That gap is where exam findings happen. Verizon's 2026 DBIR found third-party involvement in 48% of breaches, up from 30% in the prior year's report. The Regulation S-P amendments now put vendor oversight and incident notification squarely in front of covered firms.
This guide connects the rule to a working vendor risk program: scope, tiering, due diligence, contracts, monitoring, incident response, evidence, and board reporting. It is general information, not legal advice. Confirm current requirements with qualified legal or compliance counsel.
Key Takeaways
- Documented, risk-based oversight across the vendor lifecycle is required; secure vendor selection alone is not enough.
- Start with vendors that touch customer information, support critical functions, or use subprocessors.
- Providers must notify you within 72 hours of a breach; you have 30 days to notify customers.
- Proposed SEC outsourcing and cybersecurity rules were withdrawn in 2025. Don't treat them as law.
Understand Regulation S-P and Its Vendor Risk Implications
What Regulation S-P covers
Regulation S-P governs privacy notices, safeguarding of customer records and information, and disposal. The 2024 amendments (Release 34-100155) added a written incident response program, service-provider oversight, and customer notification. The operative text is in 17 CFR 248.30.
Covered institutions are broker-dealers, investment companies, SEC-registered investment advisers, and transfer agents. Funding portals follow the rule as it applies to brokers under Regulation Crowdfunding.
How third-party providers fit
A service provider is any person or entity that receives, maintains, processes, or is otherwise permitted access to customer information through services provided directly to you. Your policies must address due diligence and monitoring of those providers.
A contract does not transfer accountability. Even where a provider delivers customer notices under a written agreement, the covered institution keeps responsibility.
What changed under the amendments
- Incident response program: written, reasonably designed to detect, respond to, and recover from unauthorized access to customer information.
- Provider notice: policies must ensure providers notify you as soon as possible, and no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain.
- Customer notice: as soon as practicable, no later than 30 days after you become aware that unauthorized access occurred or is reasonably likely to have occurred, subject to a no-substantial-harm exception.
- Records: written policies, investigation and notification determinations, notice copies, and provider-oversight materials.
| Entity | Larger-entity test | Compliance date |
|---|---|---|
| Investment company | $1B+ net assets with related funds | December 3, 2025 |
| SEC-registered adviser | $1.5B+ AUM | December 3, 2025 |
| Broker-dealer / transfer agent | Not a small entity under Rule 0-10 | December 3, 2025 |
| Smaller entities | Outside those categories | June 3, 2026 |
Both dates have passed. Check which category you fall into, because the small broker-dealer and transfer-agent tests have several conditions.
Current obligations versus related rules and proposals
- Advisers Act Rule 206(4)-7: compliance policies, annual review, and a chief compliance officer. It is not vendor-specific.
- FINRA Notice 21-29 and Rule 3110: outsourced activities remain subject to supervision.
- Withdrawn proposals: the 2022 adviser outsourcing proposal and the adviser/fund cybersecurity proposal were both withdrawn in June 2025. They are not obligations.
- NIST and banking guidance: voluntary or aimed at banks. Useful for structure, not mandates.
- State law: breach-notification rules remain a separate consideration.
The final rule also dropped the proposed requirement for a mandatory written service-provider contract. No specific contract clause is required by Regulation S-P. Contracts remain the practical way to make oversight enforceable.
Map Vendor Scope, Data Access, and Risk Tiers
Build a complete vendor inventory and data map
Start with one vendor list. List every technology provider, custodian, cloud host, CRM, portfolio or account system, outsourced operations team, consultant, and contractor that touches customer information or supports a critical service.
For each, record:
- What customer information it accesses
- System connections and data flows
- Where data is stored
- Key subprocessors
Don't chase every fourth party. Focus on the key subprocessors of your critical vendors.
Classify vendors by inherent risk and business impact
Judge each vendor on:
- Data sensitivity and system privileges
- Service criticality and how easily it can be replaced
- Concentration risk and potential customer harm
Three tiers are usually enough:
| Tier | Profile | Review cadence |
|---|---|---|
| Tier 1, high | Production access, sensitive-data storage, critical operations | Within 30 days or before go-live; at least annually after |
| Tier 2, medium | Limited sensitive data, meaningful dependency | Within 60 to 90 days; set cycle or renewal |
| Tier 3, low | No sensitive data, easy to replace, minimal access | On renewal or major change |
Tiers should set the depth and frequency of oversight. A label that changes nothing is just decoration.
Assign ownership across the lifecycle
A simple RACI works:
- Business owner holds the relationship
- Procurement handles the purchase
- Legal owns the terms
- Security owns the controls
- Privacy owns data use
Compliance reviews against Regulation S-P. Executives own vendors that exceed risk appetite.
Write down the escalation path. Who decides when a Tier 1 vendor fails a review?
Build a Regulation S-P-Aligned Vendor Risk Management Program
Establish governance and decision rights
Name these roles up front:
- Policy owner
- Vendor owner
- Approval authority
- Compliance reviewer
- Incident escalation path
A short decision-rights map should answer five questions:
- What risk-acceptance threshold applies?
- How long can an exception last?
- Who decides budget tradeoffs?
- Who has incident-severity and shutdown authority?
- Who owns go/no-go for critical suppliers?
Perform risk-based due diligence before engagement
Review evidence before sharing customer information or granting access. Scale it to the tier: a short questionnaire for Tier 3, document review for Tier 2, and a focused call with security and the business owner for Tier 1.
For higher-risk vendors, ask for:
- Security policies and independent control reports
- Penetration-test summary and vulnerability-management statement
- Incident-response overview and incident history
- Encryption, access-control, retention, and disposal practices
- Business continuity and disaster recovery test evidence
- Insurance, regulatory findings, and subcontractor list
A SOC 2 report is evidence to evaluate, not proof of Regulation S-P compliance. AICPA guidance notes that scope, carved-out subservice organizations, user-entity controls, and exceptions all change what a report actually establishes. Type 1 covers a date; Type 2 covers a period.
Put enforceable safeguards into contracts
Build these requirements into the agreement:
- Confidentiality and permitted data use
- Security controls and encryption
- Retention, deletion, and data return
- Audit or assurance rights
- Cooperation with investigations
- Subcontractor controls
- Continuity and termination assistance
State breach notice in hours, not "reasonable time." Align it with the rule's 72-hour outer limit, and give your own response team a faster internal target. Have counsel review the final language.
Monitor continuously and reassess on triggers
Annual questionnaires miss what changes between cycles. Re-review when you see:
- New integrations, data types, or privilege increases
- Breach news, major outages, or service-level failures
- Acquisitions, ownership changes, or financial stress
- New subprocessors or new regulations
- Updated control reports
Tier 1 vendors deserve constant attention; Tier 3 vendors do not.
Manage exceptions, remediation, and exits
Every exception should record:
- Owner and approver
- Reason and scope
- Compensating control
- Expiry date
- Monitoring method
No open-ended exceptions. Convert inherited permanent ones into time-bound approvals.
For an out-of-tolerance vendor, choose one path and keep it visible until closed:
- Accept: time-bound exception with a named owner
- Reduce: internal controls and deadlines, tracked with evidence
- Transfer: shift part of the exposure, for example through insurance
- Replace: exit plan with data return, cutover steps, and timeline
"Must fix before go-live" blocks onboarding. "Must fix before renewal" blocks extension.
Create Evidence, Incident Response, and Examination Readiness
Build an evidence file for each material vendor
Keep, per material vendor:
- Tier classification and data-flow analysis
- Due diligence and approvals
- Contract versions
- Control reports and monitoring results
- Incidents, remediation, and risk acceptances
- Renewal decisions and offboarding records
Defensible evidence is dated, attributable to a reviewer, tied to a decision, and updated when risk changes. Retention periods differ by entity, so don't adopt one number:
| Entity | Rule | Retention |
|---|---|---|
| Broker-dealer | 17a-4(e)(14) | 3 years, easily accessible |
| SEC-registered adviser | 204-2(a)(25) | 5 years, first 2 easily accessible |
| Registered investment company | 31a-1, 31a-2 | 6 years, first 2 easily accessible |
| Transfer agent | 17Ad-7(k) | 3 years, easily accessible |
Retention clocks also start on different events, such as termination of use for policies. Confirm the triggers with counsel.
Connect vendor notices to your response plan
A vendor's notice activates your incident response program. Your workflow should cover:
- Triage and containment
- Evidence preservation
- Legal and compliance assessment
- Regulator or law-enforcement contact
- Customer notification
- Continuity
- Board escalation
Keep the two obligations separate. The vendor owes you notice. You owe customers notice, on your own clock, and the 30 days runs from your awareness.
Practical requirements:
- Current vendor contacts and escalation thresholds
- Alternate communication channels if email is compromised
- A case timeline recording timestamps, decisions, and actions in the first 24 hours
- Tabletop exercises that test whether you can identify affected customer information and pinpoint when you became aware
If you can't describe your first two hours of response, you don't have a plan yet.
Prepare for examination
The SEC's FY2027 examination priorities specifically name Regulation S-P policies, incident response, customer notification, and service-provider oversight. Those are priorities, not new rule text.
Assemble an exam-ready package that includes:
- Policies and vendor inventory
- Risk assessments and contracts
- Monitoring records and exceptions
- Incident files and training records
- Committee materials
- Proof that remediation was completed
Sample-test a few vendor files each quarter and document reassessment of material relationships.
Enforcement shows the failure patterns. Morgan Stanley Smith Barney paid $35M over decommissioned equipment handed through vendors (pre-amendment conduct). M Holdings Securities paid $325,000 in 2025 for safeguards that weren't implemented across its member firms.
Establish Executive Oversight and a 90-Day Action Plan
Avoid common oversight failures
- Incomplete vendor inventories
- One-time questionnaires
- SOC reports nobody reviewed
- Missing contract rights, especially notice and audit
- Undocumented risk acceptance
- Untracked subcontractors
- Unclear incident contacts
- Weak offboarding
- Dashboards that show activity instead of risk trends
Give boards a clear view of vendor exposure
Deloitte's 2023 survey of more than 1,300 third-party risk leaders found 32% lacked formal risk segmentation and 48% wanted a stronger executive role. Cross-industry data, but the gap is familiar.
Report in plain English, focused on critical vendors: those that can stop a business service, expose sensitive data, or trigger regulatory or contractual impact. Reporting cadence should stay concrete:
- Quarterly to the board: top vendor risks, trends, and decisions needed
- Monthly to executives: remediation progress, renewals, and exceptions
Include overdue Tier 1 findings, significant incidents, concentration risk, and renewals due within 90 days. Set thresholds from your own risk appetite, such as maximum downtime or data-loss window, rather than borrowing universal targets.
A practical 90-day plan
- Days 1 to 30: build the single inventory (doable in 7 days, even with messy data), map data, assign owners, and identify gaps.
- Days 31 to 60: tier vendors, run priority due diligence, fix contract gaps on breach notice, audit rights, and subcontractors, and wire vendor notices into your incident workflow.
- Days 61 to 90: set monitoring triggers, run a tabletop, launch the executive dashboard, and govern remediation to closure.
Where internal capacity is thin, outside help can sharpen decision rights and build execution you can inspect. Tyson Martin provides board advisory and interim or fractional CISO leadership, with a 90-day plan that has owners and measurable outcomes. It is advisory work, not legal advice, compliance auditing, or a guarantee of compliance.
Frequently Asked Questions
What is vendor risk management?
It is the process of identifying, assessing, treating, monitoring, and documenting risks introduced by vendors and other external service providers. It runs from onboarding through offboarding.
Are TPRM and vendor risk management the same?
They overlap heavily. Third-party risk management usually covers a broader ecosystem than purchased vendors, while a vendor program can be narrower. Under Regulation S-P, the operative term is "service provider."
How does Regulation S-P apply to third-party service providers?
Covered institutions must maintain policies for due diligence and monitoring of providers that access customer information, and ensure providers notify them within 72 hours of a qualifying breach. Verify current text in 17 CFR 248.30.
What should a vendor contract include for Regulation S-P compliance?
Data-use limits, security safeguards, incident notification, investigation cooperation, subcontractor controls, audit or assurance rights, retention and deletion, continuity, and termination provisions. Have counsel review them.
What evidence will the SEC expect for vendor oversight?
Dated, attributable records: risk assessments, due diligence, approvals, contracts, monitoring, incident files, remediation, and periodic review for material vendors.
