SEC Regulation S-P: The Incident Response Program Firms Now Need

The SEC's amended Regulation S-P requires broker-dealers, funding portals, investment companies, SEC-registered investment advisers and transfer agents to keep a written incident response program for unauthorized access to customer information. That program must include notice to affected individuals within 30 days, and oversight that makes service providers report breaches to you within 72 hours. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so every covered firm should now be in compliance.

This is a practical summary, not legal advice. Confirm your obligations with counsel and the rule text on sec.gov.

What changed in May 2024

Regulation S-P has governed how certain financial firms treat nonpublic personal information since 2000. In May 2024 the SEC adopted amendments that, according to the SEC's fact sheet, set a federal minimum standard for data breach notification to affected individuals. The headline changes are:

• A required incident response program, built into the written policies and procedures you already keep under the safeguards rule.
• Customer notification when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.
• Service provider oversight, including a 72-hour breach notice from vendors to you.
• A broader definition of customer information, covering information about your own customers and information you receive from other financial institutions about their customers.
• Written records documenting compliance with the safeguards and disposal rules.
• Transfer agents brought under both the safeguards rule and the disposal rule.
• The annual privacy notice rule aligned with the FAST Act exception, so firms that meet its conditions don't have to send one.

Who is covered

The SEC calls these firms "covered institutions":

• Broker-dealers
• Funding portals, which already had to follow Regulation S-P as it applies to brokers under Regulation Crowdfunding
• Investment companies (registered funds)
• Investment advisers registered with the SEC, including registered private equity and private fund managers
• Transfer agents registered with the SEC or another appropriate regulatory agency

State-registered advisers and exempt reporting advisers are not SEC-registered, so they fall outside the definition. They may still face state privacy and breach-notification laws. If you advise private equity funds and recently registered with the SEC, Regulation S-P applies to you in full.

Compliance dates: larger vs smaller entities

The amendments took effect on August 2, 2024, with a tiered compliance period based on firm size (SEC Small Entity Compliance Guide):

Industry groups asked the SEC to push both dates back, but the original dates stood. As of October 2026 both have passed, and law firms are now focused on exam readiness. The SEC's Division of Examinations named Regulation S-P a fiscal year 2026 examination priority, so expect examiners to ask for your program, your vendor oversight records and evidence that both work.

The incident response program

Under the amended safeguards rule, your written policies and procedures must include an incident response program that is reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. At a minimum, it must include procedures to:

1. Assess the nature and scope of any incident.
2. Contain and control the incident to prevent further unauthorized access or use.
3. Notify affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless an exception applies.
4. Oversee service providers through written policies covering due diligence and monitoring.

The rule doesn't hand you a template. It expects a program sized to your firm that people can actually run. In practice, that means named roles, an escalation path, evidence preservation steps, a decision log and a tested plan. If you don't have outside responders lined up, an incident response retainer means the contracting is done before the clock starts. See our guide to what an IR retainer includes.

Customer notification: the 30-day rule

You must notify affected individuals as soon as practicable, but not later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Key points:

• The clock starts at awareness, not when your investigation ends. You can investigate during the 30 days to decide whether notice is required.
• Sensitive customer information is information that, alone or combined with other information, could create a reasonably likely risk of substantial harm or inconvenience. Examples include a Social Security number, or a user name or account number combined with a security code or other information that could be used to access the account.
• The exception: no notice is required if, after a reasonable investigation, you determine that sensitive customer information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience. Document that investigation and its conclusion.
• What the notice says: details about the incident, the information involved, and what affected individuals can do to protect themselves.
• Law enforcement delay: notice can be delayed only if the U.S. Attorney General determines that it poses a substantial risk to national security or public safety and tells the SEC in writing.

Regulation S-P's notice goes to affected individuals, not to the SEC. State breach-notification laws still apply alongside it, and they may have different triggers, content rules and regulator notices.

Service providers and the 72-hour notice

Most advisers and broker-dealers rely on custodians, CRMs, portfolio systems, cloud email and IT providers that hold customer information. Your program must include written policies that require oversight of these service providers, through due diligence and monitoring, to make sure they take appropriate measures to:

• protect against unauthorized access to or use of customer information; and
• notify you as soon as possible, but no later than 72 hours after becoming aware of a breach that results in unauthorized access to a customer information system they maintain.

A vendor's 72-hour notice may be what starts your own 30-day clock, so it has to reach the right person. You can agree in writing for a service provider to send customer notices on your behalf, but the covered institution stays responsible for making sure they go out and comply. For a repeatable approach to vendor tiering, questionnaires and contract terms, see vendor risk management for SMBs.

Recordkeeping

Covered institutions other than funding portals must make and keep written records documenting compliance with the safeguards and disposal rules. Expect to keep:

• the written incident response program and safeguards and disposal policies;
• records of each detected incident and how you responded;
• any investigation and determination that notice was not required;
• customer notices sent;
• service provider oversight policies, due diligence and monitoring records, and related agreements.

Retention periods follow the existing books-and-records rules for each type of institution, so confirm the period that applies to your firm with your compliance team.

Where NYDFS Part 500 overlaps

Most RIAs and broker-dealers are not licensed by the New York Department of Financial Services, so Part 500 doesn't apply to them directly. Financial groups often include an entity that is, such as a New York-chartered trust company, an insurance agency or a licensed lender. Where both rules apply, the timelines run in parallel: Part 500 requires notice to DFS within 72 hours of determining a reportable cybersecurity event, while Regulation S-P requires customer notice within 30 days. One incident response plan can serve both, provided it maps each trigger, recipient and deadline. Our NYDFS Part 500 checklist and NYDFS compliance services cover the DFS side.

Regulation S-P compliance checklist

1. Confirm your tier (larger or smaller entity) and record the basis, such as AUM, net assets or small-entity status.
2. Map customer information: which systems and vendors hold it, including information received from other financial institutions.
3. Write or update the incident response program with detection, assessment, containment, recovery and notification procedures, plus named owners.
4. Build the notification workflow: a 30-day tracker that starts at awareness, a "substantial harm or inconvenience" assessment template, approved notice templates and a contact list for affected individuals.
5. Inventory service providers with access to customer information. Run due diligence, set monitoring and confirm each one will notify you within 72 hours.
6. Update contracts where needed, and decide whether any vendor will send customer notices on your behalf.
7. Line up outside help: breach counsel, forensic responders and your cyber insurer's requirements.
8. Test the plan with a tabletop exercise that includes a vendor-originated breach.
9. Set up recordkeeping for incidents, determinations, notices and vendor oversight.
10. Review the annual privacy notice against the FAST Act exception.
11. Map overlapping obligations, including state breach laws and NYDFS Part 500 where any group entity is licensed in New York.

Frequently Asked Questions

Does Regulation S-P apply to private equity and private fund managers?

It applies to SEC-registered investment advisers, so a PE or private fund manager registered with the SEC is covered. Exempt reporting advisers are not registered and fall outside its definition of covered institutions.

When did the Regulation S-P amendments take effect?

They became effective on August 2, 2024. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so both dates have now passed.

How long do we have to notify customers after a breach?

As soon as practicable, and no later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

Do we have to notify the SEC under Regulation S-P?

No. Regulation S-P's notice goes to affected individuals. Other rules, state breach laws or NYDFS Part 500 may require separate regulator notices.

Can our vendor send breach notices for us?

Yes, under a written agreement. But the covered institution keeps ultimate responsibility for making sure the notices are sent on time and meet the rule.

What is the 72-hour requirement in Regulation S-P?

Your service provider oversight policies must ensure vendors notify you as soon as possible, and no later than 72 hours after becoming aware of a breach of a customer information system they maintain.

Need an incident response program that holds up in an SEC exam? Defensible helps advisers, fund managers and broker-dealers build and test Regulation S-P programs, assess service providers and respond when something goes wrong. A senior responder engages within one hour. Talk to our financial services security team or get started.