{"type":"practice_guide","title":"RIA Cybersecurity: Regulation S-P, Regulation S-ID and Practical Controls","lead":"As of Oct 20, 2026, amended SEC Regulation S-P requires SEC-registered advisers to run an incident response program and to notify affected customers no later than 30 days after becoming aware of unauthorized access, with compliance dates of Dec 3, 2025 for larger entities (advisers with $1.5 billion or more in assets under management) and Jun 3, 2026 for smaller ones.","as_of":"2026-10-20","facts":{"summary":"Amended Regulation S-P (incident response, customer notice, service providers, compliance dates), Regulation S-ID, practical controls and state rules.","key_facts":["Both Regulation S-P compliance dates have passed: Dec 3, 2025 for larger entities and Jun 3, 2026 for smaller entities.","Advisers with $1.5 billion or more in assets under management are larger entities for the Regulation S-P compliance dates.","Service providers must notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach of a system holding customer information.","Regulation S-ID requires a written identity theft prevention program of an SEC-registered adviser that is a financial institution or creditor with covered accounts."]},"sources":[{"url":"https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf","checked":"2026-10-20","label":"U.S. Securities and Exchange Commission: Enhancements to Regulation S-P: A Small Entity Compliance Guide"},{"url":"https://www.sec.gov/files/rules/final/2024/34-100155.pdf","checked":"2026-10-20","label":"U.S. Securities and Exchange Commission: Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Release 34-100155 (adopting release)"},{"url":"https://www.law.cornell.edu/cfr/text/17/248.201","checked":"2026-10-20","label":"Legal Information Institute, Cornell Law School: 17 CFR 248.201, duties regarding the detection, prevention, and mitigation of identity theft (Regulation S-ID)"},{"url":"https://www.sec.gov/files/34-100155-fact-sheet.pdf","checked":"2026-10-20","label":"U.S. Securities and Exchange Commission: Fact Sheet: Final Rules, Enhancements to Regulation S-P"},{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf","checked":"2026-10-20","label":"National Institute of Standards and Technology: NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide (SP 1300)"},{"url":"https://www.nasaa.org/wp-content/uploads/2020/04/Cybersecurity-Checklist-Guidance-3-19-20.pdf","checked":"2026-10-20","label":"NASAA: Cybersecurity Checklist for Investment Advisers (guidance)"},{"url":"https://www.finra.org/rules-guidance/key-topics/cybersecurity","checked":"2026-10-20","label":"FINRA: Cybersecurity (key topics, with small firm checklist and core controls)"},{"url":"https://www.nasaa.org/56250/nasaa-members-adopt-model-rule-consolidating-existing-policies-and-procedure-for-state-registered-ias/","checked":"2026-10-20","label":"NASAA: NASAA members adopt model rule consolidating existing policies and procedure for state-registered IAs"},{"url":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","checked":"2026-10-20","label":"Federal Trade Commission: FTC Safeguards Rule: What Your Business Needs to Know"},{"url":"https://www.ncsl.org/technology-and-communication/security-breach-notification-laws","checked":"2026-10-20","label":"National Conference of State Legislatures: Security Breach Notification Laws"}],"related":[{"title":"Advisor Capacity Calculator: How Many Households Can You Serve?","url":"https://advisoriq.com/practice/calculators/advisor-capacity/"},{"title":"Advisor Fee Revenue Calculator: AUM Fee Schedule vs Flat Fee","url":"https://advisoriq.com/practice/calculators/fee-revenue/"},{"title":"How to Start an RIA: SEC vs State Registration","url":"https://advisoriq.com/practice/guides/how-to-start-an-ria-sec-vs-state-registration/"},{"title":"How to Price Advisory Services: Fee Schedules and Pricing Models","url":"https://advisoriq.com/practice/guides/advisor-fee-schedules-and-pricing-models/"},{"title":"Hiring Your First Advisor or Operations Hire: Roles, Licensing and Structure","url":"https://advisoriq.com/practice/guides/hiring-first-advisor-or-operations-hire/"},{"title":"How to Build an RIA Compliance Program: Rule 206(4)-7, CCO and Annual Review","url":"https://advisoriq.com/practice/guides/compliance-program-for-a-new-ria/"},{"title":"Legal Essentials for an Independent RIA: Entity, Advisory Agreement and Insurance","url":"https://advisoriq.com/practice/guides/legal-essentials-for-an-independent-ria/"},{"title":"How to Choose an RIA Custodian: What Custodians Do and What to Ask","url":"https://advisoriq.com/practice/guides/choosing-an-ria-custodian/"},{"title":"Financial Advisor Technology Stack: What You Need, How It Connects and How to Budget","url":"https://advisoriq.com/practice/guides/advisor-technology-stack/"},{"title":"Marketing for Financial Advisors: How to Attract Clients","url":"https://advisoriq.com/practice/guides/marketing-for-financial-advisors/"},{"title":"SEC Marketing Rule for Advisors: Testimonials, Ratings and Performance","url":"https://advisoriq.com/practice/guides/sec-marketing-rule-for-advisors/"}],"notes":["Educational, not legal, tax or investment advice.","Practice management content is not eligible for CFP Board CE. CFP Board plans to allow up to five hours of it per cycle once its Q4 2027 changes take effect."],"url":"https://advisoriq.com/practice/guides/ria-cybersecurity-and-client-data-protection/","citation":"AdvisorIQ, as of 2026-10-20. https://advisoriq.com/practice/guides/ria-cybersecurity-and-client-data-protection/","license":"https://advisoriq.com/license/","publisher":"AdvisorIQ, independent education for financial advisors","disclaimer":"Summaries of rules set by designation bodies and regulators, which have the final word."}