The compliance clock is ticking—and for many smaller investment advisers, Regulation S-P’s amended requirements are closer than they may seem.

The 2024 amendments to Regulation S-P represent the most significant overhaul by the United States Securities and Exchange Commission (“SEC”) of customer information safeguarding obligations in over two decades. As with many major rule changes, investment adviser firms that wait too long to prepare often find themselves scrambling to implement operational and compliance changes under time pressure.

Before diving in, it is important to clarify scope: the amended Regulation S-P applies to SEC-registered investment advisers – not state-registered investment advisers. However, state securities regulators are likely to view these requirements as a benchmark for reasonable data protection practices, and many of the concepts discussed below are directly relevant to state-registered firms.

What is the Compliance Date?

The SEC published the amended Regulation S-P in the Federal Register on June 3, 2024. The compliance dates for the new requirements under Regulation S-P are the following:

December 3, 2025 – Large SEC-registered advisers ($1.5B+ RAUM); and
June 3, 2026 – Smaller SEC-registered advisers (< $1.5B RAUM).

This is not simply a policy update. It is a structural compliance build-out involving incident response, vendor oversight, and documentation.

Key Components of the Amended Regulation S-P Requirements

The amended rule represents a significant expansion of the SEC’s expectations regarding the safeguarding of customer information.

Written Incident Response Program

Each SEC-registered investment adviser must adopt and maintain a written Incident Response Program that is reasonably designed to detect unauthorized access to or use of customer information, respond effectively to incidents, recover from cybersecurity events, assess the nature and scope of incidents, and implement appropriate containment and control measures.

As a practical matter, this means that firms should be prepared to assess which systems were accessed, what information was or may have been compromised, how long the exposure lasted, and whether the issue resulted from internal error, an outside threat actor, or some combination of the two. Examples of containment and control actions may include disabling compromised accounts, isolating affected systems, rotating credentials, and enhancing monitoring.

Mandatory Customer Notification

The amended rule requires advisers to notify affected individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was accessed without authorization or was reasonably likely to have been accessed or used without authorization. A narrow exception may apply where a reasonable investigation determines that the information has not been, and is not reasonably likely to be, used in a manner that could result in substantial harm or inconvenience.

Vendor Oversight and Notification Expectations

Service-provider oversight is now an express part of the rule framework. If service providers have access to customer information, firms should perform due diligence, monitor vendor controls, and ensure appropriate oversight mechanisms are in place.

Importantly, a firm should have a reasonable basis for believing that it will be notified promptly of a cybersecurity incident involving customer information held by a service provider. That reasonable basis may be established through contractual provisions, due diligence into the service provider’s incident response capabilities, ongoing oversight, or a combination of these measures. In practice, firms should be able to document how they reached that conclusion.

What Should Be in Your Compliance Manual?

At a minimum, SEC-registered investment adviser firms should ensure their policies and procedures address:

Incident detection, escalation, and response protocols
Roles and responsibilities during a cybersecurity threat
Customer notification decision-making framework
Vendor due diligence and monitoring procedures
Processes to ensure prompt notification from service providers
Documentation and recordkpeeing expectations
Periodic testing (e.g., tabletop exercises)

Importantly, policies must reflect how your firm actually operates.

Disposal Requirements

The amended rule clarifies that disposal includes discarding, abandoning, selling, donating, or transferring any medium containing customer information. Advisers must dispose of customer data in a manner that prevents unauthorized access.

Why Smaller SEC-Registered Advisers Should Be Preparing Now

Investment adviser firms that wait until the last minute may find that Regulation S-P implementation requires more than expected. Updating a compliance manual is only one part of the process. Many firms will also need to review vendor relationships, revise due diligence questionnaires, enhance incident escalation procedures, conduct training, and test their incident response process through tabletop exercises or similar reviews.

State-registered investment advisers should also pay attention. Although the amended SEC rule does not directly apply to them, the concepts reflected in the amendments may still inform state expectations through fiduciary-duty principles, information security obligations, and examination priorities.

Recommended CCO Action Items

Chief Compliance Offiers should consider the following actions:

Update the compliance manual to include the IRP and service-provider oversight requirements;
Update or renegotiate service-provider agreements and/or document service providers cybersecurity and incident response policies;
Revise due-diligence questionnaires to reflect cybersecurity and breach-notification expectations;
Conduct internal training;
Test the firm’s IRP through tabletop exercises; and
Review privacy-notice practices and disposal processes.

These steps will help demonstrate a reasonable compliance effort and readiness for regulatory examinations.

Upcoming Webinar

RIA Compliance Consultants, Inc. is hosting the following compliance webinar covering these new requirements:

Course: Regulation S-P Amendments: Incident Response, Vendor Oversight & Compliance Implementation for Investment Advisers

Date: Wednesday, April 29, 2026

Time: 12:00 – 2:00 p.m. U.S. Central Daylight Time

Description: This two-hour course provides investment adviser representatives, supervisors, and compliance professionals with a comprehensive overview of the SEC’s amendments to Regulation S-P. The course explains the key rule changes, including the requirement to adopt a written incident response program, enhanced customer notification obligations, and expanded oversight of service providers. Participants will gain practical guidance on implementing policies and procedures, updating compliance manuals, and conducting defensible internal reviews aligned with regulatory expectations. Through case studies, the course highlights common deficiencies and how firms can mitigate regulatory and operational risks. The program is designed to equip attendees with actionable steps to strengthen data protection, incident response, and vendor oversight practices within their organizations.

Click here to register.

This webinar has also been approved by NASAA* to provide two IAR CE credit hour in the Products & Practices category. A full explanation of how to receive IAR CE credit for this webinar is provided on the product page, linked above.

Availability of Sample Policies & Procedures Under Regulation S-P

To support firms preparing for the amended Regulation S-P requirements:

Annual Compliance Programs

Investment advisers who have engaged us under our Annual Compliance Program (Bronze, Silver, Gold, Platinum or Titanium Package) can access a sample Incident Response Plan, Information Security Plan and Service Provider – Due Diligence policies specifically designed to address the new requirements, through our Knowledge Base.

A La Carte

Investment advisers not enrolled in our annual program may purchase the sample Incident Response Plan, Information Security Plan and Service Provider – Due Diligence in our online store:

Related Resources

Upcoming Reg S-P Deadline for Large Investment Advisers (11/25/2026)

Regulatory Alert – SEC Amends Reg S-P (05/28/2024)

Investment Advisers Should Review Cybersecurity Incident Response Plans of Vendors (03/21/2020)

NASAA Cybersecurity Model Rule Package (05/31/2019)

SEC Risk Alert – Compliance Issues Related to Regulation S-P – Privacy Notices and Safeguard Policies (05/07/2019)

Sample WSP/CoE – Incident Response Program

Sample WSP/CoE – Information Security Plan

Sample WSP/CoE Section – Service Provider – Due Diligence

Cybersecurity – Best Practices Checklist

Cybersecurity – Best Practices for RIA Collecting Devices for Digital Forensic Expert

Recorded Webinar/IAR CE Course: Mastering SEC’s Amendments to Regulation S-P

Disclosures

This regulatory alert is a brief summary which is general in nature and offered only for educational purposes. It should not be considered as a comprehensive review or analysis of this development. There are certain requirements and exceptions outlined in the rule which are not covered in this regulatory alert. This communication is not intended to constitute compliance consulting advice or apply to any particular investment adviser firm’s specific situation without further analysis. This regulatory alert is not a safe harbor or a legal opinion. The reader should study the actual guidance, rule or enforcement action in detail and consult with his or her compliance professionals. This information in this regulatory alert may become out of date.

*NASAA Disclaimer: NASAA does not endorse any particular provider of IAR CE courses. The content of any course offered by RIA Compliance Consultants, Inc. through CE4Advisers.com and any views expressed therein are our own and do not necessarily reflect the views of NASAA or any of its member jurisdictions.

Regulation S-P: The Upcoming Compliance Deadline for Smaller Investment Advisers

April 27, 2026

Reading time : 7 minutes