Managed IT Services for Financial Services: What Banks, Credit Unions and CPA Firms Should Require

For a bank, credit union or accounting firm, the MSP decision gets graded later, by an examiner or auditor reading your vendor file, not in the sales meeting. That is the core of buying managed IT services for financial services. The Gramm-Leach-Bliley Act (GLBA) makes you responsible for overseeing your IT provider. Choose the one that hands you evidence without being chased, not the one that says "compliant" the most.

This guide serves two readers: the IT lead at a community bank or credit union who keeps the vendor-management file, and the partner or office manager at an accounting, tax or advisory firm.

Why managed IT services for financial services differ from office IT

A provider can run a tidy help desk for a law office and still leave a financial firm with nothing to show its examiner, because the rules reach vendors through you. GLBA requires financial institutions to protect customers' nonpublic personal information (NPI), and which version of its Safeguards Rule applies depends on who you are:

The third row is the easiest to miss. The FTC lists "tax preparation firms" among the financial institutions its Safeguards Rule covers, and the IRS is blunter in Publication 5708: under the GLBA and the Safeguards Rule, "tax and accounting professionals are considered financial institutions, regardless of size." A provider that treats you like any other small office will not raise the gap, so ask.

Insurance agencies answer to their state insurance regulator rather than the FTC. Payroll firms hold bank account numbers for everyone they pay; whether the FTC rule reaches one depends on its services. The vendor questions below apply to both.

What the rules require of your IT vendor

None of these rules regulates the MSP; they regulate you. The FTC version spells out how they reach the provider: you must oversee service providers by selecting ones capable of maintaining appropriate safeguards, requiring those safeguards by contract, and periodically assessing them based on the risk they present. The rule also lets a service provider, such as your MSP or a virtual CISO, supply the Qualified Individual who runs your information security program, but you still "retain responsibility for compliance" and must name a senior member of your staff to oversee that person.

An MSP can operate most of the technical elements: multi-factor authentication (MFA) for anyone accessing an information system, encryption of customer information in transit and at rest, logging of authorized users' activity, change management, disposal of old customer data, and the penetration tests and vulnerability scans required without continuous monitoring. The MSP runs the controls; your file needs the proof. The deadlines stay yours. A notification event involving at least 500 consumers must reach the FTC within 30 days of discovery, so the contract must get word of an incident to you well inside that window.

SEC-registered advisers and broker-dealers answer to Regulation S-P, whose 2024 amendments now apply to every covered firm (larger firms since December 3, 2025, smaller ones since June 3, 2026). Firms must require service providers to report a breach of a customer information system they maintain no later than 72 hours after becoming aware of it, so that notice belongs in your MSP's contract.

SOX comes in only through the financial-reporting chain: public companies and public bank holding companies under Section 404, and insured banks with $5 billion or more in assets, which need an attested assessment of internal control over financial reporting under FDIC Part 363 (the threshold since January 2026). A privately held bank below that line is outside both. Where either applies, the auditor tests access reviews and change approvals on financially significant systems and will ask whether your MSP's report is a SOC 1 or a SOC 2; only a SOC 1 is scoped to financial reporting.

PCI DSS applies wherever card data is stored, processed or transmitted, and v4.0.1 is the only active version in the PCI SSC document library. A credit union that issues cards is in scope for the card data it handles. An MSP with remote admin access to your cardholder data environment, or a managed firewall that segments it, is in your scope too: ask for its service-provider Attestation of Compliance and a written split of which requirements it owns. Our MSP compliance guide covers how the frameworks fit together.

IT services for credit unions and community banks

Examiners do not examine your MSP's sales deck; they examine how you manage it. For banks, the yardstick is the 2023 Interagency Guidance on Third-Party Relationships: planning, due diligence, contract negotiation, ongoing monitoring and termination. In September 2026 the banking agencies, joined by NCUA, proposed replacing it with guidance that scales oversight to each vendor's risk; until that is final, the 2023 guidance stands. Examiners also carry the FFIEC IT Examination Handbook; its Information Security and Business Continuity Management booklets are where an MSP's work gets judged.

Credit unions answer to NCUA Part 748. Its guidelines tell a credit union to choose service providers with due diligence, require safeguards by contract and, where its risk assessment calls for it, monitor them by reviewing "audits, summaries of test results, or other equivalent evaluations." That is the SOC report and the questionnaire, in regulatory language. A credit union must also notify NCUA of a reportable cyber incident within 72 hours, including one caused by a compromise at a cloud provider or other third-party host, so put the MSP's notice time in the contract.

Banks have two more rules. Under the computer-security incident notification rule, a bank must notify its regulator no later than 36 hours after it determines a notification incident has occurred. A bank service provider must notify the bank as soon as possible when an incident materially disrupts, or is reasonably likely to materially disrupt, covered services for four or more hours. The 36-hour clock is the bank's, not the MSP's. Name an incident contact in writing; without one, the rule sends the provider's notice to your CEO and CIO. And under the Bank Service Company Act, a bank's federal regulator can examine a provider's services to the bank as if the bank performed them itself. NCUA has no such power over credit-union vendors; the 2026 House bill that would grant it has not become law. For a credit union, the contract and the evidence you collect carry all the oversight.

So every bank or credit-union MSP contract needs right-to-audit language covering you and your examiners. Expect negotiation on scope, such as a SOC report as routine evidence with on-site access for cause. Treat a flat refusal as a red flag.

IT support for accounting and CPA firms

For a tax or accounting firm, your IT provider is part of how you show the FTC you meet the rule. The core requirement is a written information security program, which the IRS calls a Written Information Security Plan (WISP); Publication 5708 includes a sample. Your MSP may run most of the controls the plan describes, but the plan, the Qualified Individual and the oversight are yours. A provider that has never asked to see your WISP has not scoped you as a financial institution.

The small-firm relief is narrower than it sounds. Firms holding customer information on fewer than 5,000 consumers are exempt from some written requirements (the risk assessment, the incident response plan and the annual board report) and from the continuous monitoring or penetration testing element. MFA, encryption, access controls, a Qualified Individual and service-provider oversight still apply. Small is not the same as out of scope.

Two traps are specific to accounting firms. The first is card numbers. A hosted payment page keeps your PCI DSS scope small, but client card numbers stored for bill-pay or in a spreadsheet make it large fast. Your MSP needs to know where they live. The second is SOX, which reaches an accounting firm only when its MSP touches systems in a public client's financial reporting, such as a hosted client accounting system or outsourced bookkeeping. Your own office IT is not your client's IT general controls.

A firm that does accounting for medical practices and can see patient data may also be a HIPAA business associate; our healthcare IT buyer guide covers that side.

The evidence to collect from your MSP every year

This is what an examiner or auditor reads, so build the vendor file around it. A provider serving financial clients should hand most of it over unprompted:

• A SOC 2 Type II report: an independent auditor's opinion on whether the provider's controls worked over a stated review period. Add a SOC 1 Type II where SOX or Part 363 applies.
• A bridge letter: a statement from the provider's management, not the auditor, covering the months since the report period ended. Treat it as a statement, not audited evidence.
• The complementary user entity controls: the controls the SOC report assumes you run. This list shows what is still yours.
• Carved-out vendors: the provider's own critical vendors the report excludes, such as its remote-management tool, and their reports.
• Your due-diligence questionnaire, completed each year.
• Last quarter's access review and change-approval log for systems that hold customer information or feed financial reporting.
• The incident-notice clause: how fast, to whom, and what the notice contains.
• Dated test results: the latest penetration test and vulnerability scans, the last successful restore, and the last incident response tabletop.
• A responsibility matrix: which safeguards the provider owns, which stay with you, and which are shared.

For a 30-person CPA firm, a provider without a SOC 2 report is a tradeoff to weigh, not a disqualifier; ask what independent evidence it offers instead. A bank or credit union should expect the report or a clear substitute. For example, an exam can go smoothly until someone asks for the vendor's current SOC report and the file holds a two-year-old one with no bridge letter.

The five buyer signals, applied to financial services

Then compare providers on the same five signals you would use anywhere, adjusted for a regulated calendar:

• Response time on your processing calendar. Month-end close, payroll runs, wire and ACH cutoffs and tax season are when an outage costs the most. Ask for priorities that name those windows, plus an incident-notice commitment separate from the time to fix. The IT support SLA guide shows how to write them into the contract.
• Ticket tracking an examiner can sample. Changes approved in a ticket before work starts, every access add and removal tied to a ticket, and a history you can export when an examiner asks for a sample.
• Proactive monitoring of who did what. Monitoring authorized users' activity is a required Safeguards Rule control. Ask who owns each alert, how fast someone looks at it, and how long logs are kept.
• Financial clients, asked about and never assumed. Ask how many financial clients the provider has supported through an examination or audit, and whether it knows your core processor, digital banking platform, or tax and practice-management software. Then call two references.
• Security posture you can count. MFA on every system that touches customer information and on the provider's own remote tools, encryption at rest and in transit, and the dated test results above. A backup job that reports success is not proof of a restore. Ask for the date of the last successful restore.

Red flags when an MSP "does financial services"

• "We'll make you compliant." You carry the obligation. A provider operates safeguards and hands over evidence; it cannot be compliant on your behalf.
• A credential that does not exist. There is no GLBA certification, and FFIEC certifies no one; "SOX certified", "PCI certified" and "NCUA approved" are no more real. Ask what evidence sits behind the badge.
• Nothing in writing. It will not put safeguards, notice timelines, or audit and examination access in the contract.
• No independent evidence. No SOC report or substitute, and no appetite for your questionnaire.
• Weak basics. Shared admin accounts, no MFA on its own remote tools, no tested restore or dated tabletop.
• Retired material. Its proposal leans on the FFIEC Cybersecurity Assessment Tool, which the FFIEC retired on August 31, 2025.
• A tax firm scoped like any small office. No mention of the Safeguards Rule, the WISP or a Qualified Individual.

The right MSP for a financial firm is the one that is easiest to examine. Judge providers on the evidence they hand over without being chased, not on how often they say "compliant".

What to ask in the meeting

1. "Which Safeguards Rule elements do you operate for us, and what evidence do you give us for our annual board report?"
2. "What do you hand us for our vendor file each year: SOC report, bridge letter, completed questionnaire, list of your own critical vendors?"
3. "Which requirements do you own and which stay ours, in writing?"
4. "How fast, and to whom, do you report a security incident to us, and is that in the contract?"
5. "Can you produce last quarter's access review and change-approval log for our financial systems?"
6. "Have you supported a client through an examination or audit, and what did you produce for it?"
7. "Have you scoped us as a financial institution under the FTC Safeguards Rule, or as a regular small office?"

Before you sign, ask how you leave: who holds the admin credentials, documentation and backups when the contract ends. Our guides to MSP contract red flags and switching MSP providers cover the exit terms.

Compare providers, then put these questions to each one

Compare managed IT providers in your state, then put each one through these questions. The managed IT provider directory links every state. A listing that mentions banks, credit unions or tax work is a reason to call, not evidence of experience; the questions above tell you whether an MSP for financial services can deliver. Earlier in the process? The MSP buyer's guide covers the full evaluation.

Frequently asked questions

Is there a GLBA certification for MSPs?

No. GLBA is a law that financial institutions must satisfy, and no agency certifies, approves or registers IT vendors under it. The same goes for FFIEC, which publishes examination guidance, and for "SOX certified" and "NCUA approved". An MSP that calls itself GLBA certified is selling a credential that does not exist. Ask what evidence sits behind the claim: a SOC 2 Type II report, a completed due-diligence questionnaire and a written split of which safeguards it operates for you.

Does the FTC Safeguards Rule apply to accounting firms?

Yes for any firm that prepares tax returns: the FTC's rule lists tax preparation firms by name among the financial institutions it covers. IRS Publication 5708 goes further and says that under the GLBA and the Safeguards Rule, tax and accounting professionals are considered financial institutions, regardless of size. The rule requires a written information security program, which the IRS calls a WISP, and oversight of your service providers, including your MSP.

Are small firms exempt from the Safeguards Rule?

Only from some of it. Firms that maintain customer information on fewer than 5,000 consumers are exempt from four requirements under 16 CFR 314.6: the written risk assessment, continuous monitoring or annual penetration testing with vulnerability assessments, the written incident response plan, and the Qualified Individual's annual written report to the board. Everything else still applies, including MFA, encryption, access controls, a Qualified Individual and oversight of your service providers.

What should a bank or credit union get from its MSP every year?

At minimum: a current SOC 2 Type II report (and a SOC 1 if SOX or FDIC Part 363 applies), a bridge letter covering the months since the report period ended, the list of complementary user entity controls you are expected to run, the provider's carved-out vendors and their reports, a completed due-diligence questionnaire, access reviews and a change-approval log for your financial systems, and dated results from its latest penetration test, restore test and incident response tabletop. NCUA's Part 748 guidelines describe the same idea as reviewing "audits, summaries of test results, or other equivalent evaluations" of your service providers.

Is a SOC 2 report enough for a SOX audit?

Not by design. A SOC 1 Type II report covers the controls relevant to a client's financial reporting, which is what a SOX auditor relies on. A SOC 2 Type II covers security, availability, processing integrity, confidentiality and privacy. If your MSP manages access or changes on financially significant systems, ask which report it has and whether your auditor will rely on it. Either way, expect the auditor to sample access reviews and change approvals.

Can our MSP act as our Qualified Individual?

Yes. The Safeguards Rule says the Qualified Individual may be employed by you, an affiliate or a service provider. If you use your MSP or a virtual CISO for the role, you keep responsibility for compliance, you must designate a senior member of your own staff to direct and oversee that person, and you must require the provider to maintain an information security program that protects you.