If you run a registered investment adviser or a broker-dealer, the SEC’s amended Regulation S-P stopped being a future deadline this year. Larger firms had to comply by December 2025; everyone else, including the independent advisers that make up most of Portland’s wealth-management community, by June 3, 2026. The amendments don’t ask for anything exotic. They ask for a written incident response program, a 30-day clock on telling clients when their information has been exposed, real oversight of the vendors that hold your data, and records to prove all of it. Here’s what each piece means in practice and how a small firm gets there without hiring a compliance department.

What changed, in plain terms

Regulation S-P has required advisers and broker-dealers to safeguard customer records since 2000. The 2024 amendments added four things:

1. An incident response program. Written policies and procedures for detecting, responding to and recovering from unauthorized access to customer information. The program has to cover assessing what happened, containing it, and notifying affected people.

2. Customer notification within 30 days. When sensitive customer information has been, or is reasonably likely to have been, accessed or used without authorization, you must notify the affected individuals as soon as practicable and no later than 30 days after you become aware of it. The notice has to say what happened, what was taken, when, and what the person can do. The one exception is if you determine the information isn’t reasonably likely to be used in a way that causes substantial harm, and you have to be able to document that conclusion.

3. Service provider oversight. You’re responsible for the vendors that receive, store or process customer information on your behalf: the custodian portal, the CRM, the portfolio accounting system, the document vault, the IT provider. The rule requires due diligence and monitoring, and your arrangements must ensure those providers notify you of a breach within 72 hours so you can meet your own 30-day clock.

4. Broader scope and recordkeeping. The safeguarding and disposal rules now cover all customer information you hold, including information received from other financial institutions, and you have to keep records showing the program exists and runs.

A separate, broader cybersecurity rule for advisers was proposed in 2022 and, as of this writing, hasn’t been finalized; the SEC’s examination priorities already treat cybersecurity as a standing topic regardless. State-registered advisers in Oregon (generally those under $100 million in assets) answer to the Division of Financial Regulation instead, but the expectations have converged, and most custodians and E&O carriers ask for the same things.

The deadline that matters most is 30 days

Everything in the rule hangs on one practical question: when something happens, can you find out quickly, figure out whose information was involved, and tell them within a month?

That’s harder than it sounds for a firm whose technology was set up by a generalist years ago. If an assistant’s mailbox is compromised, you need to know which emails and attachments were opened, which clients they concern, and whether the attacker forwarded anything. Without security logging that retains mailbox and sign-in activity, the honest answer is “we don’t know,” and the conservative response is to notify every client, which is the outcome everyone wants to avoid.

The firms that handle this well have three things in place before anything happens: monitoring that raises the alarm on day one, logs that let someone scope the incident in days rather than weeks, and a one-page incident plan with the 30-day clock, the vendor 72-hour clock and the names of counsel and the insurance carrier already on it.

Vendor oversight without a procurement department

Most small advisers have between eight and twenty vendors touching client data. The rule doesn’t ask you to audit them; it asks you to know who they are, to have satisfied yourself that they protect the data, and to have breach-notification terms in writing. Practically:

  • Keep a vendor inventory: the system, what client data it holds, who at the vendor you’d call, and where the contract or terms live.
  • For the big platforms, the custodian, the CRM, the planning software, their SOC 2 reports and security pages usually cover due diligence. File them.
  • For the small ones, including your IT provider, get the 72-hour notification commitment in writing and ask how they’d know a breach occurred.
  • Review the list once a year. Vendors change hands and terms change.

The controls behind the paperwork

Examiners read the policies, then look for evidence that the controls exist. For an adviser the short list, the same one our cybersecurity services are built around, is:

  • Multi-factor authentication on email, the custodian portal, remote access and every admin account. Carriers and custodians already require it; the rule assumes it.
  • Endpoint detection and response with someone watching it, so a compromised laptop is caught at 2 a.m. rather than Monday morning.
  • Email security tuned for the attacks advisers actually see: spoofed custodian notices, wire-change requests, executive impersonation.
  • Encryption on laptops, phones and backups, and a defined way to send documents to clients that isn’t plain email.
  • Access by role, with departures handled the same day.
  • Backups that have been restored on purpose, because an incident response program that can’t recover isn’t one.
  • Logs retained long enough to scope an incident, usually a year.

Firms that already run on a managed IT arrangement built for financial services tend to have most of this. The gap is usually documentation: the controls exist, but nobody wrote the program, assigned the roles or kept the evidence in one place.

Dividing the work

There are two halves to this, and it helps to keep them straight. Writing the incident response program, the notification procedures and the vendor policy, and defending them in an exam, is compliance work, typically your CCO with an outside compliance consultant. Running the controls, the monitoring, the logging and the vendor technical reviews is IT work. We handle the second for our financial-services clients and work alongside a specialist compliance partner on the first, so the written program describes what actually runs rather than what someone hoped would.

A 60-day plan for a small firm

  1. Week 1: list every system holding client information and who manages it.
  2. Weeks 1–2: confirm MFA, EDR and backup status on every device and account; fix what’s missing.
  3. Weeks 2–4: turn on and retain the logs you’d need to scope a mailbox or portal compromise.
  4. Weeks 3–6: draft the incident response program and the client-notice template; collect vendor security documentation and notification terms.
  5. Weeks 6–8: run a one-hour tabletop exercise on a compromised-mailbox scenario, fix what the exercise exposes, and file the evidence.

None of that is heroic. It’s the kind of program a ten-person advisory firm can stand up in two months and maintain in a few hours a quarter, and it’s the difference between a 30-day deadline you can meet and one you’ll read about in a deficiency letter.