Your June 3 compliance date has passed — and the SEC's 2026 examination priorities put Reg S-P incident response on the list. Examiners are instructed to assess whether your program actually works: live, tested, and evidenced across every vendor, office and entity you depend on. An exam finding is how a paper program becomes a problem you can't quietly fix. Resilis is the platform that makes the program real — and runs the crisis if one comes.
On the SEC 2026 exam list · program untested · evidence assembled on request
Live · dependency-mapped · tested · audit-ready
Open the shape that fits — the answer is the part of Resilis built for it.
The platform acts as your program co-developer — it leverages what you have, runs consistency checks across your plans, policies and procedures, and flags the gaps an examiner would. You stop being the runbook, and work that used to take weeks takes days.
Resilis is built to run a crisis, not just document one. A guided tabletop produces the cheapest credible evidence an examiner looks for — proof the program was tested, with a dated record to show for it. And if a real incident comes, you run it from the same platform. That's the part the binder was never going to do.
Dependency and vendor mapping is native to the platform, not a spreadsheet you rebuild each year. It captures where your key operational processes actually run — outsourced externally to vendors, or internally to a parent, an affiliate, or a shared-services group — so you map the whole operating model and stress-test it before something breaks. Oversight evidence becomes something you pull on demand, not a project you reassemble each exam cycle.
The platform brings stakeholders together so the response spans your whole footprint — not just the entity where the incident started, and with vendors and external partners inside it rather than a separate scramble. Technology, operations and business stay naturally aligned, with the platform as challenger. When something happens, the response is co-orchestrated: you decide, while the platform proposes the next move based on your plans and the situation in front of you.
The custodian, cloud, archive and fund-admin web assembling itself — each node carrying its own oversight evidence, with gaps flagged before an incident finds them.
The live operating picture during a breach — tasks, owners, the 30-day notification clock running, every action written to a dated logbook. The program as something you run, not retrieve.
Resilis more than satisfies the operational-resilience core of Reg S-P — incident response, recovery, service-provider oversight, testing, and the evidence behind them. The same engine was built for Europe's NIS2 and DORA, and maps cleanly onto the BCP, DR, and incident-response provisions of NYDFS Part 500. Resilis is the operational-resilience layer; it works alongside your controls for access, encryption, and the rest of the security stack.
Resilis runs on infrastructure independently certified to ISO 27001, HDS and PCI-DSS — encryption in transit and at rest, least-privilege access, strict tenant isolation, 24/7 monitoring, and daily backups with tested restoration. SOC 2 is underway. And Resilis runs separately, by design, from the systems it protects — so when your own environment is under attack, the platform coordinating the response is the one still standing.
An independent advisor who works alongside Resilis on its US expansion — eighteen years in global-bank COO offices running regulatory remediation and Dodd-Frank implementation at regulated financial institutions. They've been on the side of the table that assembles the evidence when a regulator comes, and know what holds under that pressure. Not a compliance advisor, and this isn't compliance advice — an operator showing you how this evidence is typically examined.
On 17 November 2025 the SEC's Division of Examinations published its 2026 priorities. Reg S-P incident-response programs are named on the list — after the compliance date, examiners will assess whether your program is reasonably designed to detect, respond to, and recover from unauthorized access to customer information. The exam is the mechanism; a finding is how a paper program stops being quietly fixable.
SEC FY2026 Examination Priorities (PDF)Not a demo, and not a compliance assessment — a working session on evidence. Reg S-P isn't examined on whether you have a program; it's examined on what you can produce. You'll leave knowing which artifacts you could pull today and which you'd be reconstructing under pressure.
Book the review