For years, organizations viewed cybersecurity primarily as an internal challenge. Boards, executives, legal departments, and IT teams focused on protecting their own systems, deploying security tools, training employees, and developing incident response plans. While those efforts remain essential, recent cybersecurity incidents demonstrate that some of the most significant risks now originate outside an organization’s own environment.
Today’s organizations routinely entrust sensitive information and mission-critical operations to software vendors, cloud providers, payroll processors, employee benefits administrators, recordkeepers, managed service providers, and other third parties. In many cases, those vendors maintain access to the same information and systems that organizations work so hard to protect internally.
Regulatory Lens: The Duty of Vendor Oversight Is Emerging Across Industries and Regulatory Frameworks
In today’s economy, cybersecurity risk has increasingly become a third-party and supply-chain risk. Regulators have begun to reflect this reality. In 2024, the U.S. Department of Labor updated its cybersecurity guidance and confirmed that it applies to all ERISA-covered plans, including both retirement plans and health and welfare plans. The guidance emphasizes that plan sponsors and fiduciaries should prudently select service providers with strong cybersecurity practices and continue monitoring those providers throughout the relationship. The guidance also identifies recordkeepers and other service providers as critical participants in safeguarding plan data and plan assets.
Although the Department of Labor’s guidance arises in the employee benefits context, its significance extends far beyond ERISA plans. The Department has articulated a broader duty of vendor oversight that increasingly appears across the regulatory landscape: organizations may outsource operations, but they cannot outsource accountability for evaluating, contracting with, and monitoring third parties that create cybersecurity risk. Similar expectations can be found in privacy regulation, healthcare compliance, financial services oversight, cybersecurity regulation, and other industries where regulators expect organizations to understand, assess, and mitigate the risks posed by third-party service providers.
Viewed through that broader lens, the Department of Labor’s guidance serves as a useful roadmap for the developing duty of vendor oversight across industries. That duty involves reasonable diligence before engagement, appropriate contractual protections, continuing monitoring, and planning for the operational consequences of a vendor failure.
The Duty of Vendor Oversight Continues After Outsourcing
Many organizations assume that outsourcing a business function transfers much of the associated cybersecurity risk. Recent developments suggest otherwise and reinforce a continuing duty of vendor oversight before and after a service provider is engaged.
The Department of Labor’s guidance makes clear that fiduciaries retain responsibility for prudently selecting and monitoring service providers. In practical terms, the Department expects organizations to evaluate the cybersecurity capabilities of vendors before engagement and continue exercising oversight after the contract is signed.
The MOVEit Software Vulnerability Litigation
The recent MOVEit litigation provides a powerful illustration of why this principle matters. Rather than attacking thousands of organizations individually, threat actors exploited vulnerabilities in file-transfer software developed by Progress Software. Many organizations affected by the incident were never directly compromised. Instead, sensitive information was exposed because those organizations relied upon a third-party platform that later became vulnerable to attack. Litigation arising from the incident has become one of the largest cybersecurity multidistrict proceedings in recent years, and in 2025 a federal court largely denied motions to dismiss numerous negligence, contract, and consumer protection claims arising from the breach.
The teaching moment is straightforward. Many organizations continue to focus almost exclusively on the cybersecurity maturity of their own systems. The MOVEit litigation demonstrates that an organization may maintain strong internal cybersecurity controls and still face litigation exposure, notification obligations, operational disruption, reputational harm, and substantial remediation costs because of vulnerabilities in a critical third-party technology provider.
Organizations should therefore treat the duty of vendor oversight as an extension of their cybersecurity program rather than a one-time procurement exercise. Increasingly, the relevant questions are not simply whether an organization has strong cybersecurity controls, but whether it used reasonable care to select its vendors, established meaningful contractual protections, and continued monitoring vendor risk throughout the relationship.
The Duty of Vendor Oversight Is a Continuing Governance Responsibility
The Department of Labor’s guidance provides a useful framework for understanding what the duty of vendor oversight requires in practice.
The guidance encourages organizations to evaluate service providers’ cybersecurity practices before engagement and continue monitoring those practices over time. Among other things, organizations should consider prior security incidents, information security policies, cybersecurity standards, independent assessments, audit reports, cyber insurance coverage, and how providers validate their cybersecurity controls. The Department also identifies formal cybersecurity programs, annual risk assessments, independent audits, strong access controls, cybersecurity awareness training, encryption, incident response planning, business continuity planning, and disaster recovery capabilities as important safeguards.
What is particularly noteworthy about the Department’s position is how easily these concepts translate across industries. Whether the organization is a healthcare provider, financial institution, technology company, nonprofit, manufacturer, or plan sponsor, the underlying governance principles remain remarkably similar. Regulators increasingly expect organizations to understand their vendor ecosystem, evaluate risk before onboarding a provider, and periodically reassess those risks over the life of the relationship.
The Change Healthcare Cyberattack
The 2024 cyberattack involving Change Healthcare demonstrates why these expectations are becoming more pronounced. Following the attack, healthcare providers across the country experienced widespread disruptions affecting claims processing, payment systems, eligibility verification, and pharmacy operations. Many organizations suffered substantial operational and financial consequences despite not being the entity that originally experienced the intrusion. Litigation arising from the incident has since been consolidated into multidistrict proceedings in federal court.
The most important lesson from Change Healthcare is not necessarily about data security. It is about dependency risk.
The incident exposed how dependent much of the healthcare ecosystem had become upon a single service provider. Many organizations discovered that their ability to perform day-to-day operations depended upon a vendor they neither controlled nor fully understood from a resiliency perspective.
The teaching moment is that the duty of vendor oversight should not focus solely on whether a vendor can adequately protect information. It should also encompass concentration risk, operational dependency, business continuity planning, and available alternatives. A vendor may maintain strong security controls and still present significant risk if the organization cannot continue critical operations when that vendor becomes unavailable.
Boards, executives, fiduciaries, and management teams should therefore be asking more than, “How secure is this vendor?” They should also be asking, “What happens if this vendor goes offline for a month?”
Contracting Is a Critical Component of the Duty of Vendor Oversight
Even the most robust diligence process cannot eliminate cybersecurity risk. The duty of vendor oversight therefore must extend beyond diligence to the contract itself. Vendor agreements are among the most important tools available for allocating responsibility, requiring safeguards, and preserving response rights before a cybersecurity incident occurs.
Organizations should carefully evaluate whether service-provider agreements contain meaningful cybersecurity protections addressing issues such as security standards, access management requirements, multi-factor authentication, incident notification obligations, cooperation during investigations, subcontractor management, audit rights, cyber insurance requirements, and data retention or deletion obligations.
These provisions often become critically important after an incident occurs because they determine what information an organization is entitled to receive and what level of cooperation it can demand from a vendor.
Compromise of Subcontractor’s Credentials: September 2025 Lawsuit Against PowerSchool
The Texas Attorney General’s lawsuit against PowerSchool illustrates why the duty of vendor oversight must extend through the entire service-provider chain. PowerSchool provides cloud-based student-information services to school systems. Texas alleges that, during a December 2024 breach, an attacker used credentials associated with a subcontractor to obtain administrative access to PowerSchool’s systems and extract sensitive information concerning more than 880,000 Texas students and teachers. The exposed information allegedly included Social Security numbers, medical and disability records, special-education information, and school-bus-stop data.
The State alleges that PowerSchool failed to employ appropriate protections, including multifactor authentication, adequate access controls, and encryption, while making representations concerning the strength of its security practices. The lawsuit asserts claims under the Texas Deceptive Trade Practices Act and the Texas Identity Theft Enforcement and Protection Act.
The teaching moment from PowerSchool is that the duty of vendor oversight does not stop with an organization’s direct service provider. Organizations should understand whether vendors rely on subcontractors, support providers, or other downstream parties with privileged access to sensitive information or systems. Vendor agreements should address subcontractor disclosure and approval, flow-down security requirements, multifactor authentication, least-privilege access, encryption, access monitoring, incident notification, and responsibility for subcontractor failures.
The PowerSchool case also demonstrates that security promises can become enforcement evidence. Organizations should verify that vendor security representations, contractual commitments, marketing statements, and actual controls are aligned. A vendor’s assurances should not substitute for reasonable diligence, enforceable contractual requirements, and continuing oversight.
Looking Ahead
The lessons from MOVEit, Change Healthcare, and PowerSchool are remarkably consistent. In each case, organizations experienced significant consequences because of cybersecurity failures that originated within a third-party vendor ecosystem. Those consequences included litigation, regulatory scrutiny, operational disruption, substantial remediation expenses, and reputational harm.
At the same time, the Department of Labor’s cybersecurity guidance demonstrates that the duty of vendor oversight is no longer merely a procurement function or an IT responsibility. Although the guidance applies directly to ERISA-covered plans, its core principles are readily transferable across industries and regulatory frameworks. Across privacy law, cybersecurity regulation, healthcare compliance, financial services oversight, and other regulated sectors, organizations increasingly are expected to conduct meaningful diligence, negotiate appropriate contractual protections, understand critical vendor dependencies, and maintain ongoing oversight of service providers.
The common lesson from these developments is simple: the duty to mitigate cybersecurity risk includes a duty of vendor oversight. Organizations should understand their vendor ecosystem, assess third-party risks, evaluate operational dependencies, negotiate contractual protections that will matter during an incident, and maintain ongoing oversight long after a vendor has been selected.
In today’s environment, some of an organization’s most significant cybersecurity risks may exist beyond its own four walls. Organizations best positioned to manage those risks will be those that treat the duty of vendor oversight as a continuing legal, compliance, governance, operational resilience, and fiduciary responsibility requiring sustained attention from management and the boardroom alike.
Contacts:
Elizabeth Rogers I 512.370.2834 I [email protected]