Is your CRM vendor an SEC compliance liability? Understanding Third-Party Risk

This core principle sits at the heart of Regulation S-P and is a central focus of ongoing priorities for the Division of Examinations. The risk isn’t just hypothetical—failure to demonstrate robust vendor oversight is one of the fastest ways for an RIA to attract serious regulatory scrutiny.

The SEC understands that modern technology requires third-party partners. The issue that examiners flag is not the choice of the vendor itself, but the lack of documented, ongoing oversight.

To satisfy regulatory demands, your vendor risk management (VRM) framework should clearly document four areas of oversight for every material vendor.

Before a single dollar is spent or a single piece of client data is shared, you must assess the vendor’s internal security controls.

• Proof Required: Did you obtain and thoroughly review the vendor’s SOC 2 (Type II) report or equivalent security documentation? You must be able to demonstrate that you understood its control environment prior to contract execution.

The contract is your first line of defense. It must align the vendor’s responsibilities with your regulatory obligations.

• Proof Required: Does your contract specifically mandate that the vendor must notify you within the required 72 hours of discovering a material incident or data breach? The clock starts ticking for your notification requirements the moment the vendor knows.

The vendor’s control environment changes—it updates software, changes cloud providers, or moves data centers. Your oversight cannot be a one-time event.

• Proof Required: Does your contract require the vendor to notify you as soon as possible, and no later than 72 hours after it becomes aware of a breach in security resulting in unauthorized access to a system that holds your customer information? Your own 30-day deadline to notify affected clients runs from when your firm becomes aware, so quick vendor notice matters.