Third-party risk regulations across finance, life sciences & defense

Finalized June 6, 2023, by the Board, FDIC and OCC and published at 88 FR 37920 on June 9, 2023, this guidance "replaces each agency's existing general guidance on this topic and is directed to all banking organizations supervised by the agencies." For OCC third party risk management expectations, the OCC third-party risk management bulletin is the operative document. It rescinds OCC Bulletin 2013-29 and the 2020 FAQs that supplemented it.

Five life cycle stages organize the work: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring and termination, under a governance layer of oversight and accountability, independent reviews, and documentation and reporting. Risk sets the depth. Critical activities, which the guidance characterizes as those that could "cause a banking organization to face significant risk if the third party fails to meet expectations" or "have significant customer impacts," get the most oversight.

• Due diligence evaluates "the volume and types of subcontracted activities and the degree to which the third party relies on subcontractors."
• Documentation includes "a current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors)."

Subcontractors are where most programs fall short. The agencies note in the preamble that the interagency guidance on third-party relationships does not expect a bank to assess every subcontractor of every third party, so write that proportionality into your tiering: critical ones get the look, the rest get the clause.

Principles come from the Interagency Guidance. Procedures come from the FFIEC IT Examination Handbook, which is what the IT examiner has open during the visit. Its Outsourcing Technology Services booklet, announced in OCC Bulletin 2004-32 on July 15, 2004, puts it plainly: "Outsourcing, however, does not reduce the fundamental risks associated with information technology or the business lines that use it," and oversight "will depend on the criticality of the service, process, or system to the institution's operation."

• Appendix J to the Business Continuity Planning booklet, "Strengthening the Resilience of Outsourced Technology Services" (FDIC FIL-9-2015, February 23, 2015), tests third-party management, third-party capacity, testing with third-party technology service providers, and cyber resilience.
• The Architecture, Infrastructure, and Operations booklet (OCC Bulletin 2021-30, June 30, 2021) replaced the July 2004 Operations booklet and carries sections on oversight of third-party service providers and on shadow IT.
• A February 2026 update, per the InfoBase notice read October 23, 2026, removed references to reputational risk consistent with Executive Order 14331 and creates no new requirements.

For ffiec third party risk management work, map each booklet section to evidence you already hold: the board-approved outsourcing policy, the resilience tests run with each technology service provider, and the inventory that shows no shadow IT.

Before DORA there were the eba outsourcing guidelines, EBA/GL/2019/02, published February 25, 2019. They apply "from 30 September 2019 to all outsourcing arrangements entered into, reviewed or amended on or after this date," with existing arrangements documented by December 31, 2021. They repealed the 2006 CEBS outsourcing guidelines and the EBA's 2017 cloud recommendations, and they still govern the non-ICT outsourcing DORA does not reach. Anyone who has built a DORA register will recognize the structure, because DORA borrowed it.

1. Section 4 defines critical or important functions and applies stricter requirements when they are outsourced.
2. Section 11 requires a register of all outsourcing arrangements.
3. Section 12 covers pre-outsourcing analysis, risk assessment and due diligence.
4. Section 13.1 governs sub-outsourcing of critical or important functions, which "requires ex ante notification" to the institution.
5. Section 15 requires exit strategies, including "a documented exit plan for each critical or important function to be outsourced."

Status is in motion. On October 23, 2026, the EBA's page for these guidelines showed a successor, the "Guidelines on the sound management of third-party risk related to non-ICT services," marked "Final and awaiting translation into the EU official languages" and "Not yet applicable," with a press release dated 18 September 2026 and no application date filled in. Once applicable, the page says, the new guidelines will repeal the Guidelines on outsourcing arrangements. Until then, EBA/GL/2019/02 is the text your supervisor is reading.

New York's cybersecurity regulation took effect March 1, 2017, and its second amendment took effect November 1, 2023. Section 500.1 defines a third-party service provider as a person that is not an affiliate or a governmental entity, provides services to the covered entity, and "maintains, processes or otherwise is permitted access to nonpublic information through its provision of services." That definition fixes the population your policy must cover. Section 500.11(a) then requires written policies and procedures, based on your risk assessment, addressing four things:

1. "the identification and risk assessment of third-party service providers"
2. the "minimum cybersecurity practices required to be met" by them to do business with you
3. the due diligence used to evaluate the adequacy of those practices
4. "periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices"

Section 500.11(b) adds guidelines on each provider's access controls, including multi-factor authentication under 500.12, its encryption under 500.15, and the notice it owes you after a cybersecurity event.

What makes nydfs part 500 different is the clock in 500.17(a)(1): notice to the superintendent "as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider." Your vendor contract's notification window has to leave room to meet that.

GxP is the family name for good manufacturing, clinical, laboratory and distribution practice, and on outsourcing the texts speak with one voice. EU GMP Chapter 7, "Outsourced Activities," revised in view of ICH Q10 with a deadline for coming into operation of January 31, 2013, opens with the principle that any outsourced GMP activity "should be appropriately defined, agreed and controlled" under a written contract between Contract Giver and Contract Acceptor. Paragraph 7.4 leaves no gap: the Contract Giver "is ultimately responsible to ensure processes are in place to assure the control of outsourced activities."

Read in order, the chapter is a third-party lifecycle:

1. Before outsourcing, assess "the legality, suitability and the competence of the Contract Acceptor" (7.5).
2. During the relationship, "monitor and review the performance of the Contract Acceptor" (7.7) and review its records and results (7.8).
3. On fourth parties, the Contract Acceptor "should not subcontract to a third party any of the work entrusted to him under the Contract without the Contract Giver's prior evaluation and approval" (7.11).
4. Expect inspection: outsourced activities "may be subject to inspection by the competent authorities" (7.13).

US drug CGMPs land in the same place. Under 21 CFR 211.22(a), the quality control unit "shall be responsible for approving or rejecting drug products manufactured, processed, packed, or held under contract by another company," and under 211.84(d)(2) a supplier's report of analysis can replace your own testing only with an identity test and "appropriate validation of the supplier's test results at appropriate intervals." That validation cadence is a gxp compliance obligation that belongs in the supplier file as much as in the lab. Certa for life sciences lists the frameworks Certa covers for CROs, CMOs and distributors, from FDA 21 CFR and GMP through GCP oversight and HIPAA.

HIPAA's third-party rule is the business associate agreement. Under 45 CFR 164.502(e)(1)(i), a covered entity may let a business associate handle protected health information only "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information," documented in a written contract under 164.502(e)(2). Down one tier, 164.502(e)(1)(ii) requires a business associate to obtain the same assurances from any subcontractor it uses. Section 164.504(e)(2) lists what the contract must say. Among the terms the business associate must accept:

• Report any use or disclosure not provided for by the contract, "including breaches of unsecured protected health information as required by § 164.410," which 164.410(b) sets at "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."
• Ensure subcontractors "agree to the same restrictions and conditions that apply to the business associate."
• Make its books and records available to the Secretary, and at termination return or destroy the information where feasible.

A monitoring duty hides in 164.504(e)(1)(ii). A covered entity is out of compliance if it "knew of a pattern of activity or practice of the business associate that constituted a material breach or violation" and did not take reasonable steps to cure it, then terminate if those steps failed and termination was feasible. Knowing and not acting is the violation. Log it like one.

22 CFR Parts 120 through 130 implement section 38 of the Arms Export Control Act (22 U.S.C. 2778) and are administered by the State Department's Directorate of Defense Trade Controls. A defense article under 120.31 is any item or technical data on the United States Munitions List in 121.1, including unfinished forgings and castings once they are identifiable as defense articles. Export under 120.50 covers more than shipping. It includes "releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)" and performing a defense service for a foreign person anywhere.

Registration is the third-party hook. Section 122.1(a) requires "any person who engages in the United States in the business of manufacturing or exporting or temporarily importing defense articles, or furnishing defense services" to register with DDTC, and "a manufacturer who does not engage in exporting must nevertheless register." One occasion counts. A machine shop three tiers down that cuts a USML part is in scope whether or not it knows it. Penalties explain why itar compliance is a procurement question: 127.7 provides for administrative debarment, "generally" for three years, and 127.10, as the eCFR read on October 23, 2026, sets the civil penalty per violation of 22 U.S.C. 2778 at up to the greater of $1,271,078 "or the amount that is twice the value of the transaction."

• DDTC registration status for every supplier that will manufacture or handle a defense article.
• Foreign ownership, control and the nationality of personnel with access to technical data.
• The license, agreement or exemption a planned release would rely on, recorded before the drawing goes out.

CMMC did not replace the DFARS cybersecurity clauses. It sits on top of them, and for most primes they are the gate a supplier meets first:

• 252.204-7012 requires covered contractor information systems to meet "the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171," requires cyber incidents to be rapidly reported to DoD, defined as within 72 hours of discovery, and under paragraph (m) flows to subcontracts "without alteration, except to identify the parties."
• 252.204-7019 makes award conditional on "a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation)" with summary level scores posted in the Supplier Performance Risk System.
• 252.204-7020(g) carries that down a tier: the contractor "shall not award a subcontract or other contractual instrument" unless the subcontractor has completed, within the last three years, at least a Basic NIST SP 800-171 DoD Assessment.

So dfars compliance for a prime is a before-award gate with three checks per supplier: the 7012 clause flowed down verbatim, a current SPRS score, and, as CMMC phases in, the status and affirmation 7021 requires.

Build those into supplier onboarding with dates attached. Every one of them expires.