Guides › Vendor oversight

Reg S-P: what to require from vendors

Your custodian, CRM, email host and planning software all touch customer information. The amended rule makes you oversee them.

Do these

1. List every service provider with access to customer information.
2. Do due diligence before you hire them and monitor them after.
3. Require breach notice within 72 hours. Your policies must be reasonably designed so each provider tells you as soon as possible, and no later than 72 hours after it becomes aware of a breach in security that resulted in unauthorized access to a customer information system it maintains.
4. Require safeguards. Providers must take appropriate measures to protect against unauthorized access to or use of customer information.
5. Start your response plan the moment a provider notifies you.
6. Decide who notifies customers. A written agreement can have the provider notify affected individuals for you, but the obligation to make sure it happens stays with you.
7. Keep the contracts and your oversight records as books and records.

Ask each vendor

• Will you notify us within 72 hours of a breach affecting our customers' data?
• Who do we call, and how do we reach them at night?
• What customer information do you hold, and where?
• Will you notify our customers for us, and in what form?

Build your plan and vendor register

Source: 17 CFR 248.30(a)(5), read 2026-10-16. Not legal advice.