Short answer
If you are an SEC-registered adviser, amended Regulation S-P requires a written incident response program that can detect, respond to and recover from unauthorized access to customer information, a customer notice within 30 days when sensitive information is involved, and oversight of the vendors that handle your clients' data. [4] [1] Both compliance dates have passed as of Oct 20, 2026. State-registered advisers fall under state rules and, depending on facts, the FTC. Practical controls are the same for everyone.
Regulation S-P as amended in 2024
The SEC adopted the amendments in May 2024. They apply to broker-dealers, investment companies, SEC-registered investment advisers and transfer agents, which the rule calls covered institutions. [4] [1]
| Requirement | What it says |
|---|---|
| Incident response program | Written policies and procedures for a program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information, including steps to assess the nature and scope of an incident and to contain and control it. [1] |
| Customer notice | Notify affected individuals as soon as practicable, and no later than 30 days after becoming aware that unauthorized access or use has occurred or is reasonably likely to have occurred. [1] |
| Exception | No notice is required if, after a reasonable investigation, you determine the sensitive information has not been and is not reasonably likely to be used in a way that results in substantial harm or inconvenience. [1] |
| Notice content | Details about the incident, the data involved, and how affected individuals can protect themselves. [1] |
| Service providers | Written policies requiring oversight, including due diligence and monitoring, so providers protect customer information and notify you as soon as possible and no later than 72 hours after becoming aware of a breach in a system they maintain. You may have a provider send notices for you, but the responsibility stays with you. [1] |
| Records | Written records documenting compliance with the safeguards and disposal rules. [4] |
| Scope | Applies to nonpublic personal information you collect about your own customers and information you receive from another financial institution about its customers. [4] |
| Annual privacy notice | Not required if conditions of the FAST Act exception are met. [4] |
Sensitive customer information is information that, alone or with other information, could create a reasonably likely risk of substantial harm or inconvenience if compromised. Examples are a Social Security number, and an account number or user name combined with a security code or similar information that could give access to the account. [1]
Compliance dates. The amendments took effect Aug 2, 2024. Larger entities had to comply by Dec 3, 2025 and smaller entities by Jun 3, 2026. [1] For investment advisers, a larger entity has $1.5 billion or more in assets under management. [2]
Regulation S-ID: identity theft red flags
Regulation S-ID covers investment advisers registered or required to register that are financial institutions or creditors under the Fair Credit Reporting Act and have covered accounts. A covered account is one used mainly for personal, family or household purposes that allows multiple payments or transactions, or any account with a reasonably foreseeable risk of identity theft. [3]
Such a firm needs a written program, sized to its business, that identifies relevant red flags, detects them, responds to prevent and mitigate identity theft, and is updated as risks change. The board or a designated senior manager oversees it, staff are trained, and service providers are overseen. [3] Whether and how it applies to your firm is a question for counsel.
Practical controls
None of these is a safe harbor. They are the controls the guidance names most consistently.
| Control | Why | Source |
|---|---|---|
| Multi-factor authentication on every account that offers it | NIST calls it one of the fastest, cheapest ways to protect data | [5] |
| Full-disk encryption on laptops and tablets; encryption for email, cloud and portal traffic | Lost devices and intercepted messages | [5] [6] |
| Automatic updates and patching | Closes known holes | [5] |
| Backups, stored separately and tested | A backup that does not restore is not a backup | [5] [6] |
| Access limited to those who need it; access restricted when employees leave | Insider and former-employee risk | [5] [6] |
| Verify client instructions received by email, for example by calling the client about withdrawals | Email takeover and fraud | [6] |
| Vendor due diligence: cybersecurity questionnaire, written attestation, confidentiality agreement | Your clients' data sits with vendors | [6] |
| A written incident response plan with a primary and a back-up contact | The 30-day clock starts when you become aware | [6] [5] |
| A risk assessment that includes where client data is stored and whether it is encrypted | You cannot protect what you have not mapped | [6] |
| Staff training and written expectations | Employees are the usual way in | [5] [6] |
| Consider cyber insurance | NASAA's checklist lists it under recovery | [6] |
NASAA's checklist is organized around identify, protect, detect, respond and recover. [6] NIST's quick-start guide for small organizations covers governing, identifying, protecting, detecting, responding and recovering. [5] FINRA publishes a small firm cybersecurity checklist (listed as July 12, 2021) and a core controls document; they are written for FINRA member firms, which are broker-dealers. [7]
State requirements
- State-registered advisers. NASAA's November 2020 model rule would require written policies that include physical security and cybersecurity. Each state decides whether to adopt it, so check yours. [8]
- The FTC. The FTC's Safeguards Rule applies to financial institutions under FTC jurisdiction, and the FTC lists investment advisors that are not required to register with the SEC as an example. It does not apply to entities under another regulator's enforcement authority, so whether it covers a given state-registered adviser depends on the facts. It requires, among other things, a designated qualified individual, a written risk assessment, access controls, encryption, multi-factor authentication, training, service provider oversight and an incident response plan, and a report to the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers. [9]
- Breach notification laws. All 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify people of a breach. The NCSL page was last updated Jan 17, 2022, so check your state's current law. [10]
A starter plan
- Inventory the systems and vendors that hold client data.
- Turn on multi-factor authentication everywhere it exists, starting with email, custodian and CRM.
- Encrypt every laptop and phone, and test one backup restore.
- Write a one-page incident plan: who decides, who calls the lawyer and the insurer, how you reach clients, and the notice deadline.
- Add a breach-notice clause to vendor contracts and list your vendors with the contract date.
- Train everyone once a year and add the whole program to your annual review.
See building a compliance program. Client testimonials and reviews use client information, so see the SEC Marketing Rule guide as well. For privacy notices, agreements and insurance, see legal essentials for an independent RIA. For vendor choices, see the technology stack guide.
This guide is educational, not legal advice. Talk to securities counsel about how Regulation S-P, Regulation S-ID and state law apply to your firm.