Vendor oversight under GLBA: what happens after the contract?

For a CCO at an RIA, broker-dealer or family office, the vendor file often holds signed contracts and a questionnaire from onboarding. The SEC's 2026 exam priorities name oversight of third-party vendors, so examiners will also ask what you checked after signing.

What does GLBA require for vendor oversight?

GLBA requires financial firms to oversee the vendors that handle customer information, and vendor oversight under the agency rules goes further than a signed contract. The statute, 15 U.S.C. 6801(b), directs regulators to set safeguards standards. For most advisory, brokerage and other non-bank financial firms, those standards arrive through one of two rules.

Advisers not required to register with the SEC, mortgage brokers, tax preparers and other non-bank firms follow the FTC Safeguards Rule. 16 CFR 314.4(f) requires three things:

• "Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards."
• "Requiring your service providers by contract to implement and maintain such safeguards."
• "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."

SEC-registered advisers, broker-dealers and dual-registered firms follow Regulation S-P. Amended Rule 248.30(a)(5) requires written policies and procedures reasonably designed to require oversight of service providers, "including through due diligence and monitoring." The SEC's fact sheet uses the same words. Both compliance dates have passed: December 3, 2025 for larger entities and June 3, 2026 for smaller ones.

Under both rules, responsibility stays with the firm. The FTC's own guide puts it plainly: "the buck still stops with you."

Why isn't the contract enough?

The contract covers one of the three FTC steps, and it describes what a vendor promised. Monitoring shows whether the vendor is still keeping that promise. The FTC Safeguards Rule makes periodic assessment its own requirement in (f)(3), separate from the contract in (f)(2), and Reg S-P names monitoring alongside due diligence.

Vendors change after you sign. They are acquired, move data to new hosting providers, add AI features that process client documents, change subprocessors, and lose key staff. A security questionnaire from 2023 says little about any of that. The FTC's Safeguards Rule guide says contracts should "build in ways to monitor your service provider's work" and "provide for periodic reassessments of their suitability for the job."

Broker-dealers have an added layer. FINRA Regulatory Notice 21-29 reminds member firms that outsourcing a function to a vendor does not relieve the firm of its supervisory obligations.

How often should you reassess a service provider?

Neither rule sets a fixed schedule. The FTC Safeguards Rule ties reassessment to "the risk they present," and the FTC's guide does not name a frequency. That leaves the firm to set a cadence it can defend and then follow it.

A common approach is to tier vendors by the customer information they hold and the access they have:

• High risk: vendors with administrative access to your systems or large stores of client data, such as your managed IT provider, CRM, portfolio management platform, document storage and email archiving. Reassess at least annually and after any significant change or incident.
• Moderate risk: vendors with limited client data, such as e-signature, scheduling or a payroll provider. Reassess on a longer cycle.
• Low risk: vendors with no access to customer information. Confirm that remains true when you renew.

Whatever cadence you choose, write it down. An examiner will compare your policy to your file, and a policy that promises annual reviews with no annual reviews on record is a finding of its own.

What does vendor monitoring look like in practice?

Monitoring means collecting fresh evidence on a schedule and acting on what it shows. For most firms, the evidence falls into a few categories:

• Independent reports, such as a current SOC 2 Type II report, with the exceptions and the complementary user entity controls read and noted.
• Security changes since the last review: new subprocessors, new hosting locations, mergers, or new AI features that touch client data.
• Access reviews: which vendor staff and integrations can reach your systems and data, and whether that still matches the job.
• Incident history: any breach or outage the vendor disclosed, and how fast it told you.
• Contract checks: whether security terms, breach notice timing and data return or deletion terms are still in place at renewal.

For your IT provider, monitoring can go further, because it holds the keys. Ask for evidence that patching, backup testing, multi-factor authentication and administrator account controls are working: reports, test results and logs you can file.

For SEC-registered firms, notice timing is a specific check. Reg S-P requires your oversight to be designed so that service providers notify you no later than 72 hours after becoming aware of a breach affecting a customer information system they maintain. We cover the contract side in Reg S-P service provider notice: are your vendor contracts updated?

What will an examiner or board want to see?

They will want proof that oversight happened, recorded close to when it happened. The SEC's fiscal 2026 examination priorities list "oversight of third-party vendors" among the areas Regulation S-P and S-ID reviews will cover.

On the FTC side, 16 CFR 314.4(i) lists "service provider arrangements" among the material matters the Qualified Individual's annual written report to the board should cover. Firms with customer information on fewer than 5,000 consumers are exempt from that report under 314.6, though the oversight duty itself still applies.

A file that holds up usually contains:

• A current vendor inventory showing which vendors have access to customer information and their risk tier.
• The due diligence record from onboarding for each high-risk vendor.
• Dated reassessment notes, with the evidence reviewed and any follow-up items.
• Current contracts or amendments with security and breach notice terms.
• Escalations: what you did when a vendor fell short, and who decided.

What should you do this quarter?

This quarter, turn vendor oversight from a contract file into a recurring review.

• Refresh the vendor inventory and assign each vendor a risk tier with a one-line reason.
• Put reassessment dates on the calendar for every high-risk vendor, with an owner for each.
• Request current SOC 2 reports from your top five vendors and record the exceptions you found.
• Ask each high-risk vendor in writing whether it has added subprocessors, changed hosting, or added AI processing of client data in the past year.
• Compare breach notice terms against what your incident response program expects, including the 72-hour Reg S-P window where it applies.
• Add a vendor oversight summary to the next board or senior officer report.

Whether a particular vendor or program meets the rule for your firm is a judgment for your compliance officer and counsel.

How does s90 help?

s90 works with RIAs, broker-dealers, dual-registered firms and family offices in Los Angeles and Orange County. As one of your highest-risk vendors, we make our own oversight easy: our client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment. We also help firms build the vendor inventory, collect evidence from other providers, and keep the oversight file organized for an exam. If your vendor file stops at the contract, a short call is a good place to start.