🛡️ Add service-provider oversight standards

[JFWooten4]

Creates service-provider oversight procedures for Regulation S-P compliance under 17 CFR § 248.30(a)(5). The procedures should define how BlockTransfer conducts service-provider due diligence and monitoring, requires vendors to protect customer information, requires timely vendor notice of qualifying breaches, and ensures affected individuals receive any required notices.

Turnaround time and process discussed in #13 and out of scope.

Regulatory basis

Subsection (a)(3): response program

Written policies and procedures in paragraph (a)(1) of this section must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

Subsection (a)(5)(i): service-provider oversight

A covered institution's response program prepared in accordance with paragraph (a)(3) of this section must include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including to ensure that the covered institution notifies affected individuals as set forth in paragraph (a)(4) of this section.

The policies and procedures must be reasonably designed to ensure service providers take appropriate measures to:

• (A) Protect against unauthorized access to or use of customer information; and
• (B) Provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of such notification, the covered institution must initiate its incident response program adopted pursuant to paragraph (a)(3) of this section.

Subsection (a)(5)(ii): service-provider notice on behalf of covered institution

As part of its incident response program, a covered institution may enter into a written agreement with its service provider to notify affected individuals on the covered institution's behalf in accordance with paragraph (a)(4) of this section.

Subsection (a)(5)(iii): covered institution remains responsible

Notwithstanding a covered institution's use of a service provider in accordance with paragraphs (a)(5)(i) and (ii) of this section, the obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of this section rests with the covered institution.

Subsection (d)(6): customer information systems

Customer information systems means the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information to maintain or support the covered institution's operations.

Subsection (d)(10): service provider

Service provider means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.

Changes to be made

• Create written service-provider oversight procedures for vendors that receive, maintain, process, or otherwise have access to customer information.
• Define vendor due diligence procedures before onboarding service providers with access to customer information.
• Define ongoing monitoring procedures for service providers that maintain customer information systems or otherwise access customer information.
• Add contractual or written-agreement requirements requiring service providers to protect against unauthorized access to or use of customer information.
• Add a vendor breach notice requirement requiring service providers to notify BlockTransfer as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system maintained by the service provider.
• Define the process for initiating BlockTransfer's incident response program upon receipt of a service-provider breach notice.
• Define when a service provider may notify affected individuals on BlockTransfer's behalf.
• Clarify that BlockTransfer remains responsible for ensuring affected individuals are notified under Subsection (a)(4), even when a service provider sends the notice.
• Cross-reference the separate incident response program, assessment procedure, customer notice procedure, vendor contract review, and transfer-agent recordkeeping workstreams.

[JFWooten4]

I accidentally did this on main in 66240bb and 6dfca42. I didn't force any initial contract language into the direct page, since I think that would be better drafted and sourced in the vendor proposal pages for each arrangement. They will have to specifically exclude an NDA as a baseline requirement, so that everything can be tracked through this public site (for our end, not the investor data).