deciding on a CMS, our article What Is Umbraco? can be a starting point.
What should you ask about continuity, incident management, and the contract?
Questions 7, 8, 9, and 10 deal with what happens when things go wrong and with the end of the relationship.
In an incident, who will notify whom and when should be written down in advance; the timeframes are defined in the contract as [SLA]. On backup, ask not only whether backups are taken but whether restoring from them is tested. At the end of the contract, handing over source code, documentation, and access, and closing accounts, are also security matters.
How does BDDK regulation affect agency selection?
The BDDK (Banking Regulation and Supervision Agency) Regulation on Information Systems of Banks and Electronic Banking Services (Official Gazette No. 31069, dated 15.03.2020) defines as "outsourced services" (dış hizmet) the services banks procure externally in relation to their information systems that involve access to banking data. If the agency has access to banking data, or such data is shared with the agency, this definition may come into play.
Whether a website project falls within this scope is determined by your institution's compliance and legal team. On the agency side, ask whether it is ready for audit and document requests of this kind (question 9).
Source: Regulation text published in the Official Gazette (alomaliye.com).
How is trust built on finance websites?
Trust doesn't come from security infrastructure alone. On a finance website, visitor trust comes from consistent and accurate corporate information, fast and accessible pages, clear and understandable forms, and transparent communication. Security processes are the foundation that holds up this visible experience. Choosing an agency that thinks about both together is generally less risky than splitting them into separate projects.
Frequently Asked Questions
Is ISO 27001 mandatory for an agency building a bank website?
Whether it's mandatory is decided by your institution's supplier policy. ISO 27001 shows that the agency has set up an information security management system; however, you need to look at the certification's scope and whether it includes the team that will run the project.
What increases trust on a finance website?
Trust comes from the combination of secure infrastructure, clear and consistent corporate information, fast and accessible pages, and transparent communication. Security processes and accurate information are as important as design.
Is a website agency considered a bank's outsourced service provider?
If the agency has access to banking data or such data is shared, the definition of outsourced services in the BDDK information systems regulation may come into play. Your institution's compliance and legal team should make this assessment.
What rules should I set for the agency regarding test environments?
A good starting point is to keep test environments closed to search engines, limit access with a password or IP restriction, and not move real customer data into the test environment.
How does Clockwork work for financial institutions?
Clockwork is an independent digital and creative agency based in Istanbul with 25 years of experience; it is certified to ISO 27001 and ISO 12207.
Conclusion
Ask security questions at the proposal stage, request the answers as documents, and reflect them in the contract. The best agency is the one that doesn't find these questions uncomfortable and can show concrete documents and processes.
Clockwork is an independent digital and creative agency based in Istanbul with 25 years of experience. To learn about our approach to working in finance and other regulated sectors, see our industries page or get in touch with us.