Vendor and Third-Party Risk for Mid-Size Firms: The 2023 Interagency Guidance, NIST SP 800-161 and CSF 2.0

Your security is partly someone else's

A mid-size firm rarely hosts everything itself. Email sits with one provider, files with another, payments with a third, the practice or case system with a fourth, and an outside team manages the network. When one of them has an outage or a breach, you feel it, and in most regulated settings you remain accountable for it. A vendor's failure does not move your obligations to the vendor.

This is why regulators, NIST and cyber insurers all ask the same question: do you know your third parties, and do you manage the risk they bring? The question is not limited to banks. The bank guidance is the most detailed public text, so it makes a useful model. NIST's frameworks give a version any organization can use.

The 2023 interagency guidance

On June 6, 2023, the OCC, the Board of Governors of the Federal Reserve System and the FDIC issued the final Interagency Guidance on Third-Party Relationships: Risk Management (published in the Federal Register on June 9, 2023). OCC Bulletin 2023-17 introduced it and rescinded OCC Bulletin 2013-29 and OCC Bulletin 2020-10. The OCC states that it applies to all banks with third-party relationships, community banks included.

The bulletin gives three points. The guidance outlines the third-party risk management life cycle and the principles for each stage. It clarifies that not all third-party relationships present the same level of risk or criticality to a bank's operations. And it asks banks to apply sound practices that fit their risk profile and complexity, and the criticality of the activity the third party supports. The idea of proportion is the useful part for any mid-size firm.

A 2026 proposal to replace it

On September 15, 2026, the OCC, the Board, the FDIC and, for the first time in this guidance, the NCUA published proposed third-party risk management guidance in the Federal Register and invited comments until November 16, 2026. The agencies plan to rescind and replace existing guidance. They say the principles-based approach of the 2023 guidance remains relevant. But they say it has often been interpreted too broadly and without enough tailoring.

The proposal describes three problems. Organizations read the 2023 text as a one-size-fits-all checklist. The focus on "critical activities" looks at what the third party does rather than the likelihood and size of harm in the relationship. And the word "should" in examples was taken as a prescriptive requirement. The proposal puts risk identification and assessment first, and it says tailored oversight lets banks focus on material financial risks and legal violations instead of check-the-box work.

Other details in the proposal are useful. It treats a third-party relationship as an arrangement for products, services or activities, and notes that such relationships typically involve written agreements. It says that using subcontractors alone does not typically create an independent relationship or a presumption of direct oversight of the subcontractor. It also states that banking organizations include insured credit unions. The text is a proposal. Do not treat it as final. The practical advice here holds under either version.

CSF 2.0 gives non-banks the same map

NIST's Cybersecurity Framework 2.0 (NIST CSWP 29, February 26, 2024) added a Govern function. Within it, the category Cybersecurity Supply Chain Risk Management (GV.SC) lists ten outcomes:

• GV.SC-01: a supply chain risk management program, strategy, objectives, policies and processes are established and agreed to by stakeholders.
• GV.SC-02: security roles and responsibilities for suppliers, customers and partners are established and communicated.
• GV.SC-03: supply chain risk management is integrated into cybersecurity and enterprise risk management.
• GV.SC-04: suppliers are known and prioritized by criticality.
• GV.SC-05: requirements to address supply chain risks are established, prioritized and integrated into contracts and other agreements.
• GV.SC-06: planning and due diligence are performed before entering into relationships.
• GV.SC-07: the risks of a supplier, its products and services, and other third parties are understood, recorded, prioritized, assessed, responded to and monitored over the relationship.
• GV.SC-08: relevant suppliers are included in incident planning, response and recovery.
• GV.SC-09: supply chain security practices are integrated into cybersecurity and risk programs and monitored over the product and service life cycle.
• GV.SC-10: plans include provisions for activities after a partnership or service agreement ends.

Read as a list, it matches the bank life cycle: know, plan, choose, contract, monitor, respond, exit. A mid-size firm that can show a short, working answer to each of the ten is ahead of most.

NIST SP 800-161 Rev. 1 for the detail

NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, was published in May 2022. NIST's page notes it includes updates as of November 1, 2024, and a December 2025 note that a fillable version of the SCRM Assessment Scoping Questionnaire (Table 26) is available. NIST says the publication helps organizations identify, assess and mitigate cybersecurity risks across the supply chain at all levels, and integrates that work into risk management through strategy, policy, plans and risk assessments for products and services.

The document is long and written for large enterprises and federal agencies. Use it as a reference, not as a form to complete. A mid-size firm can take three ideas from it. Treat supply chain risk as part of normal enterprise risk management. Scale the effort to the criticality of the supplier. And look at products and software as well as service companies.

A program that fits a firm of 20 to 500 people

Here is a short routine that follows the sources without drowning a small team.

• Inventory. List every vendor with access to your data, systems or customers, or that your operations depend on. Include software-as-a-service tools bought on a company card. Check accounts payable and single sign-on logs to find the ones nobody told IT about.
• Tier. Put each vendor in one of three tiers by what happens if it fails or is breached: critical (operations stop or regulated data is exposed), important, and low. This is GV.SC-04. The 2026 proposal's lesson applies: rank by the likelihood and size of harm, not only by the type of service.
• Check before you sign. For critical vendors, ask for independent assurance (a recent audit report or certification), a summary of security controls, their incident history and response process, their use of subcontractors, and where data is stored. For low-tier vendors a short questionnaire or a review of public information is enough.
• Put security in the contract. For critical vendors, include incident notice with a fixed time and named contacts, breach cooperation, data location and handling, subcontractor flow-down, the right to receive assurance reports, return and deletion of data at exit, and business continuity commitments. For regulated firms, add whatever your regulator requires.
• Monitor. Review critical vendors on a schedule and when something changes: a breach notice, a merger, a new subprocessor, a major outage. Track whether they still hold the certifications they promised. Keep vendor logins under your single sign-on and multi-factor authentication where possible.
• Include vendors in incident planning. Know how you reach each critical vendor at 3 a.m., who has authority, and what you will do if a vendor is down for a day. Test one of these in a tabletop exercise each year.
• Plan the exit. For each critical vendor, know how to export your data in a usable format, how long a replacement would take, and what you would run in the meantime. Concentration risk matters too: if one cloud or one identity provider holds everything, note it as a risk.

Where incident rules meet vendors

For banks and credit unions, vendor risk and incident reporting are linked. The 2021 interagency rule requires bank service providers to notify affected banks when an incident has materially disrupted covered services for four or more hours, and the NCUA rule treats a compromise at a cloud provider, credit union service organization or other third-party data host as one of the reportable outcomes. A contract that does not match these timelines leaves the institution surprised by its own regulator clock. See our companion article on the 36‑hour and 72‑hour rules.

Common mistakes

• Treating the questionnaire as the control. A completed form is a record of what a vendor says. Ask for evidence for the vendors that matter.
• Reviewing once at signing. Risk changes during the life of a contract.
• Ignoring small tools. A scheduling app that holds client contact data can be as sensitive as a large system.
• Applying the same review to everyone. It burns the team's time on low-risk vendors and leaves less for the ones that count.
• Having no exit. A firm that cannot leave a vendor has no negotiating position.

How we help

Clayton Secure is our service for running an ongoing cybersecurity program for a client. Vendor risk is a natural part of it: building the inventory, setting the tiers, drafting the questions and contract terms for your counsel to review, and keeping a register that your leadership can read in a few minutes. We can also run the technical side: single sign-on and multi-factor authentication for vendor access, log review, and restore tests for data held by others.

Sources

• OCC — Bulletin 2023-17: Third-Party Relationships: Interagency Guidance on Risk Management (June 6, 2023)
• Federal Register — Proposed Third-Party Risk Management Guidance (OCC, Board, FDIC, NCUA), September 15, 2026; comments due November 16, 2026
• NIST — The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024)
• NIST CSRC — SP 800-161 Rev. 1 Upd. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
• Federal Register — Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers (November 23, 2021)

This article is general information, not legal or compliance advice. The interagency guidance applies to the banking organizations it names; for other firms it is a model, not a requirement. The September 2026 text is a proposal and may change before it is final. Check the current text and your own regulator before relying on it. Last reviewed November 8, 2026.

Keep reading

Next · SecurityPCI DSS 4.0.1 for Small Merchants: What Changed, What Is Now Required, and How to Cut ScopePCI DSS v4.0.1 is the only active version of the card-security standard. The requirements that were best practices until March 31, 2025 are now mandatory in every assessment. For a small merchant the work depends on the Self-Assessment Questionnaire that applies. This article explains the version history, the changes that reach small businesses, what the SAQ types mean, and how to reduce what you must protect.9 min read

• Penetration Testing Explained for Executives: Scope, Reports and How Often to Test8 min
• Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide9 min