How Should Investment Firms Coordinate a Cyber Incident Response with Their Technology Providers?

Agree on who leads, what providers communicate, and who can authorize action before an incident puts those arrangements to the test.

Investment firms and their technology providers need to agree on how they will work together during a cyber incident, when delays or unclear responsibilities can make containment and recovery more difficult. Investment firms can prepare by assigning a firm-level lead, agreeing on escalation procedures with technology providers, and establishing who can authorize actions that will affect employees' ongoing work. When an incident occurs, technical responders need established methods to share what they know, what remains uncertain, and which decisions require the firm's involvement.

Consider a hypothetical investment firm whose managed IT provider detects suspicious activity in the email account of an employee who prepares investor reports. The provider restricts access under its agreed authority and alerts the firm. Responders have not yet established which messages someone accessed, but the account contains correspondence and attachments that include customers' personal financial information.

The firm now faces several connected decisions. The COO needs to understand whether employees can continue working. Compliance representatives and legal advisers need facts about the information involved. Technical responders may need records from the email platform operator.

Effective coordination helps these participants act on the same information while carrying out their distinct responsibilities. Firms can prepare by agreeing with providers on how those decisions will work and rehearsing them together.

Establish who leads the firm's response

The person coordinating the firm's response needs a clear counterpart at the technology provider. Both should understand their authority, the decisions they must escalate, and who takes over if either becomes unavailable.

At the hypothetical firm, the COO coordinates the internal response, while the provider's technical lead directs the investigation and containment work. The COO brings in business owners, compliance representatives, and legal advisers as needed. The provider explains its findings and identifies actions requiring authorization or assistance.

These roles involve different decisions. Technical responders may recommend restricting an account or investigating another system. The business owner responsible for investor reporting can explain how a restriction affects the team's deadline. Legal advisers and compliance representatives assess the implications of the information available.

NIST's incident response guidance describes responsibilities across leadership, technical personnel, business owners, legal advisers, and third parties. It also emphasizes defining provider responsibilities, information sharing, and authority to act. Firms can use that guidance to establish an arrangement suited to their organization and contracted services.

A firm's incident lead should maintain an up-to-date view of the response: what responders have established, what each participant is doing, and which decisions remain open. A shared action record helps prevent an unresolved question from passing between teams without anyone taking responsibility.

Agree on escalation before the first alert

A provider's initial alert should reach someone who can act. Firms need primary and backup contacts, an after-hours escalation route, and an alternative communication method if responders suspect the usual email system is compromised.

In the hypothetical incident, the provider cannot reach the COO immediately. Its responder calls the designated alternate, who begins coordinating the firm's response. Because the firm and provider agreed on that route in advance, the responder knows whom to contact next.

The first update does not need to explain everything. It should establish what the provider observed, when it observed it, and what it has already done. The responder should also state what remains unknown and identify any immediate decision the firm must make.

For example, the provider may know that someone accessed the account from an unfamiliar location and that it has restricted further access. The provider may still need to determine whether the activity involved other accounts or unauthorized access to customer information.

The firm's incident lead and provider should agree on the next update and who will receive it. A consistent contact and update process helps leaders track changes without asking responders to repeat the same explanation separately to several people.

When reviewing third-party cyber risk, firms should examine these communication arrangements alongside their providers' preventive controls. During an incident, the firm's designated contacts need a reliable way to reach the provider's responders and escalate decisions requiring urgent attention.

Obtain the facts needed for decisions

The firm and its providers also need a shared account of events that distinguishes confirmed findings from working assumptions.

Technical responders should record the suspicious activity they observed, the actions they took, and the questions they are investigating. The firm can contribute information about the employee's responsibilities, the work conducted through the account, and the types of records it may contain.

For the email incident, the provider might establish when the suspicious access began and which account was involved. The reporting owner may explain that employees used the account to exchange documents containing personal financial information. Together, those findings help responders identify what to investigate next.

Available records may leave gaps. The provider might confirm unauthorized account access without being able to establish whether particular files were downloaded. The incident lead should record that uncertainty, identify who will investigate it, and explain it to the people making decisions.

Firms should also understand which records their provider can obtain directly and which require another organization's involvement. A managed IT provider may need assistance from an email-platform operator or another service provider. The firm may need to authorize a request or supply information before that work proceeds.

Shared cloud dependencies create complexity in this area. Several services may rely on the same platform, requiring response tasks that cross contractual boundaries. Before an incident, the technology lead should confirm who requests assistance from each provider and how the firm will escalate an unresolved request.

As the investigation develops, the incident lead should ensure that participants work from the latest assessment. An early assumption about one employee's account may need revision if responders find additional activity.

Coordinate containment with the work employees must complete

Containment can interrupt business activity. Firms and providers should agree in advance on which protective actions responders may take immediately and which require authorization from a designated firm representative.

Those arrangements should account for urgency. A responder who has authority to restrict a compromised account can act within that authority and promptly explain the consequences. A proposed action affecting a wider group of employees may require escalation to someone who can assess the business impact and authorize the disruption.

In the hypothetical firm, the affected employee needs to complete time-sensitive reporting work. The reporting owner explains what is due, what information the employee needs, and whether colleagues can take over part of the task.

Technical responders then assess whether staff can use an approved alternative while the investigation continues. Any workaround needs appropriate access controls and information that employees can trust.

Before restoring access, the provider should explain what it has checked, what remains unresolved, and whether further restrictions are necessary. The firm's authorized decision maker should review that assessment alongside the reporting owner's business requirements before approving restoration.

Testing disaster recovery arrangements can help firms establish how employees would resume critical work after a disruption. Incident response also involves investigating possible information exposure and supporting related decisions. Restored access does not, by itself, resolve those questions.

Give legal and compliance advisers the information they need

Compliance representatives and legal advisers should become involved early enough to identify the facts they need. Their questions can help the incident lead direct information requests while technical work continues.

For the email incident, they may need to understand whose information was present, what kinds of information the account contained, and what responders know about unauthorized access. They also need to know where the evidence remains incomplete.

For institutions covered by the SEC's amended Regulation S-P, the incident response requirements include assessing incidents, containing and controlling them, and providing required notices. The SEC also distinguishes notifications sent from service providers to the institution from the institution's notification responsibilities to affected individuals. A provider may assist with notices under an agreement, but the covered institution retains ultimate responsibility.

The requirements apply to specified institutions, including SEC-registered investment advisers. The firm's advisers should assess applicability, timing, and any other obligations relevant to the particular incident.

The incident lead supports that assessment by bringing together the available facts and assigning follow-up questions. Technical responders should distinguish confirmed findings from unresolved questions so advisers can assess the available evidence and identify any further information they need.

The firm should document the basis for its decisions and update the record as new information becomes available. A decision made earlier in the response may require reconsideration after additional findings.

Test the response arrangements together

A joint exercise allows the firm and its providers to work through their responsibilities before an actual incident. The most revealing discussions often concern decisions that require several participants to act in sequence.

Rehearse decisions with incomplete information

The email scenario provides a practical starting point. Ask the provider to explain its first actions and alert. Then ask the firm's incident lead whom they would involve and what they would need to decide.

Introduce a complication, such as an unavailable primary contact or records that require another provider's assistance. The participants can examine how they would proceed, who would authorize the next action, and how they would communicate uncertainty.

Business owners should participate where the scenario affects their work. Their involvement helps technical responders understand the consequences of restricting access and the requirements for an acceptable workaround.

Assign responsibility for gaps

Before concluding the exercise, the firm's incident lead and provider should assign an owner to each agreed improvement. The technology lead might need to update escalation contacts or clarify an administrator's permissions. A provider may need to explain how it obtains records from an upstream platform. The reporting owner may need to review an alternative way to complete time-sensitive work.

Each owner should have a completion date. Where an improvement changes how participants would respond, the firm should check the revised arrangement with the relevant provider.

Keep a record of what changed

Retain the scenario, important decisions, and completed improvements. Leaders can use that record to assess whether the firm addressed the gaps participants identified.

Preparing IT and security evidence for investor due diligence may also involve explaining how the firm rehearses its response arrangements. A summary of exercises and improvements can support that discussion without requiring routine disclosure of sensitive investigation details.

Leaders have a stronger basis for assessing their firm's preparedness when the people responsible have practiced working together and addressed the gaps they identified. Clear authority, accessible facts, and tested communication arrangements help leaders make decisions when the incident is real.

How Option One Technologies can help

Option One Technologies' managed IT, cybersecurity, and cloud services can support investment firms as they review how their internal teams and technology providers work together. Contact a member of our team to discuss your firm's incident response coordination and technology-provider responsibilities.

Executive FAQs

Who should lead an investment firm's response when a provider detects an incident?

The firm should designate an internal incident lead and an alternate. That person coordinates business decisions and internal participants, while the provider's technical lead directs the work within its agreed responsibilities.

What should a provider include in its first incident alert?

The alert should explain what responders observed, when they observed it, and what action they have taken. It should also identify key uncertainties, decisions that require the firm's involvement, and when the next update will arrive.

Can an investment firm delegate customer notification to a provider?

For covered institutions under amended Regulation S-P, a provider may assist with notification under an agreement. However, the institution remains ultimately responsible, and its compliance representatives and legal advisers should assess the applicable requirements.