Key takeaways

  • Covered institutions need a written incident response program to detect, respond to and recover from unauthorized access to customer information.
  • Affected individuals must be notified within 30 days when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.
  • Service providers must be overseen and must notify the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach.
  • Firms must keep records documenting compliance, including investigations, breach determinations and notifications.

Who must comply, and by when

The amendments to Regulation S-P became effective on August 2, 2024. Larger entities had to comply by December 3, 2025. Smaller entities — for investment advisers, firms with less than $1.5 billion in assets under management — had to comply by June 3, 2026. Both dates have passed as of this review (November 8, 2026). If your firm is not yet compliant, it is already late.

1. A written incident response program

The program must be reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. In practice, examiners will ask to see:

  • Who leads an incident, and how they are reached at 2 a.m. on a Sunday
  • How an incident is assessed and contained
  • How the firm decides whether sensitive customer information was affected
  • Evidence that the plan has been tested, not only written

2. Customer notification within 30 days

When sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, affected individuals must generally be notified as soon as practicable and no later than 30 days after the firm becomes aware of the incident. Prepare the notice template, the mailing process and the decision record now.

3. Service-provider oversight and 72‑hour notice

Your policies must require oversight of service providers, including due diligence and monitoring designed to ensure they protect customer information and notify you as soon as possible — and no later than 72 hours — after becoming aware of a breach. Review every vendor agreement that touches customer data.

4. Recordkeeping

Keep written policies and procedures, records of incident investigations and breach determinations, service-provider oversight arrangements and copies of notifications sent.

Who counts as a covered institution

The amended rule applies to broker-dealers, funding portals, registered investment companies, SEC-registered investment advisers and registered transfer agents. For compliance dates, the larger-entity group is made up of investment companies with more than $1 billion in assets, registered investment advisers with more than $1.5 billion in assets under management, and most broker-dealers with capital above $500,000, according to Holland & Knight's summary of the release. Everyone else is a smaller entity. If your firm sits near a threshold, read the release itself, because the definitions have details that a summary cannot carry.

What 'sensitive customer information' means

The trigger for the notice duty is not every incident. It is an incident involving sensitive customer information. The release defines that broadly: any component of customer information, alone or combined with other information, whose compromise could create a reasonably likely risk of substantial harm or inconvenience to an identified individual. Social Security numbers and account access credentials are obvious examples. Other identifiable information, such as investment history, can qualify depending on what it reveals. A practical consequence is that you should classify your data before an incident, not during one. A firm that knows which systems hold sensitive customer information can answer the first examiner question quickly.

The notification decision, step by step

When unauthorized access to a customer information system occurs, the rule creates a presumption that notice is required. The firm can avoid notice only if a reasonable investigation shows that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. That determination needs evidence. A sentence in an email saying 'we think it was fine' will not satisfy an examiner. A workable process looks like this:

  • Contain the incident and preserve logs, images and mailbox data before anyone cleans anything up.
  • Identify the systems touched and the customer information those systems hold, using the data inventory.
  • Decide, in writing, whether sensitive customer information was accessed or is reasonably likely to have been, and who made the decision.
  • If notice is required, start the 30-day clock at the determination, and send the notice as soon as practicable. Do not wait for day 30.
  • If you conclude that notice is not required, record the investigation and the reasoning, and keep it with your other compliance records.

The notice must be clear and conspicuous. Expect to describe the incident in general terms, the types of data involved, and what recipients can do to protect themselves, such as checking account statements for suspicious activity and using identity theft resources. Draft this once, with counsel, so that during an incident you are editing, not writing.

Vendors are where most of the work is

The service-provider provision is the part that changes daily operations. Your written policies must provide for due diligence and monitoring of service providers, and for a contract term under which the provider notifies you as soon as possible, and no later than 72 hours, after becoming aware of a breach in a customer information system it maintains. You remain responsible for notifying customers. A provider does not notify them for you, unless you have arranged and documented that. So the vendor list matters: custodians, portfolio systems, CRM, email, backup providers, the managed IT provider, the cloud platform and any analytics tool that stores customer data.

Check each agreement for three things: a notice clock of 72 hours or less, a named contact on both sides who answers on a weekend, and the right to receive the facts you need to make your own decision. Where a vendor will not agree, record the risk decision and the compensating controls. The SEC's rule asks for policies that are reasonably designed, so a documented, reasoned exception is better than silence.

Disposal, annual notices and the records examiners ask for

The safeguarding and disposal provisions now cover all customer information, including information handled on the firm's behalf, with an exception for transfer agents as to some provisions. Data you no longer need can be deleted if no other recordkeeping rule requires you to keep it. Deleting what you do not need is also the cheapest way to reduce the size of a future notice list. The amendments also address annual privacy notices. For recordkeeping, firms must keep written policies and procedures, incident investigations and breach determinations, service-provider oversight arrangements, and copies of customer notices. The retention periods depend on the firm's type and the recordkeeping rule that applies to it, which the release sets out, so confirm the period with your counsel rather than assuming one.

Testing the program

An incident response plan that has never been exercised fails in familiar ways: the phone list is out of date, the person with authority is on a plane, and nobody knows where the customer list lives. A yearly tabletop exercise takes two hours and finds most of these. Run one scenario that involves a compromised mailbox, because email is where many investment firms keep customer information, and one that involves a vendor breach, because it tests the 72‑hour path. Record what you learned and what you changed. That record is itself evidence of a program that is operating, not only written.

How we help

Our team helps firms inventory customer data, write and test incident response programs, review vendor agreements against the 72‑hour requirement and prepare the records an examination asks for. We do not provide legal advice, and your counsel should approve the notification process and the wording of any notice.

A 10‑question self-check

  • Is your incident response program written, approved and dated?
  • Has it been tested in the last 12 months?
  • Do you know where all customer information is stored, including in email and spreadsheets?
  • Is multi-factor authentication enforced on email, CRM and custodial platforms?
  • Are backups tested by restoring them?
  • Do all vendors with customer data have breach-notice terms of 72 hours or less?
  • Is there a current list of those vendors?
  • Is there a customer-notice template ready?
  • Who decides whether an incident is notifiable, and is that decision documented?
  • Would your records satisfy an examiner tomorrow?

If any answer is "no" or "not sure", a readiness assessment will show exactly what to fix first.

Sources

This article is general information, not legal advice. Confirm your obligations with your compliance counsel. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity