How to Prove Your Regulation S-P Vendor Reviews Happened

Amended Regulation S-P requires SEC-registered advisers to oversee their service providers. Most firms already check their vendors in some way: a call with the vendor, a security questionnaire, a SOC 2 report saved to someone's desktop.

The harder part is showing it later. When an examiner asks how you reviewed your CRM vendor last year, you need to hand over a dated, signed review form and the evidence behind it.

Proving a vendor review happened comes down to two things. First, each review needs accurate, verifiable proof that the checks were done. Our free Vendor Security Review template is built for that. Second, keep every document used in each year's vendor review on file, where you can produce it during an exam.

What Regulation S-P says about service providers

The service provider requirement is in 17 CFR 248.30(a)(5)(i). Your incident response program must include written policies and procedures:

reasonably designed to require oversight, including through due diligence and monitoring, of service providers

Those policies must be reasonably designed to ensure your service providers take appropriate measures to:

• protect against unauthorized access to or use of customer information, and
• notify your firm as soon as possible, and no later than 72 hours, after becoming aware of a breach that results in unauthorized access to a customer information system the provider maintains.

Two terms matter most here: due diligence and monitoring. In practice, due diligence is the review before you start using a vendor, and monitoring is the review you repeat after that. The rule names both. It does not say how often to repeat the review.

Who counts as a service provider, including your IT provider

The definition is in 248.30(d)(10). A service provider is any person or entity that:

receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution

The definition is wide. For a small RIA it usually includes the IT provider, the CRM, financial planning software, document storage, email archiving, e-signature, and any AI note-taker that sits in client meetings. An IT provider with access to client information generally falls within the definition.

Start with a list. Every vendor that can see client data goes on it.

Six records every vendor review should produce

A vendor review should produce the same set of records every time. We built the free Vendor Security Review template around them:

1. A vendor profile. What the vendor does for the firm, what client data it touches, how the data gets there, and where it is hosted. The answers set a data tier, and the tier decides how deep the rest of the review goes.
2. A list of the documents you reviewed. The SOC 2 Type II report, a penetration test summary, security and incident response policies, a certificate of insurance, and the contract or data protection addendum. Write down whether you received each one and the date or period it covers.
3. The security controls you checked, against a pass standard. Encryption, MFA, access logging, vulnerability management, subprocessors, and how the vendor uses client data in AI features.
4. The Regulation S-P terms. Does the contract, or a signed attestation, cover protecting customer information and the 72-hour breach notice? Who at your firm receives that notice?
5. Findings, with actions and due dates. List every gap, the action required to close it, and the date it is due.
6. A decision and a sign-off. Approved, approved with conditions, or not approved. Signed by the reviewer and the CCO, with the next review date.

If one of these records is missing, the review is harder to defend.

Proof an examiner can verify

Evidence holds up when it is dated, sourced, read, and tied to a decision. A folder of vendor documents, on its own, does not show that anyone read them.

Here is the difference in one line from a review form.

Weak: "Vendor has SOC 2."

Strong: "SOC 2 Type II, period ending June 30, 2026, unqualified opinion. Two exceptions in change management, judged low risk. Complementary user entity controls: the firm enforces MFA for all users. Report saved in the vendor file."

The strong version tells an examiner that someone opened the report, read the exceptions, noted what the firm itself has to do, and kept a copy. A few habits get you there:

• Record the audit period, not only the report date. If the period ended more than three months ago, ask for a bridge letter, a letter from the vendor that covers the time since the period ended.
• Read the exceptions and write down what you decided about each one.
• Note the complementary user entity controls. These are the controls the vendor assumes your firm runs, such as MFA or removing access when someone leaves. They become your firm's controls for that vendor.
• Keep the vendor's answers in writing. If the 72-hour notice is confirmed by email instead of contract, save the email.
• Sign and date the form. An unsigned form is a draft.

Keep every review document on file and ready to produce

Regulation S-P records for advisers are covered by Advisers Act Rule 204-2(a)(25). For service providers, it names two records: the written policies and procedures for service provider oversight, in (a)(25)(iv), and any contract or agreement with a service provider under 248.30(a)(5), in (a)(25)(v).

Rule 204-2(e)(1) sets the retention period. Keep these records in an easily accessible place for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office of the adviser.

The rule names the policies and the contracts. It does not list the SOC 2 report or the review form by name. But your written policies say you do due diligence and monitoring. The completed reviews, and the evidence behind them, are how you show the policies were followed. So keep every document you used in each year's review with the records the rule names, on the same schedule, where you can produce it during an exam.

A few practical rules for the file:

• One folder per vendor, with a subfolder for each year's review.
• Keep every year. Do not overwrite last year's review with this year's. The history shows monitoring.
• Keep the completed form, the documents you reviewed, the contract in force, and any written vendor answers together.
• Keep superseded contracts too. An examiner may ask what terms were in place at the time of an incident.
• Test the file. Ask someone who did not build it to find last year's review of your IT provider. If it takes more than a few minutes, fix the filing before an examiner tries.

The SEC's fiscal 2027 examination priorities, a staff statement released October 23, 2026, say staff will evaluate response program policies and procedures, including oversight of service providers. A file you can hand over quickly shows that oversight happens.

Repeat the review every year for vendors with client data

Vendors change. They add subprocessors, turn on AI features, get acquired, and let their SOC 2 lapse. A review from 2024 says little about the vendor you use today.

The template sets a schedule by data tier: every year for vendors that hold client data, every two years for vendors that hold none. Review sooner when a vendor tells you about a material change, or when you change how you use it.

Start with your vendor list and the template

1. Download the Vendor Security Review template.
2. List every vendor that can see client data. Include your IT provider.
3. Set a data tier for each one.
4. Review the highest-tier vendors first, starting with whoever holds the most sensitive customer information.
5. File each completed review, with its evidence, in a folder someone else can find.

If you want the full program checked, the Regulation S-P cybersecurity checklist covers vendor oversight alongside the rest of the rule. If you would rather have the reviews done for you, book a consult.

This post is general information, not legal advice. Confirm your firm's obligations with compliance counsel. SaberGuard assesses and advises; it does not warrant compliance.