Third-Party Risk

Four federal financial regulators extended the comment period for proposed, nonbinding third-party risk management guidance to December 16, 2026. The proposal may shape how banks and credit unions oversee contractors and service providers, but it announces no solicitation, contract award, or mandatory contractor compliance deadline.

A Center for Internet Security report cited in a November 10, 2026 article found that 51% of surveyed K-12 organizations had a cyber incident in the prior year, but only 15% regularly practiced their response plans. The gap points to potential demand for incident-response exercises, vendor-risk reviews and continuity planning, but no funded requirement or procurement timeline is identified.

A Qubole-related supply-chain attack used compromised AWS credentials to assume customer roles, access cloud data, and harvest AWS, Microsoft Entra ID, and Okta credentials. Sentra reported dozens of affected customers, underscoring the need for contractors to review third-party cloud access and credentials; no procurement opportunity was identified.

The American Conference Institute will hold its 4th Annual Cybersecurity, AI Governance & Digital Risk summit in Washington, DC, on February 2–3, 2027. The event is not a solicitation or award, but contractors may find its sessions on third-party risk, incident reporting, ransomware, and AI governance relevant to contract compliance and supplier oversight.

The SEC Division of Examinations’ FY 2027 priorities emphasize scrutiny of firms’ AI use, cybersecurity, customer-information safeguards, and third-party service-provider risks. The announcement is a regulatory signal—not a federal solicitation or award—but may prompt financial firms to seek support with governance, testing, incident response, and compliance documentation.

A cyber-extortion group claims it stole roughly 590 gigabytes from a vendor hosting PwC employee learning records. The incident underscores third-party cyber risk, a core component of federal supply chain security requirements and vendor risk assessments.

Quest Diagnostics said unauthorized access to its Quantum Lab Services Manager system may have exposed patient records, though the number affected is unknown. The incident is a healthcare cybersecurity and third-party-risk signal for government buyers and contractors; the company reports services and operations remain unaffected, and no procurement opportunity was announced.

A breach of an **Educational Testing Service (ETS)** file-transfer system exposed sensitive records belonging to millions of current and former California public school students. The incident underscores procurement risks around contractor access controls, student-data protection, and third-party oversight; no new solicitation or contract action has been identified.