Reg S-P raises the bar for incident response for small advisers

On 3 June 2026, the 2024 amendments to the SEC's Regulation S-P (17 CFR 248.30) took full effect for smaller firms — registered investment advisers under about $1.5 billion in assets, plus a range of smaller broker-dealers and transfer agents. Larger firms crossed the same line six months earlier, on 3 December 2025.

The industry asked for more time. Trade groups petitioned the SEC for a six-month extension for everyone. It declined, and the dates stood.

So for a smaller adviser or broker-dealer, a rule that reads like privacy housekeeping is now an operating obligation. The changes are focused on incident-response rule with a privacy label on the front.

What changed

The old Reg S-P asked you to protect customer information in general terms. The amendments make it specific. A covered firm now has to:

1. Run a written incident-response program — procedures to detect an incident, work out how far it reached, contain it, and recover. Not a policy you file; a process you run. (248.30(a)(3))
2. Notify affected customers when their sensitive information was, or probably was, accessed — as soon as practicable, and no later than 30 days. (248.30(a)(3)(iii)) You can hold that notice back only if the U.S. Attorney General asks you to, in writing, on national-security grounds. (248.30(a)(4))
3. Oversee your vendors — conduct due diligence, monitor them, and require by contract that they notify you of a breach within 72 hours of discovering it. (248.30(a)(5))
4. Keep administrative, technical and physical safeguards on customer records, and dispose of them properly. (248.30(a))

Two deadlines, one program, and a clause that has to reach every vendor that touches your customers' data.

Why this is a resilience rule

Every obligation here is operational: detect, contain, recover, notify. That is resilience work, not privacy. The US arrives at it through breach notification rather than a rulebook with "resilience" in the title — of the US, EU, UK and Canadian resilience regimes, the US places the most weight on detecting and reporting incidents.

For a large firm with a security team and a 24/7 incident desk, this is paperwork on top of something that already runs. For a smaller firm, it asks for work a bigger firm has already done and a smaller one often hasn't focused on:

1. The 30-day clock means telling customers, fast, whose data was affected — which means knowing where your sensitive customer data is held and being able to diagnose quickly what is affected.
2. The 72-hour vendor rule only works if it is written into the contract. In most existing agreements it isn't, so this is a contract-by-contract update across the vendor base, not a memo. Even if the contract mentions it, has it been tested? Can the vendor live up to the expectation?
3. An incident-response program is only worth having if it has been tested. One written the week before the deadline hasn't been. It may also be already obsolete as business expands, vendors change and product suites become more complex.

That is not documentation work. It is operating capability — and it is far easier to build before an incident than during one.

Where to start

A sensible order:

1. Find your sensitive customer data — across your own systems and your vendors'. You can't scope a breach, or a notice, without knowing where it is.
2. Write an incident-response plan you can actually run — who does what, when to escalate, who makes the call to notify, how the 30-day clock starts — then run it against a realistic scenario. A tabletop test beats a template.
3. Update the vendor contracts. The 72-hour rule has to land in your service agreements. Keep a plain list: who holds customer data, and whether their contract says it. Also ask your vendors to share their own resilience plans and performance. You may want to test them as well periodically so you are not surprised when time is of the essence.
4. Draft the customer notice now — the wording, the channel, and the narrow Attorney-General delay route — so that if something happens you're sending it, not writing it.

None of this is exotic. It is the continuity, third-party and incident-response discipline that resilient operations already run on; Reg S-P puts a date on it.

The constraint for most smaller firms is not understanding the rule — it is making the response repeatable without a large security team. That is where Resilis does the work: it turns the incident-response program, the scenario testing, and the customer-notification workflow into a system you operate, rather than a process you assemble after the clock has started.

If Reg S-P has moved this up your priority list, it is a short conversation.

An operator's read of a live rule, not legal or compliance advice — applicability is entity- and activity-specific; confirm against the rule text and your own counsel.

Sources: SEC Final Rule, Regulation S-P (Release 34-100155, May 2024) and the SEC Small Entity Compliance Guide; 17 CFR 248.30. Compliance dates: larger entities 3 Dec 2025, smaller entities 3 Jun 2026.

#OperationalResilience #RegulationSP #FinancialServices #IncidentResponse #SEC #COO