If your firm is a registered investment adviser, broker-dealer or other covered financial institution, the SEC’s amended Regulation S-P is no longer something on the horizon. Larger firms had to comply by December 2025. Smaller investment advisers, those with less than $1.5 billion in assets under management, had until June 3, 2026. That date has come and gone. The rule now applies across the board, and the conversation has shifted from “when do we have to be ready” to “can we show an examiner that we are.”
For many small advisory practices, that’s an uncomfortable shift. A policy may have been drafted in the spring. A vendor or two may have been asked to sign something. But having documents and having a working program are two different things, and the amended rule was written specifically to close that gap.
What the Rule Actually Requires
This isn’t a paperwork update. Regulation S-P now requires covered firms to maintain a written incident response program that can actually detect, respond to and recover from unauthorized access to customer information. If an incident involves unauthorized access to sensitive customer information, affected individuals must be notified as soon as practicable, but no later than 30 days after the firm becomes aware of it.
Firms also have to oversee their service providers. That means identifying every third party that touches customer information, making sure those vendors will notify the firm of a breach within 72 hours, and keeping records that show all of this is happening. The emphasis on records matters. Examiners won’t just ask whether a policy exists. They’ll ask for evidence that it’s been followed.
That’s a much higher bar than “we have antivirus and a firewall,” and plenty of smaller advisers are discovering it applies to them in ways they didn’t expect.
Why “Our IT Guy Handles It” Falls Short
Many small firms rely on a part-time IT contractor, a tech-savvy operations manager, or a friend of the founder who set up the network years ago. Those people often do good work keeping computers running. But Regulation S-P isn’t really an IT question. It’s a governance question with technical pieces.
Someone has to own the incident response plan and know what happens in the first hour after a suspicious login. Someone has to decide when the firm officially “became aware” of an incident, since that starts the 30-day clock. Someone has to track every vendor with access to client data, from the custodian and CRM to the email archive, the document scanner service and the outsourced bookkeeper. And someone has to keep the paper trail. When an examiner asks who is responsible for those things, “our IT guy handles it” isn’t an answer that inspires confidence, especially if that person has never seen the plan.
Where Smaller Firms Actually Fall Short
It’s rarely a lack of effort. A four- or six-person practice simply doesn’t have a dedicated compliance or security team, so a few patterns show up again and again:
- An untested plan. The incident response program exists as a document, but nobody has walked through a realistic scenario to see whether it works.
- An incomplete vendor list. The obvious providers are covered, while smaller tools that quietly sync client data never made the inventory.
- Contracts without notification terms. Older vendor agreements don’t include a 72-hour breach notice requirement, and nobody has gone back to amend them.
- No reliable detection. Without monitoring, the firm may learn about an incident from a client or a custodian, which makes the 30-day notice window much harder to meet.
- Thin documentation. Good things may be happening, but there’s no record of reviews, tests or decisions to show an examiner.
What a Tabletop Exercise Reveals
One of the most useful things a small firm can do is a short tabletop exercise. Gather the principals and operations lead for an hour and talk through a scenario: an adviser’s email account was accessed from overseas two weeks ago, and the attacker downloaded a folder of client statements. Who notices? Who decides it’s a reportable incident? Who calls the custodian, the insurer, outside counsel? How do you figure out which clients were affected, and how do you notify them inside 30 days?
Most firms find several gaps in that hour, and that’s the point. It’s far better to discover that nobody knows how to pull email access logs during a practice run than during a real incident with the clock running. The exercise itself also becomes evidence that the program is real and tested.
Building a Program You Can Defend
Getting this right doesn’t mean building an internal security department. It means having a documented incident response plan mapped to this specific rule, a complete inventory of vendors who touch client data with notification terms in their contracts, monitoring that can actually tell you when something happened, and a simple record of reviews and tests. Done well, the same work also strengthens your position with cyber insurers and with institutional clients doing their own due diligence.
Regulation S-P Questions We Hear Most
Does amended Regulation S-P apply to small RIAs?
Yes. Advisers with less than $1.5 billion in assets under management had until June 3, 2026 to comply, and the rule now applies to every covered firm regardless of size.
How long does a firm have to notify customers after a breach?
As soon as practicable, and no later than 30 days after the firm becomes aware of unauthorized access to sensitive customer information.
What does the rule require from vendors?
Firms must oversee service providers that handle customer information, including making sure those vendors will report a breach to the firm within 72 hours, and keep records showing that oversight actually happens.
The Takeaway
The compliance date is behind you, which means the next exam is the real test. The question isn’t whether your firm has a Regulation S-P policy. It’s whether you could show an examiner, today, that the plan has been tested, every vendor is accounted for, and someone specific owns the response. If any part of that answer starts with “I think,” that’s where to focus first.
Cloud9 Tech Solutions helps Massachusetts financial firms build that readiness through IT support designed for regulated financial practices, paired with compliance guidance mapped to the frameworks that actually apply to your firm.
If you can’t say with confidence that your incident response plan has been tested, or that every vendor touching client data is under a 72-hour notification clause, now is the time to close that gap. Schedule a free security assessment with Cloud9.