Five questions every wealth management firm should ask its IT provider

Your IT provider can see more of your firm than almost anyone outside it: the email server, the file shares, the CRM, every laptop and every password reset. Under the amended Regulation S-P, the SEC expects your firm to oversee that relationship in writing, and examiners are now asking how. Below are five questions to ask your IT provider that a CCO, COO or managing partner of an RIA, broker-dealer or dual-registered firm should be able to answer before the next exam or contract renewal.

Why ask your IT provider these questions before an SEC or FINRA exam?

Because Regulation S-P treats your IT provider as a service provider, and overseeing it is your firm's responsibility. 17 CFR 248.30(a)(5) requires a covered institution's incident response program to include written policies and procedures for due diligence on, and monitoring of, service providers. A managed IT provider that administers your systems almost always fits that description.

The compliance dates have passed: December 3, 2025 for larger entities and June 3, 2026 for smaller ones, according to the SEC's small entity compliance guide. The SEC's fiscal year 2027 examination priorities say staff will evaluate Reg S-P response programs, including customer notification procedures and oversight of service providers, and will assess risks from registrants' growing use of third-party service providers. Broker-dealers carry a parallel duty: FINRA Regulatory Notice 21-29 reminds member firms that outsourcing a function to a vendor does not relieve them of their supervisory obligations under Rule 3110.

State-registered advisers are generally outside the SEC's Reg S-P amendments, though their state regulator and other laws may still expect vendor oversight. For the full rule-by-rule picture, see our article on Reg S-P oversight of third-party service providers. The questions below are the short version for a leadership meeting or a contract renewal.

1. Will you tell us within 72 hours if a system you maintain is breached?

The answer should be yes, and in writing. Section 248.30(a)(5) requires your policies to be reasonably designed so that service providers notify you as soon as possible, but no later than 72 hours after becoming aware of a breach in security that results in unauthorized access to a customer information system they maintain. Ask for that commitment in the contract.

The 72 hours matter because your own clock starts soon after. Under section 248.30(a)(4), notice to affected individuals is due as soon as practicable, and no later than 30 days after you become aware that unauthorized access to sensitive customer information has occurred or is reasonably likely to have occurred. A provider that takes two weeks to tell you leaves little time to investigate. Follow-up questions worth asking: who at the provider sends the notice, to whom at your firm, and by what channel if email is the system that was compromised. Our article on updating vendor contracts for the 72-hour notice walks through the contract language.

2. What evidence can you hand us when an examiner asks?

Your IT provider should be able to hand you exam-ready evidence of its work quickly, because oversight on paper only counts if you can show it happened. SEC-registered advisers must keep records of their Reg S-P policies, incident documentation and service provider arrangements under Rule 204-2(a)(25), generally for five years.

The SEC's September 2026 risk alert on adviser annual compliance reviews reported that examiners found policies that delegated services or operations to others without identifying how the adviser would oversee those delegated responsibilities. Ask your provider what it can produce on request: patch and backup reports, MFA coverage, access reviews, incident tickets, and the results of any restore tests. Then ask how long it takes to produce them. Our guide to building an SEC exam evidence binder from your MSP's reports covers what to collect.

3. Who at your company can access our systems and client data?

Your IT provider should be able to name each person or role with access to your systems and client data, how they get in, and how that access is controlled and logged. The FY2027 exam priorities say staff will review cybersecurity policies covering access controls and account management, and will focus on advisers that use third parties to access clients' accounts where existing controls may be insufficient to protect client assets and data.

An IT provider usually holds the most powerful accounts in your environment. Reasonable questions include whether each technician has a named account (shared logins make activity impossible to attribute), whether administrative access requires multifactor authentication, whether remote access tools are limited to approved staff and devices, and how quickly access is removed when one of the provider's employees leaves. Ask for a periodic report showing who holds privileged access. Our article on reading an identity posture report shows what that report should include.

4. Which other vendors do you rely on to serve us?

Your IT provider should give you a list of the vendors it relies on to serve you, because a weakness in any of them can reach your systems. Those vendors include remote monitoring and management tools, backup platforms, security software and cloud hosting. FINRA's 2026 oversight report section on third-party risk lists assessing fourth-party vendors among effective practices, along with keeping an inventory of the firm data each vendor can access and involving vendors in incident response testing.

Two follow-ups are worth the time. First, which of those tools can touch your customer information systems directly, since those are the ones that matter for Reg S-P. Second, what happens to your data and the provider's access when the relationship ends. The same FINRA section lists returning or destroying data and revoking access at termination as an effective practice. If your firm connects outside platforms to your custodian, our article on custodian API integrations and vendor inventories covers that side of the inventory.

5. How do you control AI tools that could see our client data?

Your IT provider should be able to say which AI features it uses in its own work and what controls it applies to the AI tools your staff use. AI now shows up in help desk software, security tools and Microsoft 365, and each one is a path for client data to leave the firm.

FINRA's 2026 report lists due diligence that assesses a vendor's use of generative AI, and contract language that prohibits sensitive data from being ingested into open-source generative AI tools, among effective third-party practices. Its generative AI section suggests firms consider formal review and approval of use cases and storing prompt and output logs. The SEC's FY2027 priorities list generated phishing messages and synthetic or deepfake voice and video used for social engineering among the threats staff will consider. A capable provider should be able to explain which AI tools are approved at your firm, how unapproved ones are detected or blocked, and how client data is kept out of prompts. Our Reg S-P AI vendor due diligence checklist lists the specific checks.

What should you do this quarter?

As of November 2026, both Reg S-P compliance dates have passed, so start with these steps:

• Pull your current IT services agreement and check whether it contains a written 72-hour breach notice commitment and names who receives the notice.
• Send your provider these five questions in writing and file the answers with your Reg S-P records.
• Request one sample evidence package (for example, last quarter's patch, backup and MFA reports) and time how long it takes to arrive.
• Ask for the provider's list of subcontractors and tools that can reach your customer information systems.
• Add the provider to your annual compliance review, with the oversight steps written into your policies so the review can test them.
• Take the decisions listed in the counsel review section below to compliance counsel before you sign contract changes.

What should your counsel review before you change the IT contract?

Do this review before you sign a renewal or amendment with your IT provider, and before your next annual compliance review. Bring these decisions:

• Whether your IT provider, and each subcontractor that can reach customer information, is a service provider under Rule 248.30(d)(10). Bring the IT services agreement and the provider's subcontractor list.
• Whether the contract's breach notice terms support policies reasonably designed to get notice within 72 hours under Rule 248.30(a)(5)(i). Bring the agreement, any security addendum and your incident response program.
• For broker-dealers, how your Rule 3110 supervisory procedures cover the outsourced IT functions, using Regulatory Notice 21-29. Bring your written supervisory procedures and vendor due diligence file.
• Which service provider records you must keep under Rule 204-2(a)(25), and for how long. Bring your recordkeeping policy and current vendor file.

How can s90 help?

If you are not sure how your IT provider would answer these five questions in front of an examiner, that is the gap to close before your next exam or renewal. s90 is a managed IT provider for financial services firms in Los Angeles and Orange County, and we expect clients to ask us these questions. Our agreements include a 72-hour breach notification commitment and 24-hour evidence production, and we can walk your team through how we answer the other three. If that would be useful, talk with our team.