Skip to content

Control 2.7: Vendor and Third-Party Risk Management

Control ID: 2.7
Pillar: Management
Regulatory Reference: GLBA Section 501(b), SOX Section 404, FINRA Rule 4511, FINRA Rule 3110, FINRA Regulatory Notice 24-09, SEC Rule 17a-4(f), OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Fed SR 26-2 (formerly SR 11-7), OCC Bulletin 2013-29, Interagency Guidance on Third-Party Relationships (FRB/FDIC/OCC, June 2023), OWASP LLM Top 10 (2025)
Last UI Verified: May 2026
Governance Levels: Baseline / Recommended / Regulated

Last Verified: 2026-11-06 — technical documentation only; no tenant UI, screenshots, API execution, or compliance reassessment. Historical Last UI Verified is unchanged.

Objective

Establish a comprehensive framework for identifying, assessing, and managing risks associated with third-party vendors and connectors used by AI agents. Vendor risk management addresses the unique risks introduced by Power Platform connectors, custom APIs, external AI services, and dynamic tool loading.

Why This Matters for FSI

Regulation How this control supports it
Interagency Guidance on Third-Party Relationships (FRB/FDIC/OCC, June 2023) Establishes lifecycle expectations (planning, due diligence, contract negotiation, ongoing monitoring, termination) that...
OCC Bulletin 2013-29 / Bulletin 2020-10 FAQs Third-party risk management expectations for national banks, including risk-tiered due diligence and ongoing monitoring
OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Fed SR 26-2 (formerly SR 11-7) Treat third-party AI/LLM providers as part of the model supply chain; vendor change can constitute a model change requiring...
GLBA Section 501(b) (16 CFR Part 314 Safeguards Rule) Requires service-provider oversight, written contracts, and periodic assessment for any vendor handling customer information
SOX Section 404 Internal controls over financial reporting extend to vendor-provided services that influence reportable processes; SOC 1/SOC 2...
FINRA Rule 3110(a) Supervisory system must reasonably address risks introduced by third-party tools used in business communications and recordkeeping
FINRA Rule 4511 / SEC Rule 17a-4(f) Books-and-records vendors (archiving, WORM) supporting AI-generated content must meet electronic recordkeeping requirements;...
FINRA Regulatory Notice 24-09 / Rule 3110 Reinforces that AI-generated communications are subject to existing recordkeeping and supervision rules — vendor capability gaps...
OWASP LLM Top 10 (LLM03 Supply Chain, LLM05 Improper Output Handling, LLM07 Insecure Plugin Design) Identify supply-chain, plugin, and tool-loading risks unique to LLM-backed agents
Regulatory mapping — click to expand
  • Interagency Guidance on Third-Party Relationships (FRB/FDIC/OCC, June 2023): Establishes lifecycle expectations (planning, due diligence, contract negotiation, ongoing monitoring, termination) that supervised institutions are expected to apply to AI/connector vendors
  • OCC Bulletin 2013-29 / Bulletin 2020-10 FAQs: Third-party risk management expectations for national banks, including risk-tiered due diligence and ongoing monitoring
  • OCC Bulletin 2026-13 (formerly OCC Bulletin 2011-12) / Fed SR 26-2 (formerly SR 11-7): Treat third-party AI/LLM providers as part of the model supply chain; vendor change can constitute a model change requiring re-validation
  • GLBA Section 501(b) (16 CFR Part 314 Safeguards Rule): Requires service-provider oversight, written contracts, and periodic assessment for any vendor handling customer information
  • SOX Section 404: Internal controls over financial reporting extend to vendor-provided services that influence reportable processes; SOC 1/SOC 2 reporting helps support attestation
  • FINRA Rule 3110(a): Supervisory system must reasonably address risks introduced by third-party tools used in business communications and recordkeeping
  • FINRA Rule 4511 / SEC Rule 17a-4(f): Books-and-records vendors (archiving, WORM) supporting AI-generated content must meet electronic recordkeeping requirements; recent amendments (effective May 2023) accept audit-trail alternatives but still require demonstrable immutability
  • FINRA Regulatory Notice 24-09 / Rule 3110: Reinforces that AI-generated communications are subject to existing recordkeeping and supervision rules — vendor capability gaps become firm-level deficiencies
  • OWASP LLM Top 10 (LLM03 Supply Chain, LLM05 Improper Output Handling, LLM07 Insecure Plugin Design): Identify supply-chain, plugin, and tool-loading risks unique to LLM-backed agents

No companion solution for this control — see the Solutions Index for the full companion-solution catalog and coverage scope.

Control Description

AI agents frequently connect to external services, APIs, and data sources that may introduce security vulnerabilities, compliance gaps, or operational dependencies:

Capability Description FSI Application
Connector Inventory Catalog all third-party connectors Regulatory examination readiness
Vendor Risk Assessment Evaluate vendor security and compliance Interagency Guidance requirements
Contract Management Security clauses and SLAs Contractual protections
Dynamic Tool Governance Control runtime plugin loading OWASP supply chain risk
Ongoing Monitoring Continuous vendor oversight Emerging risk detection

Connector Risk Categories

Category Examples Risk Level Assessment Frequency
Microsoft First-Party Dataverse, SharePoint, Teams Low Annual
Certified Third-Party Salesforce, SAP, ServiceNow Medium Semi-annual
Independent Publisher Community connectors High Quarterly
Custom Connectors Organization-built APIs Medium-High Quarterly
External AI Services OpenAI, third-party LLMs High Quarterly

FSI-Specific Vendor Categories

Financial services organizations typically integrate with specialized vendors. Include these categories in your vendor risk assessment:

Vendor Category Example Vendors Key Assessment Areas
Archiving/WORM Storage Smarsh, Global Relay, Proofpoint Archive, Bloomberg Vault SEC 17a-4 attestation, immutability certification, AI content support
Communication Compliance Theta Lake, NICE Actimize, Behavox AI interaction capture, FINRA Rule 4511 / RN 24-09 recordkeeping support, review workflow
Identity Verification Jumio, Onfido, IDology Synthetic identity detection, deepfake detection, KYC support
LLM/AI Providers Azure OpenAI, Amazon Bedrock, Anthropic Data residency, training data policy, SOC 2 certification
Copilot Plugins Third-party M365 Copilot plugins Data access scope, permission requirements, publisher verification
MCP Tool Providers Custom MCP server implementations API security, data handling, logging capabilities

Model provider and route-specific evidence

Copilot Studio supports primary model selection on Overview → Model. Model names, GA/preview/experimental status, regional availability and retirements vary; use the current model matrix, not a blanket “ChatGPT-5 and Claude are GA” assertion. Preview/experimental models are not intended for production.

Anthropic is a Microsoft subprocessor, not a Microsoft first-party provider. Microsoft Product Terms/DPA cover applicable Claude routes, but Anthropic models with Data Retention require separate enablement and Anthropic terms, with Anthropic acting as an independent processor. Verify the selected route, access, processing and retention commitments (Anthropic guidance). External provider access in Microsoft 365 and PPAC environment/group controls are separate (external model settings). Native selection does not make every provider's terms, certification or residency coverage identical.

MCP clarification: MCP is an open protocol supported natively by Copilot Studio, including prebuilt Microsoft MCP connectors and custom/third-party servers (MCP integration). Classify risk by publisher, hosting operator, downstream service and data, not protocol alone. ACP supports MCP server-level blocking, not individual MCP tool controls; custom/HTTP/virtual connector gaps still need classic DLP (ACP limits).

Vendor Assessment Checklist for AI Integrations:

  1. Does the vendor support AI-generated content archiving per FINRA Rule 4511 / RN 24-09 recordkeeping requirements?
  2. Can the vendor distinguish AI-generated vs human-generated content in records?
  3. Does the vendor provide immutable storage (WORM) for AI interactions?
  4. What is the vendor's data residency and AI training policy?
  5. Does the vendor have SOC 2 Type II attestation covering AI services?

Key Configuration Points

For registered Microsoft 365 plugins/MCP servers, distinguish publisher-category and individual-plugin availability from server Block / Unblock under Agents → Tools → Registry. Agent 365 individual-tool controls are rolling out for supported server types, not universal ACP granularity. Blocking a plugin leaves its MCP server available to other plugins unless the server is separately blocked (current plugin/MCP controls). Verify tenant support and the actual hosting route.

  • Maintain complete inventory of all third-party connectors with risk classifications
  • Apply the Interagency Guidance on Third-Party Relationships: Risk Management (FRB/FDIC/OCC, June 2023) lifecycle stages to every Zone 2/3 AI / connector vendor: planning → due diligence and third-party selection → contract negotiation → ongoing monitoring → termination
  • Apply OCC Bulletin 2013-29 risk-tiered due-diligence depth (and the OCC Bulletin 2020-10 FAQs) to scope vendor assessment effort to the criticality of the connector or AI service; document the tiering decision per vendor
  • Require SOC 2 Type II (or equivalent) for Zone 3 vendors
  • Implement AI-specific contract clauses (model change notification, no training on customer data)
  • Apply organizational default-deny requirements through supported connector/server policies, agent tool selections and maker approvals; no universal Copilot Studio marketplace or tool auto-update switch is assumed. For MCP, turn Allow all off and approve only needed tools; newly added tools then default off.
  • Map transitive data exposure for tool chains invoking multiple third parties
  • Establish review cadence (monthly usage, quarterly performance, annual security) consistent with the Interagency 2023 Guidance ongoing-monitoring expectations
  • Document exit plans for critical vendor relationships, aligned to the Interagency 2023 Guidance termination-stage expectations

Zone-Specific Requirements

Zone cross-reference

Baseline = Zone 1 (Personal Productivity) · Recommended = Zone 2 (Team Collaboration) · Regulated = Zone 3 (Enterprise Managed). Zone requirements below correspond to the Governance Level in the control header.

Zone Requirement Rationale
Zone 1 (Personal) Maintain a connector inventory (refreshed at least annually); rely on Microsoft and verified-publisher connectors only; standard contract terms acceptable; no custom or independent-publisher connectors without exception approval Personal-productivity scope; limited blast radius but still subject to firm-wide DLP and recordkeeping obligations
Zone 2 (Team) Formal vendor questionnaire on intake; SOC 2 Type II (or ISO 27001 + bridge letter) recommended for non-Microsoft vendors; quarterly usage and risk review; documented business owner per connector; AI-specific contract clauses for any LLM-backed integration Shared agents extend data exposure across teams; FINRA 3110 supervisory expectations apply
Zone 3 (Enterprise) Comprehensive risk-tiered due diligence aligned to Interagency 2023 Guidance; SOC 2 Type II required (SOC 1 where financially material); continuous monitoring (telemetry, security advisories, financial health); contractual audit rights; documented and tested exit/contingency plan; board- or committee-level reporting; transitive data-flow map maintained Customer-facing or financially material; subject to OCC/Fed/SEC examination; vendor failure could constitute a recordkeeping or safeguards breach

Roles & Responsibilities

Role Responsibility
AI Governance Lead Owns vendor risk policy, tiering criteria, and AI-specific assessment standards for agent integrations
Power Platform Admin Maintains connector inventory, configures DLP/connector policies, restricts custom and independent-publisher connectors per zone
AI Administrator Governs Copilot Studio model providers, plugins, and MCP integrations; coordinates with vendor risk on AI provider changes
Procurement / Vendor Management Executes contract lifecycle, ensures SOC 2 / SOC 1 collection, manages renewals, exits, and subprocessor approvals
Security Team Performs technical security review (SOC 2 analysis, penetration test review, incident response posture) and continuous monitoring
Compliance Officer Confirms regulatory alignment (FINRA 3110/4511, SEC 17a-4, GLBA 501(b), Interagency 2023 Guidance); supports board/committee reporting
Model Risk Manager Treats third-party LLM/AI providers as model supply-chain elements; coordinates with Control 2.6 on vendor-driven model changes
Control Relationship
1.4 - Advanced Connector Policies Connector-level security and granular action controls
1.5 - DLP Policies Tenant-wide data protection that operationalizes vendor risk decisions
2.1 - Managed Environments Zone 2/3 organizational environment governance; required to block otherwise nonblockable connectors with ACP, not a prerequisite for every classic DLP restriction or a custom-connector creation switch
2.6 - Model Risk Management Vendor model changes are a model-risk trigger requiring re-validation
2.17 - Multi-Agent Orchestration Limits Agent-to-agent composition risks and transitive vendor exposure

Implementation Playbooks

Step-by-Step Implementation

This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

Verification Criteria

Confirm control effectiveness by verifying:

  1. Connector inventory is current (refreshed at least quarterly for Zone 2/3) and includes publisher type, business owner, environments, data classes, and risk tier
  2. SOC 2 Type II (or accepted equivalent) on file and within validity window for every Zone 2/3 third-party vendor; gaps tracked with compensating controls and risk-acceptance dates
  3. Vendor contracts for AI/LLM providers include the AI-specific clauses (model change notice, no-training-on-customer-data, AI incident notification, audit rights, data residency)
  4. Power Platform DLP policies block independent-publisher and unapproved custom connectors in Zone 2/3 environments by default; exception register is maintained and reviewed
  5. Transitive data-flow maps exist for every Zone 3 multi-tool agent and identify downstream subprocessors, residency, and recordkeeping coverage
  6. Quarterly vendor risk report is delivered to the AI governance committee (and board/risk committee where required); evidence retained per FINRA 4511 / SEC 17a-4 retention schedules
  7. Documented exit/contingency plan exists for every Zone 3 critical vendor, with at least one tabletop test in the prior 12 months

Additional Resources

Updated: November 2026 | Version: v1.6.2 | UI Verification Status: Needs Review (documentation-only verification; no tenant UI tested)