Regulation S-P: The SEC’s Latest Cybersecurity Mandate – What RIAs Need to Know
The SEC’s amendments to Regulation S-P introduce stricter cybersecurity and data protection requirements for RIAs. If your firm isn’t proactively securing client data and preparing for breach response, you’re at risk—both legally and reputationally.
What’s Changed?
Regulation S-P, originally adopted in 2000, has been updated to reflect today’s cybersecurity threats. Here’s what every RIA must implement:
Written Cybersecurity Policies – Firms must document and enforce cybersecurity measures, data protection protocols, and breach response plans.
Mandatory Client Notifications – If a breach occurs (or is likely), you must notify affected clients within 30 days—even if you’re a small firm.
Expanded Compliance Scope – New rules apply to transfer agents and funding portals, ensuring third-party vendors meet security standards too.
How This Affects Your Firm
If you’re a smaller RIA with limited IT resources, compliance might feel overwhelming. But the reality is:
You’re still a target for cyber threats. Hackers know smaller firms may have weaker security.
Deadlines are approaching. Large RIAs ($1.5B+ AUM) must comply by December 3, 2025; smaller RIAs have until June 3, 2026.
Clients expect security. Compliance isn’t just about avoiding SEC penalties—it’s about maintaining trust and credibility in a competitive market.
Next Steps: How to Stay Compliant
- Review Your Cybersecurity Framework – Do you have written policies that align with Regulation S-P? If not, start drafting them now.
- Plan for Client Notification – Develop a clear communication strategy in case of a breach.
- Strengthen Vendor Oversight – Ensure your third-party providers (IT, custodians, software vendors) follow SEC-compliant security practices.
- Implement an Updated Secure Data Disposal Policy – New rules require proper handling and destruction of client data.
Don’t Wait Until It’s Too Late
Cyber threats won’t wait until 2025 or 2026—and neither should you. Firms that act early reduce risk, ensure compliance, and strengthen client trust.
Need help? Download our Regulation S-P Compliance Guide or schedule a free consultation with our cybersecurity experts today.
Your clients trust you with their financial futures. Make sure their data is just as secure.
FREQUENTLY ASKED QUESTIONS ABOUT REGULATION S-P COMPLIANE GUIDE
Q1: What are the new Regulation S-P rules that affect RIAs in 2024–2026?
The SEC’s Regulation S-P amendments require firms to:
- Implement a documented incident response program
- Notify affected clients within 30 days of discovering a breach or likely compromise
- Conduct ongoing oversight of third-party vendors that access client data
- Expand and document data protection and disposal procedures
- Maintain detailed records of incidents, notifications, and vendor reviews
Q2: What is Regulation S P and why is it important for RIAs?
Regulation S‑P, first adopted in 2000, enforces SEC privacy protections for customer data under the Gramm-Leach-Bliley Act. It requires RIAs and broker-dealers to establish written policies to protect nonpublic personal information (NPI), ensure its secure disposal, and manage breach notifications.
Q3:What are the key changes in the SEC’s May 2024 Regulation S P amendments?
As of May 2024, the SEC updated Regulation S‑P to include modern cybersecurity expectations:
- Mandatory written cybersecurity and incident response policies
- Client breach notifications within 30 days of discovering unauthorized access
- Expanded scope to include transfer agents and third-party data
- Vendor breach notifications within 72 hours
- Enhanced recordkeeping for policies, incidents, notifications, and vendor agreements
Read the official SEC final rule here.
Q4: Who must comply and what are the deadlines?
- Larger RIAs (AUM ≥ $1.5 billion): compliance required by December 3, 2025
- Smaller RIAs (AUM < $1.5 billion): deadline is June 3, 2026
All SEC-registered RIAs must align with these requirements by the respective deadlines.
Q5: What must be included in written cybersecurity policies?
Your policies should be designed to detect and respond to unauthorized access and should cover:
- Risk assessment and continuous monitoring
- Incident detection, containment, and recovery processes
- Secure data disposal procedures
- Vendor oversight and due diligence
- Protocols for notifying clients and service providers about breaches
Q6: What triggers the 30-day client notification requirement?
You must notify affected individuals within 30 calendar days after you learn of (or suspect) unauthorized access to sensitive customer information. Sensitive data includes:
- Social Security numbers, passports, driver’s license numbers
- Login credentials tied to financial data
- Biometric identifiers and other data that could lead to harm if compromised
Q7: Can notification be delayed beyond 30 days?
Notification may only be delayed if the U.S. Attorney General provides a written exception for reasons of national security or public safety. In all other instances, the 30-day notification requirement must be met.
Q8 What are the requirements for service provider oversight?
RIAs must:
- Conduct due diligence when selecting vendors
- Include security and breach-reporting clauses in contracts
- Require vendors to notify your firm within 72 hours of a breach
- Retain vendor records and related documentation for at least 3–6 years
Q9: What recordkeeping is required under the new rule?
Maintain documentation for at least 3 to 6 years, including:
- Written cybersecurity policies and procedures
- Incident logs, investigation summaries, and recovery actions
- Copies of client notifications and rationale for those actions
- Vendor oversight documentation, such as agreements and reports
- Data disposal records for customer and third-party information
Q10: How does Regulation S P compare to the SEC’s Cybersecurity Rule?
- Regulation S‑P centers on data protection and customer notification
- The Cybersecurity Rule addresses resiliency, incident governance, and ongoing monitoring
Together, these regulations form a comprehensive cybersecurity framework for RIAs.
Q11: What should RIAs do now to comply?
Follow these steps:
- Conduct a cybersecurity gap analysis
- Draft or update written policies and incident response protocols
- Create client notification templates
- Implement vendor oversight and breach-reporting processes
- Perform tabletop incident-response exercises with staff
- Strengthen data disposal procedures to meet the expanded scope
👇🏻 Fill out the form to download the guide!
Want to talk?
Grab 30 minutes with us here:
