Most IT providers run operations, meaning devices, email, the help desk, and patching, not a security program. Under Regulation S-P the adviser is responsible for oversight of its service providers either way, and the SEC’s September 14, 2026 risk alert on annual compliance reviews faulted advisers whose policies delegated operations to others without saying how the adviser would oversee them.
This is written for the owner or chief compliance officer of a 10 to 500 person RIA who already pays a managed IT provider and isn’t an IT person. The question we hear is some version of the same one: our IT company says we’re all set, so how do we know?
Usually the firm likes its IT company. There are a lot of good IT vendors out there, but their job isn’t SEC compliance. Their job is to keep the lights on.
None of this is a case against your IT firm. What follows is a way to check what you’re paying for without becoming an IT person yourself, and it fits inside the wider cybersecurity for RIAs picture we keep for firms this size. Here are our thoughts regarding RIA IT provider oversight.
Who does what between your IT provider, your compliance consultant, and a security firm?
An IT contract is a scope of services, and the good ones spell out what the provider gives you and what it doesn’t. In the fifty or sixty of those contracts we’ve reviewed over the years, it’s rare to find one that covers everything an RIA needs to be compliant with the SEC, let alone secure enough to avoid a breach.
The compliance consultant works the other side of the firm, including Form ADV, the compliance manual, and the annual review. They sometimes get into information security a little, but they often don’t know enough about the technology to guide it.
Here is how the eleven controls examiners ask about usually split across the three parties. We keep a longer version of this split and hand it to new clients and their IT firms on the day we partner with them.
| Control | IT provider | Compliance consultant | Security firm or vCISO |
|---|---|---|---|
| MFA enforcement | Does it | Not involved | Documents it (the enforcement report) |
| Admin access and access reviews | Grants it, and usually holds admin rights itself | Documents it (the access policy) | Audits it (who holds admin rights, including technicians at the IT firm, and the yearly review) |
| Endpoint detection (EDR) | Does it | Not involved | Documents it (coverage by computer) |
| Backups and restore testing | Does the backups, and should test restores, though many don’t | Not involved | Documents it (the dated restore test) |
| Log retention and review | Keeps them, rarely reviews them | Not involved | Documents it (the review) |
| Vendor inventory and due diligence | Not involved (flags new vendors, at most) | Documents it, sometimes | Both (the inventory, the reviews, the risk ratings) |
| Patching | Does it | Not involved | Documents it (an independent scan) |
| Employee offboarding | Does the technical half | Documents it (the policy) | Audits it (the completed record for each departure) |
| Phishing training | Not involved, usually | Documents it (a template training) | Both |
| Written incident response plan | Doesn’t write it (they own the first response when it runs) | Documents it (a template) | Both (writes it, tests it) |
| Breach-notice terms in vendor contracts | Not involved (they’re one of the vendors asked) | Documents it, sometimes | Documents it (the request-and-response log) |
Read down the IT column and the pattern is “does it,” rarely “documents it.” Read down the consultant column and it’s the reverse. The column that compares what the policy says with what the systems show is the one most firms haven’t filled, and that gap is the one the SEC’s September alert points at.
MFA is the simplest example of why the checking column matters. There are a half dozen ways to implement it, and the strongest form, phishing-resistant MFA, isn’t always the one users want or IT vendors support. So, you can’t just tell the IT company to implement MFA. You have a conversation, and decide on the best option, and then someone confirms it was enforced.
None of this means the IT firm is doing a bad job. Even the best IT providers require nagging and oversight. Sometimes they get busy or have turnover, and ultimately, it’s still the adviser’s responsibility.
Inside the firm, the person who owns that oversight is the chief compliance officer. The SEC’s 2003 release adopting the compliance rule says the CCO “should be empowered with full responsibility and authority to develop and enforce appropriate policies and procedures for the firm.” That’s the standing a CCO needs to ask the IT firm for the documents below.
Cybersecurity is a shared responsibility between the firm, the IT provider, and whoever is checking the work, and the IT provider can’t make a lot of these changes without the firm’s input, because many of them change the way people work.
The list of company computers is a good example. The IT company has primary responsibility for it, but there also needs to be someone inside the company who keeps them honest, because these lists quickly get out of date.
RIA IT Provider Oversight: Eleven things to ask your IT company for this week
Most of the RIAs we work with don’t know the right questions to ask their IT person to find out whether they have it right.
Our version of that question, in the regular meetings we hold with clients and their IT firms, is the same every time: if the answer is that no evidence was found, tell us specifically which logs you looked at and give us copies for the compliance folder.
Send this to whoever runs your systems and ask for each one as a file:
1. The MFA enforcement report, including the policy that enforces it for every new user
2. The list of everyone with admin rights in each system, including technicians at the IT firm, and the date someone last reviewed it
3. A cross-indexed list of every computer against every security and management tool they run, showing full coverage
4. The date and result of the last backup restore test
5. Evidence that someone reviews the logs, such as the last review and who did it
6. The vendor list, with what each vendor holds for you
7. The latest independent vulnerability scan, run by something other than their own management tool
8. The onboarding and offboarding checklist, with proof it was completed for the most recent joiner and leaver
9. The results of the last phishing test they ran on your staff
10. The written incident response plan, with its version date
11. The breach-notification clause in their contract with you
Ask them to reply with which ones they can produce today. Anything that comes back unclear is where to look first.
Expect a few to be hard. Many IT companies struggle to show full tool coverage across every computer, and many struggle with restore tests, or they just don’t do them. A scan from the same tool that does the patching is the tool checking its own work, which is why item seven asks for an independent one. Underneath the whole list is one principle: your IT provider has to be reviewed like any other high-risk vendor.
We make this kind of request of every IT provider that serves our clients, and the only time one has declined is when the document doesn’t exist. A questionnaire answer and actual practice don’t always match, which is why we ask for the scan or the policy rather than a “yes.” If a report is hard to pull, a screenshot will do.
One firm we spoke with had been with the same IT company for years before it asked for this kind of evidence. It turned out the provider could produce reports showing how it managed the firm’s computers and firewall. Nobody had ever sent those reports to the firm, and nobody at the firm had known to ask for them.
Why a policy PDF is not a security program
The firms that call us describe their situation in nearly the same words every time. They are wealth managers, not IT people, so they don’t know what they don’t know, and their compliance consultant does a lot of things but nothing on the cyber side.
At that point the paperwork usually consists of a compliance manual from a law firm or a consultant, with an information security section that reads well and may or may not be technically accurate, plus an IT contract that covers devices, email, and tickets. Nobody’s job is to check that the policy is running on the systems the contract covers.
Many compliance firms aren’t very technical and tend to take a template-driven approach, as opposed to really understanding the technology they’re trying to protect. For the Form ADV side of the firm, a template is fine.
The trouble is that the template describes controls, and when we start from how a firm is actually doing things instead of from its policies, we usually find that the policies, if the firm has any, don’t match. You can have documentation that will pass a general exam just fine and still not be secure. Sometimes having a document is enough to be compliant, but making the policy real is what you need to do to be secure.
One firm we work with brought us a consultant’s manual whose Reg S-P section didn’t commit to the notification clocks the amended rule now sets. Another had a plan whose breach procedures section said, in effect, that the firm still needed to write them. One owner described a generic incident response plan a software tool had produced for them, and said it wasn’t something they would feel comfortable actually implementing.
In all of these cases, the firms had paid for a document and assumed that having it was the same as running it. In all the assessments we’ve run, only once has a firm turned out to be as well set up as it thought it was.
What the SEC wants to see, as we tell clients, “is not that you’re perfect, but that you have a process and the process is working.” The September 14 alert reads the same way.
Its findings are annual reviews that weren’t done or weren’t documented, policies that didn’t match practice, and the delegation problem from the top of this page. Every one of those is a gap between the document and the practice.
A better PDF won’t close that gap. Closing it takes someone whose job is to compare the two, and who neither wrote the policy nor runs the systems.
When is more RIA IT provider oversight needed?
The firms that add independent oversight usually do it because something forced the question. When we ask a new prospect what kicked off the conversation, the answer is almost always one of the same few things: a custodian cybersecurity assessment, an exam letter, a cyber insurance application or renewal, or a client questionnaire.
An exam notice is the obvious one. A general exam goes a mile wide and an inch deep, and a policy plus a little evidence usually gets you through the cybersecurity part. An IT-focused exam is different. That one comes with a request letter asking for evidence before the examiners arrive, and most of that evidence is going to be with the IT firm.
A cyber insurance renewal asks the same questions in a form. Custodians are often why the form shows up at all. In 2021 Schwab began requiring the RIAs it custodies for to carry coverage that includes social engineering and theft by hackers, and Fidelity Institutional followed with its own requirement.
The application will ask whether you have endpoint detection and response. We’ve seen firms answer “yes” because they believed they did, and then have coverage declined after a breach because they didn’t. Before you answer, ask the IT firm for the report that shows which computers have EDR installed and running, and answer from that report, not from memory.
Moving from state to SEC registration is another. Advisers generally have to make that move once they reach $100 million in assets under management, and it puts them on the SEC’s exam calendar.
The SEC’s fiscal 2027 exam priorities say examiners will keep prioritizing advisers that have never been examined, “with particular emphasis on recently registered advisers.” A newly registered firm doesn’t need to be perfect on the day they open, but it needs to be able to show it was working on the list.
A near miss is the trigger nobody plans for. One firm we spoke with had an email account taken over and spoofed messages sent to a couple of hundred contacts. The IT company handled the emergency well and got the systems sound.
If spoofed messages like those reach your clients, our client account compromise response guide covers what to do when one of them calls.
When the operations lead asked what happened next, the answer was that they don’t really get into that, you’re good. The reaction was the right one: are we, though? Who do we need to tell? Another prospect asked us a sharper version of the same question before anything had happened: if we were hacked, how long before we’d even know?
The best trigger is the list above. If you sent it to your IT company and more than a couple of items came back unclear, that is your answer.
None of this makes the IT provider the villain. In our experience, IT providers fall into two camps. The good ones say, honestly, we don’t know the SEC side, but tell us what you need and we’ll make sure you have it and tell you what it costs. The other camp says don’t worry about it, you’re good.
When we review an IT provider as a vendor, the good ones ask to be rated honestly and fix what the review finds. One told us the most useful thing to come out of the review was a gap they found because we asked the question. Two of the IT firms our clients work with have said so repeatedly.
We learned this the hard way. When we started the company we worked through IT firms, and more than once the IT firm asked us to hold back results or stay off a sensitive topic until they’d had time to clean it up, so the client never needed to know.
Nobody in those conversations was a bad actor. That is what the incentive does when the same company grades its own work, and it’s why we stopped working through IT firms and why we describe the all-in-one model as the fox watching the henhouse.
So, when it comes to RIA IT provider oversight, someone who isn’t your IT firm has to check your IT firm, because nobody can audit their own work.
That check is what our RIA cybersecurity services are built around, and most of the firms we work with keep the IT provider they already have.
Frequently asked questions about RIA IT provider oversight
Is our IT company a “service provider” under Reg S-P?
Yes. The amended rule defines a service provider as any person or entity that “receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to” the firm. An IT provider with administrative access to your computers and email is permitted access to everything in them, whether or not it touches client data day to day.
A vendor with access to your computers might as well be storing the data on its own machines. Treat the IT firm as a high-risk vendor in your inventory, which means due diligence, monitoring, and the 72-hour breach-notice expectation in 17 CFR 248.30(a)(5).
Do we need a separate security firm if we already have a compliance consultant?
No rule requires one. What Reg S-P and Rule 206(4)-7 require is that someone oversees the service providers and reviews whether the policies are working, and in our experience the compliance consultant usually isn’t doing the technical part. If your consultant checks MFA enforcement, reads the patch report, and keeps the restore test on file, you’re covered. If not, that work needs an owner.
That owner can be the CCO. The document list above is built so a CCO can run it personally. The real question is whether the CCO has the time and the technical judgment to read what comes back.
What’s the difference between an MSP vs. MSSP for RIAs, and where does a vCISO fit into the picture?
An MSP, a managed service provider, is a traditional IT provider, and the good ones stay in that lane. MSSP, managed security service provider, is an overloaded phrase these days because you can’t always tell whether it’s an MSP trying to sell the latest security products it saw at a trade show or a proper, separate company that focuses only on security.
A vCISO, or fractional CISO, is a fractional executive who oversees your cybersecurity program and is separate and distinct from your IT team. We’re a combination of a vCISO and a proper MSSP. The arrangement to look at carefully is the same company doing all three, because then nobody is checking the work.
Can our IT provider do our annual security review?
There has to be some level of RIA IT provider oversight. They can contribute to your annual security review, and they should, since they hold most of the evidence. But they shouldn’t be the only reviewer.
Rule 206(4)-7 requires the adviser to review, at least annually, the adequacy of its policies and the effectiveness of their implementation. An IT firm reviewing its own implementation is the unsupervised delegation the September alert faulted, and it’s the reason we stopped working through IT firms ourselves. Our SEC exam document request list covers what the annual review needs to show.
What does the SEC actually ask for regarding vendors?
Examiners want written vendor-oversight procedures and the most recent completed review. Our SEC exam document request list covers the inventory columns they expect, and our Regulation S-P page covers the 72-hour notice log.
What if our IT company won’t give us the documents?
Ask what they can show instead. A screenshot of the console often does the job. Some IT firms treat their security policies as internal and will only walk through them on a call under an NDA, which is fine. In our experience the only time an IT provider has refused outright is when the document doesn’t exist, and that is the finding.
