🔑 Key Takeaways
- Any unauthorized access triggers your IRP—not just external hackers, but also interns, advisors, contractors, spouses, and executives who access client information outside their defined role
- IRP trigger ≠customer notification—while any unauthorized access activates your incident response plan, you only notify clients when there's a reasonable likelihood of "substantial harm or inconvenience"
- Internal scenarios rarely require notification—spouse accessing data, intern seeing files outside their role, or advisor viewing another's client typically won't meet the harm threshold
- Build off-ramps before incidents happen—create risk matrices, define minimal-risk scenarios, prepare investigation templates, and document your "reasonable investigation" standard
- Prevention beats investigation—audit permissions, implement role-based access controls, enable logging, train your team, and review access regularly
When most RIAs think about cybersecurity incidents, they picture hackers, phishing attacks, and ransomware. The threat comes from outside.
But here's what catches firms off guard during SEC examinations: your incident response plan doesn't just get triggered by bad actors. It gets triggered by any unauthorized access to client information—including access by your own team.
Wait, My Intern Can Trigger My IRP?
Yes. And so can your advisors, your operations staff, your 1099 contractors, your spouse, and potentially even your executives.
Under Regulation S-P's amendments, any instance of unauthorized access to or use of nonpublic customer information triggers your incident response program. The rule doesn't distinguish between malicious external hackers and well-meaning internal employees who simply had access they shouldn't have had.
Let's break down what this means in practice:
Common Internal Triggers RIAs Miss
The Summer Intern
You brought on a college student to help with administrative tasks. Someone set up their account with broad permissions "just to make things easier." Now they can technically access any client file in your CRM, even though their job only requires them to update contact information for a specific list of prospects.
That's unauthorized access. That triggers your IRP.
The Siloed Advisor
Your firm operates with independent books of business. Each advisor manages their own clients. But your systems allow any advisor to view details on any client in the firm.
If Advisor A pulls up Advisor B's client file out of curiosity—or even by accident—that's unauthorized access. That triggers your IRP.
The 1099 Contractor
You hired a paraplanner on a contract basis to help with financial plan preparation. They need access to specific client data to do their job. But your file sharing system gives them access to your entire client folder structure.
Every time they could have accessed information beyond what they needed for their assigned work? Potential unauthorized access. Potential IRP trigger.
The Spouse Who Helps Out
This is incredibly common among smaller RIAs: your spouse helps with the business, maybe handling social media, marketing materials, or administrative tasks. They have login credentials to your systems "just in case you need help with something."
But their role doesn't require access to client account information, Social Security numbers, or financial planning documents. If they can access that information—even if they never would—that's technically unauthorized access waiting to happen. And if they ever do access it, even innocently? IRP trigger.
The Executive with Too Much Access
Your CCO has admin-level access to everything "just in case." But their actual job responsibilities don't require them to view client account statements or Social Security numbers on a daily basis.
If they access that information outside the scope of their role? You guessed it—IRP trigger.
The Bad News: This Happens More Often Than You Think
Here's the uncomfortable truth: most RIAs have multiple instances of unauthorized access happening regularly, and they don't even know it.
Why? Because firms typically set up permissions based on convenience rather than the principle of least privilege. It's easier to give everyone broad access than to carefully define and maintain role-based permissions.
But under Reg S-P, "easier" doesn't cut it anymore. The SEC expects you to:
- Define who needs access to what information
- Limit access accordingly
- Monitor for unauthorized access
- Investigate when it happens
- Document everything
Every. Single. Time.
But Wait—Do I Have to Notify Clients About All of This?
Here's the critical distinction: triggering your IRP is not the same as triggering customer notification.
Your incident response program gets activated by any unauthorized access. But customer notification only happens when sensitive customer information was accessed without authorization and that access is reasonably likely to result in substantial harm or inconvenience to clients.
The SEC's rule leaves "substantial harm or inconvenience" undefined—a topic for another day—but they provide examples: financial loss, theft, fraud, identity theft, damaged credit, harassment, impersonation, or misuse of information to access accounts.
In virtually all cases, your spouse accessing client information they shouldn't have, or an intern seeing data outside their role, would not meet this threshold. There's no reasonable likelihood of substantial harm when:
- The person is trustworthy and part of your firm's ecosystem
- No sensitive information was downloaded, copied, or shared
- The access was inadvertent and immediately contained
- There's no indication of misuse or intent to misuse the information
So yes, you need to run your IRP. But no, you probably don't need to send notification letters to clients explaining that your spouse who handles your Instagram account accidentally opened a client folder.
The investigation is your opportunity to document why notification isn't required. But you have to actually do the investigation and document your reasoning.
The Good News: You Can Build Smart Off-Ramps
This is where a well-designed IRP becomes your best friend. The key is to do the thinking before incidents happen, not during them.
Build Your Off-Ramps Ahead of Time
1. Create a Risk Matrix
Develop a framework that helps you quickly categorize incidents by:
- Actor type: Internal vs. external, employee vs. contractor vs. family member, technical vs. non-technical role
- Extent of access: Single client record vs. bulk data, view-only vs. download capability
- Type of information: Contact details vs. SSNs vs. account credentials
- Likelihood of harm: Accidental one-time access vs. repeated access vs. data exfiltration
2. Define Your Minimal-Risk Scenarios
Spend a few hours identifying the types of unauthorized access that are:
- Low risk (limited data, limited exposure)
- Low likelihood of harm (no sensitive information, no evidence of misuse)
- Quickly investigable (clear audit trails, immediate containment possible)
For example: "An employee with view-only CRM access accidentally opened a client record outside their book of business, immediately closed it, and reported it to their supervisor. No sensitive financial information or credentials were displayed. Audit logs confirm no data was downloaded or shared."
3. Prepare Investigation Templates
Create streamlined investigation checklists for your most common scenarios:
- Intern/temporary worker with overly broad permissions
- Advisor accessing another advisor's client
- Administrative staff accessing information beyond their role
- Contractor with file system access beyond project scope
- Spouse or family member with system access beyond their role
Each template should include:
- Initial assessment questions
- Required documentation
- Containment steps (if any)
- Determination criteria for whether customer notification is required
- Sign-off requirements
4. Document Your Reasonable Investigation Standard
Write down what "reasonable investigation" means for your firm in different scenarios. This becomes your defense during an SEC examination.
For minimal-risk incidents, your reasonable investigation might be:
- Reviewing audit logs to confirm the extent of access
- Interviewing the individual involved
- Verifying no data was downloaded, copied, or shared
- Confirming the access was unintentional and isolated
- Assessing whether substantial harm or inconvenience to clients is reasonably likely
- Implementing immediate permission changes to prevent recurrence
For higher-risk incidents, you'll need deeper investigation, but having the framework in place means you're not starting from scratch.
The Bottom Line: Prevention Is Easier Than Investigation
Yes, any unauthorized access triggers your IRP. But the best strategy isn't just having a great investigation process—it's preventing unauthorized access in the first place.
Start with these steps:
- Audit your current permissions: Who has access to what? Does everyone need everything they can currently access?
- Implement role-based access controls: Define roles, define required access, and enforce it systematically.
- Enable audit logging: You can't investigate what you can't see. Make sure you have logs showing who accessed what and when.
- Train your team: Make sure everyone understands that "can access" doesn't mean "should access." Create a culture of data minimization.
- Review permissions regularly: People's roles change. Make sure their access changes with them.
- Build your IRP with internal triggers in mind: Don't just plan for hackers. Plan for the summer intern, the curious advisor, the contractor with too much access, and yes, even the helpful spouse.
Your Compliance Deadline Depends on Your Firm Size
For most RIAs, the compliance deadline is June 3, 2026. That might feel far away, but implementing proper access controls, audit logging, and a comprehensive IRP takes time.
However, if your firm manages $1.5 billion or more in AUM, your deadline is much sooner: December 3, 2025—that's this Tuesday.
The firms that wait until the last minute will be scrambling. The firms that start now will have time to:
- Get their systems properly configured
- Train their teams
- Test their incident response procedures
- Build those smart off-ramps that make compliance manageable
And when the SEC shows up for an examination, you'll be able to demonstrate not just that you have an IRP, but that you've thought through the real-world scenarios your firm actually faces—including the ones that come from inside.
Need help building an IRP that accounts for both external threats and internal triggers? That's exactly what we do. Schedule a 30-minute consultation to discuss how CyberSecureRIA can help your firm meet your compliance deadline.
Jonathan Addington
Founder & CEO, CyberSecureRIA
jonathan.addington@cybersecureria.com
865-622-9304
www.CyberSecureRIA.com
