A free tool from AnaConnectsYou

The Vendor File Check

Vendor oversight is where the paperwork is. Answer ten questions drawn from the service provider items in Regulation S P as amended in 2024, and see the state of your vendor file: what is in place, what is partial, and what is empty. Your answers stay in your browser. Nothing is sent, stored, or tracked, and no email is required.

The compliance date for smaller entities was June 3, 2026; for larger entities, December 3, 2025. Both dates have passed. This check describes the state of your file from your answers. It is not a compliance verdict, and it is not legal advice. Your compliance lead decides what the state of the file means.

Item 1 of 10

Vendor list current

Is there one current list naming every service provider that receives, maintains, processes, or can access your client information?

A service provider under the amended rule is any entity permitted access to customer information through the services it provides directly to your firm.

Item 2 of 10

Client data mapped

Has the firm mapped where its client information lives, including the information handled or maintained by providers on the firm's behalf?

The amended rule covers customer information in your possession and information handled or maintained by you or on your behalf.

Item 3 of 10

Due diligence recorded

Is the due diligence behind each provider's selection written down, with the contract or agreement kept on file?

Oversight under the amended rule runs through due diligence and monitoring, and the documentation of provider contracts is part of the written record.

Item 4 of 10

Monitoring on a cycle

Is each provider monitored on a set cycle, with the review and its date recorded in the file?

Due diligence alone is not the whole duty. The amended rule pairs it with ongoing monitoring of service providers.

Item 5 of 10

72 hour breach notice confirmed

Has each provider confirmed, in writing, that it will notify your firm as soon as possible and no later than 72 hours after becoming aware of a breach of a client information system it maintains?

Your oversight policies must be reasonably designed to ensure providers give that notice within the 72 hour window.

Item 6 of 10

Protection measures in writing

Do your agreements or your file record the measures each provider takes to protect against unauthorized access to or use of client information?

The amended rule asks your oversight policies to ensure providers take appropriate measures to protect against unauthorized access to or use of customer information.

Item 7 of 10

Incident response program written

Does the firm have a written incident response program, designed to detect, respond to, and recover from unauthorized access to or use of client information?

The amended rule requires the written program itself, covering detection, response, and recovery.

Item 8 of 10

Investigation step written

Does the program include a written investigation step, so any decision that customer notice is not required rests on a reasonable investigation of the facts?

Notice may be withheld only after a reasonable investigation supports the determination that sensitive customer information has not been and is not reasonably likely to be used in a way that results in substantial harm or inconvenience.

Item 9 of 10

Customer notice path ready

Is there a ready path to notify affected customers as soon as practicable and no later than 30 days after the firm becomes aware of unauthorized access to or use of their information?

The 30 day outer limit runs from when the firm becomes aware. A path that has never been written down or assigned is rarely ready when it is needed.

Item 10 of 10

Written records kept

Does the firm keep the written records that document all of this, including its written policies for the proper disposal of client and consumer information?

The amendments require written records documenting compliance, and written policies and procedures for proper disposal.

0 of 10 answered

The next step

Verify maps the file for real

This check works from your answers. Verify works from the record: we map your systems and vendors, fix what is broken, and hand your compliance lead a signed record with every source named, in 24 to 72 hours. Checking your systems runs only with your written permission.

Start Verify, $2,299

The other free path

One Task Plan, free

Name one task that eats your week and receive a written plan for it by email in 1 business day, signed by Ana. Free, and no call. If the task is the vendor file, say so and the plan starts there.

Get the free One Task Plan

Questions this check raises

What does the Vendor File Check do?

It asks ten questions drawn from the service provider oversight items in Regulation S P as amended in 2024 and shows, from your own answers, which parts of your vendor file are in place, which are partial, and which are empty. Your answers stay in your browser and are never sent or stored.

Does the check store or send my answers?

No. The result is computed on this page from the answers you select. Nothing is transmitted, stored, or tracked, and there is no email gate and no signup.

Is the result a compliance verdict?

No. The result describes the state of your vendor file based on your answers. It is not a compliance verdict and it is not legal advice. Your firm's compliance lead decides what the state of the file means and what happens next.