What Will SEC Examiners Ask My IT Provider?
Updated: 18 hours ago
"Will examiners talk to our IT company?" We hear that question from chief compliance officers and principals at registered investment advisers, and the short answer is yes. The SEC's own Regulation S-P outreach materials list your IT managed service provider's contract among the documents requested, and name outsourced IT staff among the people interviewed.
That changes how you prepare. Your written policies still matter, but examiners want to hear how the controls actually run, from the people who run them.
24uNet is a cybersecurity-first managed IT firm serving RIAs and professional firms from Denver, Colorado, and College Station, Texas. Below is a plain checklist of what examiners ask your IT provider about, how to prepare together, and what a ready answer looks like.
THE SHORT VERSION
Yes. In Regulation S-P exams, SEC staff have requested the IT managed service provider contract and interviewed outsourced IT staff. Themes include MFA and conditional access, admin rights, endpoint monitoring, how access is revoked when someone leaves, and who detects and contains Microsoft 365 and firewall alerts. Prepare your CCO and IT provider to give the same answers.
Why your IT provider is on the exam list
The SEC's Technology Controls Program published a mock Regulation S-P examination for advisers. Two lines in it matter for anyone who outsources IT:
The initial document request includes the "Information Technology Managed Service Provider Contract."
The interview list names the CCO, the CIO, the CTO and "Outsourced Information Technology Staff." Interviews happen after examiners review your documents, in your office or virtually.
The mock firm is small: one office, seven employees, and it "Leverages Managed Service Provider for Information Technology Services." The SEC built its example around a firm like many of our clients.
What happens in real exams lines up. Key Bridge Compliance, a compliance firm that has sat in on these exams, reported in September 2026 that examiners "repeatedly moved from written policies to operational implementation." It reviewed two initial request letters from different SEC offices and found the lists "effectively matched," which suggests a coordinated approach. In an earlier exam, staff asked to interview "the individual most familiar with the firm's IT infrastructure." For many small advisers, that person works for the IT provider.
The questions examiners put to your IT provider
The themes below come from Key Bridge's report on exams it observed. Key Bridge says it restated and generalized them, so treat them as topics to prepare for, not the SEC's exact wording.
Question theme | What "ready" looks like | Security Baseline tie-in |
Where does client and firm information live? | A short written data map: which systems hold client information (Microsoft 365, CRM, custodian portals, file shares), cloud or on-premises, and who can reach each one. | Annual risk assessment that covers every system with client data |
MFA and conditional access | Where MFA is required, how conditional access rules are set, and a written list of any bypasses, exemptions or opt-outs, with the reason for each. | MFA on every account; legacy sign-in blocked |
Admin rights | Everyday staff don't have admin rights. A short, named list of who holds privileged roles and why. | Identity controls |
Remote and personal-device access | A plain description of how remote access is secured and what personal phones and laptops can reach. | No exposed remote desktop; VPN or zero-trust access with MFA |
Endpoint protection and monitoring | Which devices are protected, who watches them, and who receives the alerts. | Endpoint detection with 24/7 monitoring |
Offboarding | Written steps for removing access when someone leaves, plus the ticket or record that shows it happened. Describe your real timing honestly. | Offboarding and password manager controls |
Who handles Microsoft 365 and firewall alerts? | A named answer for who detects, receives, investigates and contains each kind of alert, and when someone at the firm is told. | Identity threat detection; managed firewall; written incident response plan |
Logs to reconstruct an incident | Which security logs are kept, for how long, and why that period was chosen rather than left at a default. | Retained security logs with enough history to scope an incident |
The alert question deserves extra attention
After the interview in one exam, Key Bridge reports, staff asked for a detailed explanation of "who detects, receives, investigates, and contains firewall, endpoint, and Microsoft 365 alerts, and when internal personnel are notified." The same follow-up asked the firm to confirm MFA is enforced, including any bypasses or exemptions.
"Our IT company handles it" won't hold up. Expect the next questions: who exactly, during which hours, and who at your firm gets the call. MFA alone doesn't settle it either, because attackers now get around standard MFA (here's why MFA isn't enough). That's why the question is really about what happens after someone signs in, which is the job of Microsoft 365 account takeover monitoring.
Vendor oversight still sits with the adviser
Your IT provider can supply facts, but the oversight program belongs to the firm: contracts, due diligence, periodic reviews, and how you track Regulation S-P's 72-hour service-provider notification requirement (one of the vendor themes Key Bridge lists). That's a bigger topic than this post. For the wider picture, see our page on financial services and RIA cybersecurity.
Want a walkthrough before an exam window? Book an independent security review, email sales@24unet.com, or call Denver (303) 468-5515 or College Station (979) 256-5100.
Documents examiners ask for that name your IT provider
The SEC's mock exam and Key Bridge's reports point to the same handful of documents. Have these ready before anyone asks:
The signed IT services contract. It's on the SEC's initial request list by name.
Org charts and reporting lines, including who at the firm supervises the outsourced provider.
Your incident response plan, plus the list of staff, vendors and contractors responsible for response activities. The mock exam asks for both.
Evidence of monitoring. The mock exam asks for a list of the tools that detect and monitor your network, and reports that confirm the monitoring happens. A high-level summary from your provider is the place to start.
Then expect a second round. Key Bridge describes the pattern as: initial request list, document production, examiner interview, then targeted supplemental requests. Oral answers turn into requests for written proof. The progression runs from describing the control, to who owns it, how it operates, how compliance oversees it, how you know it works, and finally the evidence.
How to prepare this week (CCO + IT provider tabletop)
You don't need a 40-page memo. You need one working session.
Get the right people together. The CCO, a principal, and the IT lead from your provider, in one room or on one call.
Walk the table above out loud. For each theme, write a one-sentence answer everyone agrees is true today.
Pull the paperwork. The signed IT contract, the incident response plan, MFA evidence (including any exceptions list), and a simple summary of where client data lives.
Agree who speaks first on each theme. Consistent answers from compliance, management and IT matter as much as the answers themselves.
Schedule a short refresh before any known exam window, and whenever your systems or provider change.
How this ties to a Security Baseline you can show
Examiners keep asking the same thing in different ways: what is the control, and how do you know it works? Our 24-line Security Baseline is built to make those answers easy to give. It covers MFA and conditional access, offboarding, endpoint monitoring, and identity threat detection that watches what accounts do after they sign in. It also includes a yearly risk assessment, external vulnerability scan and restore test, which produce the written evidence examiners ask for.
The SEC's mock exam asks for your program to "Detect, Respond to, and Recover from" unauthorized access. Recovery includes getting your Microsoft 365 data back, so it's worth asking: does Microsoft 365 back up your data?
To be clear, this is operational readiness. It isn't a certification, and nobody can promise an exam outcome.
There are two ways to work with us. Some firms engage us for specific services under a service authorization. Others put IT and security under one master service agreement, with every Baseline line from day one; that's our Cybersecurity Business Bundle.
Frequently asked questions
Will the SEC interview my IT provider?
Yes, it can. The SEC's Regulation S-P outreach materials list outsourced information technology staff among the people interviewed, and list the IT managed service provider contract among requested documents.
What will SEC examiners ask my IT provider?
Themes reported from recent exams include where client information lives, MFA and conditional access, admin privileges, endpoint monitoring, how access is revoked when someone leaves, and who detects and contains Microsoft 365 and firewall alerts.
Does Reg S-P require me to use a managed IT provider?
No. Many small advisers do. If you outsource IT, expect examiners to understand that relationship in writing and in interviews.
What documents about my IT provider should I have ready?
At minimum: the signed IT services contract, clarity on who owns cybersecurity decisions, your incident response plan (and who does what), and evidence you can explain how MFA, access, and monitoring work day to day.
Who should sit in the interview?
Plan for consistent answers from the CCO, management, and whoever runs the technology environment — including the outsourced IT lead when that is your model.
Is this the same as a full Reg S-P readiness guide?
No. This post covers the IT-provider interview. Firm-wide policies, customer notice, and vendor oversight belong on a broader exam-readiness page.
Can 24uNet sit with us for exam prep?
We can walk CCOs and principals through how our clients' environments are run and documented. Call Denver (303) 468-5515 or College Station (979) 256-5100, or book a review at /secure-your-network.
Ready for the interview? Talk it through with us
The best time to find a gap is before an examiner does. In a security review, we can walk your CCO and principals through the themes in this post, look at how your Microsoft 365, devices and alerts are actually set up, and show you in writing where your answers are solid and where they need work.
Prefer to talk? Call Denver (303) 468-5515 or College Station (979) 256-5100.
Related reading: How Cybersecurity Technology Solves the Top 3 Pain Points of Wealth Management Firms; How Wealth Management Firms Can Solve Client Retention and Fee Compression Challenges.
ABOUT THE AUTHOR
Dane Gray, CEH, CompTIA Security+ — Cofounder, 24uNet. Dane has 30+ years in IT and cybersecurity and is a Cyber AB Registered Practitioner. He leads independent security reviews and SEC exam prep for RIAs and broker-dealers from 24uNet's offices in Commerce City, CO 80022 and College Station, Texas. Connect with Dane on LinkedIn.
Last reviewed: October 7, 2026
General information, not legal advice. Talk to your CCO or counsel about your Regulation S-P program.
Comments