Regulation S-P: The SEC’s Latest Cybersecurity Mandate – What RIAs Need to Know
The SEC’s amendments to Regulation S-P introduce stricter cybersecurity and data protection requirements for RIAs. If your firm isn’t proactively securing client data and preparing for breach response, you’re at risk—both legally and reputationally.
What’s Changed?
Regulation S-P, originally adopted in 2000, has been updated to reflect today’s cybersecurity threats. Here’s what every RIA must implement:
Written Cybersecurity Policies – Firms must document and enforce cybersecurity measures, data protection protocols, and breach response plans.
Mandatory Client Notifications – If a breach occurs (or is likely), you must notify affected clients within 30 days—even if you’re a small firm.
Expanded Compliance Scope – New rules apply to transfer agents and funding portals, ensuring third-party vendors meet security standards too.
How This Affects Your Firm
If you’re a smaller RIA with limited IT resources, compliance might feel overwhelming. But the reality is:
You’re still a target for cyber threats. Hackers know smaller firms may have weaker security.
Deadlines are approaching. Large RIAs ($1.5B+ AUM) must comply by December 3, 2025; smaller RIAs have until June 3, 2026.
Clients expect security. Compliance isn’t just about avoiding SEC penalties—it’s about maintaining trust and credibility in a competitive market.
Next Steps: How to Stay Compliant
- Review Your Cybersecurity Framework – Do you have written policies that align with Regulation S-P? If not, start drafting them now.
- Plan for Client Notification – Develop a clear communication strategy in case of a breach.
- Strengthen Vendor Oversight – Ensure your third-party providers (IT, custodians, software vendors) follow SEC-compliant security practices.
- Implement an Updated Secure Data Disposal Policy – New rules require proper handling and destruction of client data.
Don’t Wait Until It’s Too Late
Cyber threats won’t wait until 2025 or 2026—and neither should you. Firms that act early reduce risk, ensure compliance, and strengthen client trust.
Need help? Download our Regulation S-P Compliance Guide or schedule a free consultation with our cybersecurity experts today.
Your clients trust you with their financial futures. Make sure their data is just as secure.
👇🏻 Fill out the form to download the guide!
FREQUENTLY ASKED QUESTIONS REGARDING REG S-P
Q1: What is Regulation S P for RIAs and why is it important?
Regulation S‑P is an SEC rule designed to protect customer privacy and safeguard nonpublic personal information (NPI). It mandates that RIAs adopt written policies and procedures to protect sensitive client data from unauthorized access or use. These rules stem from the Gramm-Leach-Bliley Act (GLBA) and were recently updated in May 2024 to reflect modern cybersecurity threats.
Q2: What are the latest SEC changes to Regulation S P in 2024?
The 2024 amendments to Regulation S‑P require:
- Written cybersecurity and incident response programs
- Client breach notifications within 30 days of detecting unauthorized access
- Oversight of service providers with breach notifications due within 72 hours
- Expanded scope to include transfer agents and third-party data
- Updated recordkeeping and data disposal obligations
These changes modernize outdated rules and enhance protection for client data in today’s digital environment.
Q3: Who must comply with the new Regulation S P rules and by when?
- Large RIAs (≥ $1.5 billion AUM): Must comply by December 3, 2025
- Smaller RIAs (< $1.5 billion AUM): Deadline is June 3, 2026
These timelines give firms 18 to 24 months from the rule’s effective date to become compliant.
Q4: What is required in a Regulation S P-compliant incident response plan?
Your Written Incident Response Program must include:
- Detection and assessment of unauthorized access
- Scope evaluation and containment steps
- Recovery plans and system restoration
- Client notification protocols (within 30 days)
- Vendor breach monitoring and reporting (within 72 hours)
- Full documentation and post-incident reviews
Q5: What does “sensitive customer information” mean under Regulation S P?
This includes any information that could cause harm or identity theft if disclosed. Examples include:
- Social Security numbers
- Account usernames and passwords
- Biometric identifiers
- Driver’s license or passport numbers
- Financial account credentials
- Any combination of data that identifies a customer
Q6: What is the SEC’s 30-day breach notification rule for RIAs?
RIAs must notify clients within 30 days of becoming aware of unauthorized access to sensitive customer data. Notification can only be delayed if the U.S. Attorney General requests it for national security or law enforcement purposes. Firms must retain documentation justifying delays or decisions not to notify.
Q7: Do RIAs need vendor breach response policies under Regulation S P?
Yes. Regulation S‑P now mandates written vendor oversight policies, including:
- Risk-based due diligence during vendor selection
- Breach notification requirements within 72 hours of discovery
- Ongoing monitoring and audit rights
- Formal contracts documenting compliance expectations
RIAs remain responsible for notifying clients—even if a vendor is at fault.
Q8: What are the recordkeeping requirements under the amended rule?
RIAs must retain the following records for 3 to 6 years, based on firm size:
- Written cybersecurity and incident response policies
- Breach logs and investigation summaries
- Copies of client notifications and related decisions
- Vendor contracts and oversight documentation
- Data disposal records and policy revisions
Q9: What’s the difference between Regulation S P and the SEC Cybersecurity Rule?
- Regulation S‑P: Focuses on protecting sensitive client data and notification obligations
- Cybersecurity Rule: Focuses on operational resilience and business continuity during cyber events
Together, they create a comprehensive compliance framework for RIAs managing digital risk.
Q10: Why did the SEC update Regulation S P now?
Cyberattacks have increased dramatically since the rule’s original version in 2000. The 2024 update reflects:
- Rise in ransomware and credential theft
- Complexity of remote/hybrid work environments
- Need for faster breach response and client transparency
- Importance of third-party oversight and secure data disposal
The SEC aims to shift firms toward a “detect, respond, and recover” mindset.
Q11: What steps should RIAs take now to comply with Regulation S P?
| Step | Description |
| 1 | Conduct a cybersecurity gap assessment |
| 2 | Draft or enhance your Incident Response Plan |
| 3 | Develop client notification templates |
| 4 | Create and document vendor oversight procedures |
| 5 | Align data disposal methods with new requirements |
| 6 | Maintain and audit written records and contracts |
| 7 | Train staff and conduct tabletop incident exercises |
Want to talk?
Grab 30 minutes with us here:
