Reg S-P oversight of third-party service providers: what should you expect from your MSP?

If your managed IT provider can sign in to your email, file shares, CRM or backups, it almost certainly fits the Regulation S-P definition of a service provider, and your firm answers for how it oversees that provider. The amended rule makes oversight of third-party service providers part of your incident response program. Since the compliance dates passed (December 3, 2025 for larger entities and June 3, 2026 for smaller ones), your firm must oversee each provider through written policies and procedures. This piece covers what a well-run MSP relationship should give you to meet that obligation, and what to ask for if yours does not.

Is your MSP a service provider under Reg S-P?

Most likely, yes. Rule 248.30(d)(10) defines a service provider as any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information" through services provided directly to a covered institution.

The test is access. An MSP that administers your Microsoft 365 tenant, manages workstations through a remote monitoring tool, or runs your backups is permitted access to customer information even if its technicians never open a client file. Most managed IT services for financial advisors include at least one of those, and the analysis is the same whether the firm is an RIA, a broker-dealer or a dual-registered firm.

What does oversight of third-party service providers require under Reg S-P?

Your incident response program must include written policies and procedures, reasonably designed to require oversight of service providers "including through due diligence and monitoring." Those policies must be reasonably designed to ensure each provider takes appropriate measures to protect against unauthorized access to customer information and to notify you of a qualifying breach. The text is in Rule 248.30(a)(5)(i).

If your firm already runs a broader third-party risk management program, the MSP can sit inside it. Check that the program covers the Reg S-P elements specifically: due diligence, ongoing monitoring and notice within 72 hours.

Two points get missed. First, the obligation sits with the firm. The SEC's small entity compliance guide frames it as oversight the covered institution performs. Second, the rule does not prescribe a contract for oversight, so the evidence you keep is what shows an examiner that oversight happened. We covered contract terms in detail in Reg S-P service provider notice: are your vendor contracts updated?

How fast should your MSP tell you about a breach?

No later than 72 hours. The rule requires your policies to be reasonably designed so a service provider notifies you "as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider."

Once you receive that notice, the rule says your firm "must initiate its incident response program." That is the start of your own clock. Customer notice, where required, is due as soon as practicable and no later than 30 days after your firm becomes aware of the incident under Rule 248.30(a)(4).

In practice, expect your MSP to put the 72-hour commitment in writing, name who on its side sends the notice, and name who on your side receives it. A notice that goes to a shared inbox nobody watches on a Friday night does not help you.

Which systems does your MSP "maintain"?

The 72-hour trigger applies to a customer information system "maintained by the service provider," so you need a shared list of what that covers. The rule defines customer information systems broadly in Rule 248.30(d)(6) as the information resources owned or used by your firm, including physical or virtual infrastructure, organized for handling customer information.

For a typical MSP relationship, that list includes:

• Your email and collaboration tenant, if the MSP holds administrative access
• Endpoints and servers the MSP patches, monitors or remotely controls
• Backup and recovery systems the MSP operates
• Firewalls, remote access tools and identity systems the MSP configures
• The MSP's own management tools that can reach your environment

Agreeing on this list in advance avoids an argument during an incident about whether a given system was in scope. It also feeds the data map most firms built for the 2024 amendments. If you have not mapped sensitive customer information yet, see How do you map sensitive customer information for Reg S-P?

What evidence should your MSP give you for due diligence and monitoring?

Your MSP should give you enough to show an examiner that you checked it before relying on it and kept checking afterward. The rule names due diligence and monitoring and leaves the method to you.

Reasonable requests to an MSP include:

• A description of its own security controls, such as how its technicians authenticate and how administrative access to client environments is logged
• Periodic reports on patching, backup success, endpoint protection status and privileged account changes in your environment
• A current list of its staff and tools with access to your systems
• Prompt answers to your annual vendor review questions

Recordkeeping is where this evidence lands. Rule 204-2(a)(25) requires SEC-registered advisers to keep records of their Reg S-P written policies, including the service provider policies, and broker-dealers have a parallel requirement in Rule 17a-4(e)(14). Your MSP's reports are the working evidence that those policies operate. For one way to organize them, see How to prepare for an SEC exam: build an evidence binder from your MSP's reports.

What should your MSP do during an incident?

Help you meet the three things your response program must do: assess, contain and decide on notice. Rule 248.30(a)(3) requires procedures to assess the nature and scope of an incident, take steps to contain and control it, and notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

Your MSP usually holds the logs and technical access needed for the first two steps. Expect it to preserve evidence, identify affected systems and types of customer information, and document what it did and when. Advisers must keep written documentation of any detected unauthorized access and their response under Rule 204-2(a)(25)(ii), so your MSP's incident notes become part of your records. They also support your notice decision, including a decision not to notify. We covered that record in Reg S-P notification requirements: how do you document a no-notice decision?

Can your MSP send customer notices for you?

It can, if you sign a written agreement for it, but the responsibility stays with your firm. Rule 248.30(a)(5)(ii) and (iii) allow a covered institution to agree in writing that a service provider will notify affected individuals on its behalf, while "the obligation to ensure that affected individuals are notified" rests with the covered institution.

Most firms keep customer notice in-house because it involves client relationships, legal review and regulator communication. Whichever route you choose, write it down so nobody assumes the other party is handling it.

Does your MSP have a role in disposal?

Often, yes. Rule 248.30(b) requires covered institutions to properly dispose of consumer and customer information and to adopt written disposal policies. If your MSP retires laptops, wipes servers or swaps out firewalls, ask for a record of each device and the method used. Our guide to retiring laptops, copiers and phones under the disposal rule covers the details.

What should you do this quarter?

Five steps cover most of the gap for a firm that already has a Reg S-P program on paper:

• Confirm in writing that your MSP treats itself as a Reg S-P service provider and commits to notice within 72 hours
• Agree on the list of systems your MSP maintains and attach it to your service provider records
• Name the people on each side who send and receive breach notices, with after-hours contacts
• Decide whether your MSP will ever send customer notices, and document the answer
• Schedule a recurring request for your MSP's operational reports and file them with your oversight records

A tabletop exercise that includes your MSP is a good test of all five. See How do you run a Reg S-P incident response tabletop exercise?

How does s90 help?

s90 works with RIAs, broker-dealers and dual-registered firms in Los Angeles and Orange County as a Reg S-P service provider. Our agreements commit to breach notification within 72 hours and to producing requested evidence within 24 hours, and our reporting is built to drop into your oversight file. If you want to compare your current MSP arrangement against this list, we are happy to walk through it with you.