Description
This Regulation S-P Service Provider Due Diligence & Information Security Bundle combines our Sample WSP/CoE Package – Regulation S-P Policies & Procedures and our Due Diligence – Regulation S-P Service Provider Review Package.
- The Sample WSP/CoE Package – Regulation S-P Policies & Procedures is a collection of three compliance manual update sections centered around due diligence of service providers and information security, designed or updated in light of the SEC’s 2024 amendments to Regulation S-P. This package includes:
- Sample WSP/CoE – Information Security Plan, which is an example of an information security plan. It includes examples of physical and electronic safegaurds and an annual assessment.
- Sample WSP/CoE – Incident Response Program, which is an example of an investment adviser firm’s policy and procedure for investigating, containing, and communicating an incident involving an unauthorized access or use of customer information.
- Sampe WSP/CoE – Service Provider Due Diligence, which is a sample section of an investment adviser compliance manual describing the due diligence process when an investment adviser utilizes a service provider which will have access to client information.
- Due Diligence – Regulation S-P Service Provider Review Package is a collection of supplemental forms, checklists, and questionnaires to help evaluate and monitor cybersecurity and incident response risks associated with service providers. These materials are designed to scale due diligence based on the nature and type of the service provider, the sensitivity of data involved, and the level of access to customer or firm information. This package includes:
- Service Provider Due Diligence Glossary of Key Terms and Definitions, which is an internal guide providing plain-English definitions of key terms necessary to understand when completing the supplemental forms, checklists, and questionnaires.
- Service Provider Cybersecurity Due Diligence – Risk Rating Guide and Scorecard, which is an internal guide to support consistent evaluation of service provider cybersecurity risk and to document service provider oversight and monitoring under Regulation S-P (17 CFR 248.30(a)(5)) and related recordkeeping expectations.
- Tier 1 or Tier 2 Service Provider Cybersecurity & Incident Response Due Diligence Questionnaire, for lower risk vendors, as determined by the Scorecard. This questionnaire supports a risk-based approach to service provider oversight and helps ensure that service providers maintain appropriate safeguards consistent with the firm’s regulatory obligations and identity theft prevention objectives.
- Tier 3 or Tier 4 Service Provider Cybersecurity & Incident Response Due Diligence Questionnaire, for higher risk or critical service providers. This questionnaire gathers detailed information regarding security governance, incident detection and response capabilities, notification practices, and use of subcontractors.
- Service Provider Due Diligence Summary Memo Sample Template, which is a template for documenting initial and ongoing oversight (due diligence and monitoring) of service providers that have access to the firm’s customer information, supporting Regulation S-P safeguards and service provider oversight requirements.
- Cybersecurity – Best Practices Checklist, which is a checklist for cybersecurity and avoidance of identity theft.
- Bonus Recorded Webinar: Regulation S-P Amendments: Incident Response, Vendor Oversight & Compliance Implementation for Investment Advisers
All of this content is included with Bronze, Silver, Gold, Platinum & Titanium Annual Compliance Program packages. Initially posted in June 2026.


Reviews
There are no reviews yet.