Regulation S-P Amendments: Practical Considerations for Smaller Investment Advisers | Kroll

Regulatory Updates

May 21, 2026

Regulation S-P Amendments: Practical Considerations for Smaller Investment Advisers

Cybersecurity regulation of investment advisers has steadily intensified over the past decade. However, the 2024 amendments (the “Amendments”) to the U.S. Securities and Exchange Commission's (SEC or Commission) Regulation S-P represent some of the most consequential updates to the Commission’s investor data protection framework since the rule was originally adopted in 2000.

The Amendments modernize the rule to address the increasing scale and sophistication of cyber incidents affecting financial institutions. As then-SEC Chair Gary Gensler noted when announcing the rule, the Amendments are designed to ensure that “if you’ve got a breach, then you’ve got to notify.” 1

For registered investment advisers (“RIA’s” or “advisers”), who are “covered institutions” 2 under the Amendments, the rule’s real impact will not be the establishment of cybersecurity oversight itself, as most advisers already maintain information security policies and procedures. These advisers will be affected primarily by the requirements to respond to breaches, notify customers and oversee third-party vendors in ways that regulators can evaluate.

Large covered institutions were required to comply with the Regulation S-P 2024 amendments by December 3, 2025, while smaller covered institutions have until June 3, 2026.

If they haven’t, smaller advisers subject to the later compliance date should begin implementation now, because the compliance deadline is fast approaching. Proactive action is critical, particularly where compliance will require coordination with vendors or updates to internal policies, procedures, and workflows, to ensure readiness and avoid gaps at implementation. 

Regulation S-P Rule Requirements: Before and After the Amendments

Requirement Area
Before 2024 Amendments
Current Amendments
Safeguards Rule and Disposal Rule
Required written policies to protect customer information
Expanded to include incident response programs to detect, respond to and recover from data breaches
Incident Response Program
Did not explicitly require this program
Made mandatory for all covered institutions; includes procedures to assess and contain breaches, and notify customers
Customer Notification
Did not federally require breach notification
Required to notify affected individuals within 30 days of discovering unauthorized access/use
Scope of Covered Information
Focused on nonpublic personal customer information
Broadened to include information received from other institutions and sensitive customer data
Service Provider Oversight
Did not specifically address this issue
Required to oversee service providers and ensure they notify institutions within 72 hours of a breach
Record Keeping
Required general compliance documentation
Required to maintain detailed records of policies, incidents, notifications and service provider contracts
Annual Privacy Notice
Required an annual notice, unless specific exceptions applied
Aligned with Gramm-Leach-Bliley Act exceptions; not required if the RIA has no policy changes and limited third-party sharing
Applicability
Applied to broker-dealers, investment companies and advisers
Expanded to include transfer agents and broader definitions of covered institutions
Compliance Timeline
Large entities: 18 months; smaller entities: 24 months3

Incident Response Programs

Maintenance of a formal incident response program is the first significant structural change introduced by the Amendments. RIAs must adopt “reasonably designed” written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information.4

These procedures must include processes to:

  • Assess the scope of an incident and identify affected systems and information5
  • Contain and control the breach to prevent further unauthorized access6
  • Notify affected individuals when sensitive customer information has been compromised7

The SEC notably avoided prescribing highly specific operational steps, instead allowing firms to tailor response programs to their particular circumstances. For smaller RIAs, however, the flexibility of this standard may create uncertainty about how examiners define “reasonably designed.”

Customer Breach Notification

The Amendments also introduce a federal breach notification requirement. Under the Amendments, covered institutions must notify individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was accessed or used without authorization, unless an investigation determines the information is not reasonably likely to cause substantial harm or inconvenience.8

“Sensitive customer information” 9 generally includes any component of customer information alone or in conjunction with any other information, that if compromised, could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.

Put simply, sensitive customer information is data (such as the following) that could facilitate identity theft or fraud:

  • Social Security number
  • Driver’s license and passport numbers
  • Financial account numbers
  • Authentication credentials or login information

Many states and foreign jurisdictions already have breach notification requirements, but the SEC’s 2024 amendments create a uniform federal standard applicable to SEC-regulated entities, with strict documentation and timing expectations. As a result, firms that are already subject to state notification laws, contractual notification provisions or notice requirements will need to carefully harmonize those existing obligations with the Amendments. Being proactive in this area will ensure consistency across policies, procedures and incident‑response protocols and avoid conflicting standards or timelines in the event of a reportable incident.

Service Provider Oversight

Another major element of the Amendments concerns oversight of third-party vendors. Under the Amendments, covered institutions must maintain written policies and procedures reasonably designed to ensure that service providers:

  1. Protect customer information from unauthorized access or use; and
  2. Notify the adviser as soon as possible, but no later than 72 hours after becoming aware of a breach involving customer information systems maintained by the service provider10

Many smaller RIAs rely on external technology platforms such as administrators, custodians, cloud providers and customer relationship management (CRM) systems. Therefore, this provision effectively extends the adviser’s cybersecurity oversight obligations beyond its own internal infrastructure, a potential pain point for many smaller advisers.

A Key Implementation Challenge: Vendor Contract Limitations

The most straightforward way for RIAs to comply with the service provider oversight requirement is to incorporate explicit 72-hour breach notification provisions into vendor contracts.

In practice, however, many smaller RIAs rely on technology providers whose contracts are nonnegotiable or heavily standardized. Advisers could attempt to get written confirmation or quarterly attestations from their vendors, but doing so could prove just as difficult as amending agreements.

The SEC seems to acknowledge that advisers may not always have the leverage to compel contractual changes, particularly with large technology vendors. It modified the final rule by removing a requirement that advisers enter specific contractual provisions with service providers. The rule now requires policies and procedures “reasonably designed” to ensure service providers meet the rule’s expectations.

This update still leaves smaller advisers in a tricky spot, and they should expect examiners to assess whether the firm made meaningful efforts to oversee vendor cybersecurity practices.

Practical Steps

Only time will tell how the SEC interprets “reasonably designed” regarding policies and procedures. For RIAs that cannot renegotiate vendor agreements, several practical measures could help demonstrate good-faith compliance with the rule.

Take Inventory of Current Data and Vendor Status

First, have relevant personnel create a Regulation S‑P “data map” of where customer information and sensitive customer information reside across the organization’s environment. This exercise will highlight what key information you have and where it is. Classify the data into customer information and sensitive customer information categories using the rule’s examples (e.g., Social Security numbers, account names/usernames paired with passwords, PINs) to build the foundation for compliance with the Amendments.

In addition, build a complete vendor inventory that identifies which service providers receive, maintain, process or access customer information. Risk‑rank those vendors based on factors such as the sensitivity of the data involved, the scope of access and the vendor’s criticality to adviser operations. If your organization relies on the service provider, as a covered institution, to issue breach notifications on your behalf, explicitly reflect that reliance in the vendor inventory, risk ranking and, where possible, contractual framework. Clearly document roles, responsibilities, notification timelines and information‑sharing expectations. This risk‑ranking can then be used to inform and prioritize a risk‑based vendor due‑diligence (VDD) approach, including the depth and frequency of precontract reviews, ongoing monitoring and periodic comprehensive assessments.

These exercises should be documented to demonstrate to regulators the steps your organization has taken to internally assess the rule’s key components and their application to your organization.

Document Good-Faith Contract Negotiation Efforts

As previously mentioned, the most straightforward way to comply with the Amendments is to amend existing vendor agreements. Advisers can attempt to negotiate breach notification provisions when feasible and retain documentation of these efforts, including:

  • Proposed contractual language
  • Vendor correspondence
  • Vendor explanations declining the Amendments

This documentation could be important during an SEC examination, as it demonstrates that your organization attempted to address the regulatory requirement via binding contractual provisions.

Send Notice of Regulatory Expectation

Another practical approach is to send formal notice of regulatory expectations to service providers.

Such a letter (or similar correspondence) can:

  • Inform vendors of your organization’s obligations under the Amendments
  • Inform vendors of your expectations
  • Request that vendors notify your organization within 72 hours of discovering a breach affecting relevant systems
  • Create a written record that the vendor was informed of your organization’s regulatory obligations

Even if the vendor cannot amend its contract, this approach establishes a clear compliance record and may encourage vendors to align internal procedures with your organization’s regulatory obligations.

If your organization is a smaller RIA that relies heavily on third-party infrastructure, this step can be a meaningful way to demonstrate that vendor oversight policies are “reasonably designed.”

Strengthen Vendor Due Diligence

Advisers should also incorporate cybersecurity considerations into their VDD processes. If your organization uses a vendor’s due diligence questionnaire or a similar document, incorporate breach notification expectations and data-security policies into that form.

You could request information such as:

  • Summaries of vendor incident response plans
  • Breach notification procedures
  • Independent cybersecurity assessments (e.g., SOC 2 reports)
  • Confirmation of encryption, access controls and monitoring systems

These materials can help your organization assess whether vendors maintain appropriate safeguards for customer information.

Apply Risk-Based Vendor Oversight

Because many RIAs rely on dozens of vendors, it may not be practical to apply identical oversight to each provider.

A risk-based approach may therefore be appropriate, so your organization can focus enhanced oversight on vendors that:

  • Store or process sensitive customer information
  • Maintain systems containing client data
  • Provide critical operational infrastructure

At this stage, RIAs must treat VDD as a substantive compliance obligation, not a check-the-box exercise. To enhance VDD for high-risk vendors:

  • Flag noncompliant vendors for risk evaluations by legal and compliance departments and senior management. This prioritization aligns oversight efforts with your organization’s actual cybersecurity risk profile.
  • Adjust vendor risk ratings to reflect lack of contractual oversight.
  • Maintain detailed records of outreach, responses and decisions.

Leverage Third-Party Risk Assessments

Advisers should consider periodic independent third‑party assessments to support due diligence through documented testing and monitoring, including comprehensive reviews of high-risk areas, precontract and ongoing evaluations of critical vendors and inputs to annual enterprise and vendor risk-ranking processes. Advisers could:

  • Engage independent cybersecurity firms to assess the security posture of critical vendors, especially those unwilling to amend contracts
  • Include findings in vendor oversight documentation to demonstrate proactive risk management

Third-party assessments can help validate that even without contractual guarantees, the vendor’s controls are reasonably sufficient.

Regulatory Considerations

Historical Enforcement Actions Related to Regulation S P Violations

Well before the 2024 amendments, the SEC repeatedly used Regulation S P to govern basic data protection through enforcement actions addressing deficient safeguards and oversight. Enforcement cases have focused on recurring compliance breakdowns, including the failure to implement written safeguards11, weak device‑disposal and vendor controls that left unencrypted personally identifiable information exposed12, inadequate email security and missing multifactor authentication that enabled account takeovers and delayed or misleading breach notifications13 and insufficient identity‑verification procedures that allowed impostors to access customer information.14 More recently, the SEC has emphasized firmwide control design and supervisory accountability across distributed branch networks15.

Taken together, these actions foreshadow the 2024 amendments by underscoring that advisers must maintain fit‑for‑purpose safeguard programs, demonstrate credible implementation and deliver accurate and timely incident communications.

As the Amendments take effect, every RIA legal and compliance professional’s favorite phrase— “Say what you do, and do what you say”—will carry renewed urgency. The SEC’s Division of Examinations explicitly prioritized compliance with Regulation S‑P and Regulation S-ID in its Fiscal Year 2026 Examination Priorities and it will likely test whether written policies are implemented in practice, particularly those regarding incident response and third‑party oversight.

Further, the SEC held two outreach events related to Regulation S‑P compliance and tailored to registrant size (one for large firms on September 25, 2025, and one for small firms on January 22, 2026) as part of its Compliance Outreach Program. The sessions were designed to brief advisers on the 2024 amendments, explain exam team expectations and notice/production mechanics and answer implementation questions, so advisers could prepare for the phased compliance dates.

Examinations will likely focus on whether policies and procedures are not only facially compliant, but also reasonably designed and effectively implemented. Examiners will expect contemporaneous documentation to support key decisions.

The following sections cover specific areas of the rule that examiners may focus on, as well as practical considerations to help advisers prepare for an examination related to Regulation S-P requirements.

Staff Interviews

During its outreach events, SEC staff emphasized that examinations will include targeted interviews across business, technology and compliance functions to assess how Regulation S‑P compliance looks in practice. These discussions will not be limited to compliance leadership and will often extend to personnel with daily responsibility for data protection, vendor management and incident response execution.

Advisers should expect examiners to speak with chief information officers, chief information security officers, chief technology officers, privacy and information‑security personnel, incident‑response leads and, in some cases, key third‑party service providers supporting cybersecurity or data hosting functions.

The SEC staff made clear that these interviews are intended to test alignment between written policies and operational reality, not to elicit perfect answers.

How to Prepare: Before the examination, conduct internal practice interviews across your compliance, IT and security teams to reveal any disconnect between expectations and execution. If gaps exist, it’s better to address them and document remediation than to assume the examinations will remain confined to the written rule text.

Incident Response Governance

Examiners may seek to trace a real or mock incident end‑to‑end and ask who decides (and when) that sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, with particular emphasis likely to be on documenting the adviser’s decision‑making process, rather than hindsight conclusions. Examiners will likely also focus on how your organization met the “as soon as practicable,” but no later than 30 days, notice deadline.

Advisers should expect scrutiny of how incident severity determinations are escalated, whether legal and compliance functions are appropriately involved and how advisers avoid undue delay while the facts are still being gathered. Examiners will also likely look for written documentation of the assessment, containment and notification decisions.

What to Have Ready: Incident response procedures, a timeline of decision points, copies of notices and tabletop results.

Service Provider Oversight

Policies must be reasonably designed to require providers to notify the adviser as soon as possible, but no later than 72 hours, after becoming aware of a breach in a customer information system they maintain. Examiners will likely ask for contracts or program standards reflecting that trigger, plus evidence of due diligence and ongoing monitoring (e.g., questionnaires, SOC reports, remediation tracking).

What to Have Ready: Your vendor inventory and risk rankings, the notice/escalation path per vendor and proof you monitor and follow up, not just check the box.

Data Mapping and Disposal

As a best practice to assess readiness, advisers should conduct an internal risk assessment related to technology/cybersecurity risk, controls, threats and vulnerabilities.

Because the customer information category now expressly includes data handled on your behalf by service providers, examiners may expect a current data map and flow narrative showing where the data lives (e.g., email, CRMs, custodian portals, file shares), who can access it, how access is restricted and monitored, how it’s protected and how it’s disposed of under the expanded Disposal Rule. In particular, advisers with decades of legacy customer records should reassess long‑standing data retention practices and evaluate whether continued retention is necessary for business, legal or regulatory purposes, or if such retention instead introduces avoidable cybersecurity and privacy risk.

Clear, documented retention schedules and destruction protocols—covering both electronic and physical records and extending to service providers—are important, as retaining obsolete or duplicative customer data can complicate incident response, expand the scope of potential harm and increase the likelihood that a cybersecurity incident triggers notification obligations. Stale or incomplete data maps undermine an adviser’s ability to assess risk, respond to incidents and determine whether notification obligations are triggered.

How to Prepare: System‑by‑system inventories, flow diagrams and retention/disposal records that cover both customer and consumer information.

Final Thoughts

The Regulation S-P 2024 amendments reflect a broader shift in how regulators view cybersecurity risk within the investment management area. Data protection is no longer treated solely as an IT issue. It is now viewed as a core component of an adviser’s compliance and fiduciary framework.

But given the operational complexity involved, particularly with vendor oversight and incident response planning, many smaller advisers may struggle with getting up to speed on compliance.

Kroll’s Financial Services Compliance and Regulation team, as well as its Cyber Data Resilience team, can help on all fronts, including implementing cybersecurity systems, assessing risk and demonstrating compliance with the amended rules.

 

Sources
1SEC, Press Release No. 2024‑58, SEC Adopts Rule Amendments to Regulation S‑P to Enhance Protection of Customer Information (May 16, 2024).
217 C.F.R. § 248.30(a)(4)
3Federal Register, Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information (June 3, 2024).
4“Customer information” (17 C.F.R. § 248.30(d)(5)) means, with certain exceptions, any record containing nonpublic personal information as defined in the regulation, about a customer of a financial institution, whether in paper, electronic, or other form, that is in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf regardless of whether such information pertains to (A) individuals with whom the covered institution has a customer relationship or (B) to the customers of other financial institutions, where such information has been provided to the covered institution. A separate definition of “customer information” is provided for registered transfer agents.
517 C.F.R. § 248.30(a)(3)(i).
617 C.F.R. § 248.30(a)(3)(ii).
717 C.F.R. § 248.30(a)(3)(iii).
817 C.F.R. § 248.30(a)(4).
917 C.F.R. § 248.30(d)(9)(i).
1017 C.F.R. § 248.30(a)(5).
11Administrative Proceeding, File No. 3-16827, R.T. Jones Capital Equities Management, Inc. (Securities and Exchange Commission, September 22, 2015), https://www.sec.gov/files/litigation/admin/2015/ia-4204.pdf
12Administrative Proceeding, File No. 3-21112, Morgan Stanley Smith Barney (Securities and Exchange Commission, September 20, 2022), https://www.sec.gov/files/litigation/admin/2022/34-95832.pdf
13Administrative Proceeding, File No. 3-20490, Cetera Advisor Networks LLC, Cetera Investment Services LLC, Cetera Financial Specialists LLC, Cetera Advisors LLC, and Cetera Investment Advisers LLC (Securities and Exchange Commission, August 30, 2021), https://www.sec.gov/files/litigation/admin/2021/34-92800.pdf
14Administrative Proceeding, File No. 3-18840, Voya Financial Advisors, Inc. (Securities and Exchange Commission, September 26, 2018), https://www.sec.gov/files/litigation/admin/2018/34-84288.pdf
15Administrative Proceeding, File No. 3-22562, M Holdings Securities, Inc. (Securities and Exchange Commission, November 25, 2025), https://www.sec.gov/files/litigation/admin/2025/34-104255.pdf

Stay Ahead with Kroll

Financial Services Compliance and Regulation

In the ever-evolving financial services landscape, Kroll's award-winning team offers comprehensive regulatory and compliance services, guiding clients through registration, licensing, and compliance support to minimize risks and enhance efficiency globally.

Learn more

U.S. Financial Services Compliance and Regulation

Navigate the ever-changing U.S. financial regulatory environment with confidence. Kroll provides unparalleled expertise in SEC, FINRA, NFA and CFTC regulations, helping clients mitigate risks, maintain current compliance programs and confidently overcome regulatory challenges.

Learn more