For a small adviser, Regulation S-P compliance is bought before the breach

The week

June 3, 2026 was the compliance date for smaller entities under the SEC’s May 2024 amendments to Regulation S-P, the Securities and Exchange Commission rule that governs how financial firms protect customers’ personal information.

For a twelve-person wealth management firm, the change looks like this. A staff member mentions on a Monday morning that a client received an odd email, apparently from the firm, asking them to confirm their account details. Someone may have gotten into the firm’s email. The chief compliance officer, who also runs operations, now has a question with a federal clock attached: what did the intruder see, and who has to be told?

Smaller entities include registered investment advisers with less than $1.5 billion in assets under management, as well as smaller broker-dealers and other covered firms. Larger entities had been required to comply since December 3, 2025. The amendments cover broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents.

The amendments require a written incident response program, meaning a documented plan for spotting, containing and recovering from a security breach. They require notice to affected individuals within 30 days of becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. That “reasonably likely” wording matters: a firm does not need proof of theft before the duty can apply.

They also require oversight of service providers, including 72-hour breach notice to the firm, so that a vendor that suffers an incident affecting the firm’s customers must tell the firm within three days. And they require new recordkeeping, so the firm can show what it did.

The SEC’s Division of Examinations, the arm that inspects registered firms, had already named Regulation S-P in its fiscal 2026 priorities, published in November 2025. Small firms could read the message easily: the rule had arrived, and examiners would be asking about it.

The 2024 amendments, their 72-hour vendor clause and the notification presumption that took effect for larger firms in December 2025 are already familiar ground. Our subject here is the smaller firms that crossed the line in June 2026, and money rather than drafting.

A large broker-dealer has a security team, retained counsel and a playbook. A twelve-person advisory firm has a chief compliance officer who also runs operations, an outsourced IT provider and a custodian. It cannot build an incident response capability. It has to buy one, and the purchases have to be made before anything goes wrong.

Those purchases fall into three groups that follow the rule’s sequence of events. Response capacity is the people who will investigate. Evidence is the records that let the firm decide whether to notify. Notification capacity is the means to reach customers within 30 days. A gap in any one of them shows up as a failure of the whole program.

Four questions in a fixed order

An incident, in security language, is any event where someone may have gotten into systems or data they should not have. It might be a stolen laptop, a staff member tricked into entering their password on a fake login page, a ransomware attack that locks files until a ransom is paid, or a breach at a vendor that holds the firm’s data. Many incidents turn out to be minor. Some are serious. The trouble is that on day one, you usually cannot tell which.

Incident response is the discipline of settling four things quickly and in order: what happened; whether it is still happening, and how to stop it; what information was exposed, and whose; and who has to be told, by when. The first two are technical and urgent. The third is forensic, meaning it relies on evidence such as system logs, the automatic records software keeps of who logged in, from where, and what they opened. The fourth is legal and operational.

A house fire follows the same sequence. The smoke alarm is detection, the fire brigade is containment, the adjuster and investigator work out what was damaged and why, and then someone has to call the people affected. A large firm has all of those roles in-house. A small firm has a phone list, and whether the right numbers are on it before the fire starts makes most of the difference.

Response capacity: the people who will investigate

The rule requires procedures to detect, respond to and recover from unauthorized access to customer information. For a small firm, that means named outside resources: a forensic firm, breach counsel and an IT provider that knows its role. A forensic firm is a specialist investigator that examines systems after an incident to establish what happened. Breach counsel are lawyers who specialize in data incidents and the notification laws that follow. A plan that assigns analysis to an internal team that does not exist will not survive the first incident.

Cyber insurance shapes this purchase more than most firms realize. Many policies require the insured to use the carrier’s panel of forensic firms and lawyers, and to notify the carrier promptly. A panel is the insurer’s pre-approved list of providers whose rates it has negotiated. If the written program names a different firm, the first hours of an incident can be lost reconciling the two. The better approach is to choose from the panel, record the contacts and claim process in the plan, and confirm the policy covers the costs the rule now makes likely: investigation, notification and customer support.

Retainers deserve a hard look. Some forensic firms offer pre-negotiated terms with no upfront fee. Others require a paid retainer that buys guaranteed response times. The outsourced IT provider’s contract should state what it will do in an incident, such as preserving logs, isolating accounts and supporting forensics, and at what rates. Many managed service agreements are silent on this.

A thirty-minute tabletop exercise with all three parties tests whether the arrangements work before they are needed. A tabletop is a rehearsal around a table, or a video call, where someone describes a plausible scenario and each participant says what they would do next. It costs little and reliably exposes the gaps: the phone number nobody has, the log setting nobody turned on, the contract clause nobody read.

Evidence: the records that decide whether to notify

The evidence a firm keeps before an incident decides how many customers it must notify. A firm can avoid notice only if a reasonable investigation supports a finding of no likely substantial harm or inconvenience. Without logs that show what an intruder saw, notice defaults to everyone in the affected system. For a small firm that argument has a twist: almost none of the evidence sits on systems it runs.

A typical small adviser’s customer data lives in four places it rents: a cloud email and file suite, the custodian’s platform, a CRM or planning application, and the laptops its IT provider manages. A custodian is the institution that actually holds clients’ assets and maintains their account records. A CRM, or customer relationship management system, is the database where the firm keeps client contact details, notes and history.

Each of those holds its own audit trail on its own terms. In the cloud suite, detailed audit records and longer retention are often tied to the subscription tier, so the decision is made at purchase, usually by whoever bought the licenses. The CRM vendor decides what it logs and how long it keeps it. The IT provider’s remote management and endpoint tools, the software it installs on laptops to monitor and maintain them, record what happened on devices, under the provider’s account.

Evidence is therefore a procurement item with three parts. The first is the license: checking the tier of each cloud service against what an investigation would need, with the forensic firm on the insurer’s panel advising on which records matter. The second is access: written terms, in contracts or onboarding documents, for how quickly each vendor will export logs and records to the firm or its investigators during an incident. The third is ownership: confirming that logs held in the IT provider’s tools belong to the firm and survive a change of provider.

This is the practical side of the service provider oversight requirement. A vendor’s 72-hour notice tells a firm that something happened. Only the vendor’s records can tell it to whom. For a small firm, a tested export path from the custodian and the CRM is worth more than a signed attestation.

Notification capacity: reaching customers within 30 days

If notice is required, it must generally go out as soon as practicable and no later than 30 days after the firm becomes aware of the incident. Producing a notice is a small task. Producing hundreds or thousands of accurate notices to current mailing addresses, with a call line to answer questions and any credit monitoring offer arranged, is a much larger one. Breach notification vendors do this work, often through the insurer’s panel, and their terms are far better arranged in advance.

The rule allows a firm to have a service provider send notices on its behalf, but the obligation stays with the firm. That arrangement must be agreed before an incident. State breach notification laws apply alongside the federal rule and differ by state, so counsel should map how the timelines interact for the states where the firm’s clients live. The firm should also be able to pull a current client contact list quickly, which is harder than it sounds when data sits across the custodian, the CRM and planning software.

The cost case is clearest at this stage. A firm that arranges notification support during an incident pays emergency rates, negotiates under a 30-day clock and may write to every client because it cannot prove a narrower group was affected. Arranged in advance, the same support is a modest annual line alongside the insurance premium and the software tier. Smaller firms can also share effort. Industry associations, compliance consultants and some custodians offer template notices and vetted vendor lists. Those help, provided each firm still checks that the arrangements fit its own systems and policy.

Turning the rule into a budget

Because compliance for a small firm is mostly a set of purchases, the sensible treatment is the one the firm gives any other recurring cost: a short list of line items with an owner and a renewal date. Most firms will find the items already exist in some form, scattered across invoices nobody connects.

The first line is the cyber insurance policy. Its renewal is the natural moment to confirm the panel providers, the notification requirements and the cost categories covered, and to ask whether the limits fit the realistic cost of investigating and notifying the firm’s whole client base.

The second line is software subscriptions. The email and file suite, identity and login tools, the CRM and planning applications each have a tier, and each tier determines what records exist when something goes wrong. Reviewing them together, once a year, with a short note from the forensic firm on what matters, turns a scattered set of purchasing decisions into a deliberate one.

The third line is the managed IT contract. Incident duties, rates and log ownership belong in it, and the renewal is the time to add them if they are missing. The fourth is any forensic retainer and the notification vendor arrangement, which may sit under the insurance panel or alongside it.

Put together on one page, these items give a principal or managing partner something they can actually decide on: what the firm spends each year to be ready, what it would cost to be better prepared, and which renewal dates offer the chance to make each change. That page is also exactly what an examiner will want to see behind the written program.

What a broad notice does to a small firm

For a small advisory firm, client trust is the business. Clients choose an adviser because they believe their money and their information are in careful hands. A notice that goes to every client, because the firm could not show which few were affected, does more damage to that trust than the incident itself. A notice that is late, confusing or inconsistent with what the firm tells callers does more still.

The money is concentrated and avoidable. The costs of an incident, investigation, legal advice, notification, call handling and credit monitoring, land at once, often in the same month. Insurance can cover much of it, but only if the firm followed the policy’s rules about whom to call and when. Missing logs can turn a narrow notice into a broad one, multiplying cost. And examiners will look at whether the program existed and was tested, as well as whether a policy was filed.

There is a people cost too. In a small firm, the person running the incident is usually also running compliance, operations and perhaps HR. An incident without arrangements in place consumes that person for weeks. With arrangements in place, their job becomes coordination rather than invention.

Two firms, one compromised mailbox

Take two advisory firms of the same size. Each discovers on the same Monday that a staff member’s email account was accessed by someone else for several days.

At the first firm, the compliance officer opens the incident plan. It names the insurer’s panel forensic firm and breach counsel, with phone numbers and the claim procedure. She calls the insurer first, as the policy requires, then the forensic firm. The cloud email subscription is on a tier that keeps detailed audit records, so investigators can see which messages and files the intruder opened. The managed IT contract says the provider will preserve logs and support the investigation at agreed rates. Within days, the firm can identify the clients whose information was actually exposed. A pre-arranged notification vendor sends accurate letters well inside 30 days, and a call line answers questions.

At the second firm, the plan says “IT will investigate.” The IT provider says incident work is outside its contract and quotes an emergency rate. The compliance officer calls a forensic firm she found online, then learns the insurer requires its own panel. The email subscription keeps only basic logs for a short period, so investigators cannot tell what the intruder read. Counsel advises that, without evidence to narrow it, every client whose information was in the mailbox should be notified. The firm hunts for current addresses across three systems while the 30-day clock runs.

The incident was identical. The difference was a handful of purchases and phone calls made months earlier.

A plan that names real people

A small firm in good shape has a short incident plan that names real outside people, chosen from its insurance panel; cloud subscriptions set to keep the logs an investigation needs; a managed IT contract with defined incident duties and log ownership; tested export paths from its custodian and CRM; and a notification vendor arranged in advance. It has run at least one tabletop and kept the record. The firms that struggle usually went wrong in one of five places:

• A plan that assumes an in-house team. If the people do not exist, the plan does not either.
• Ignoring the insurance panel. Calling the wrong forensic firm can cost time and coverage.
• Buying the cheapest cloud tier without checking logs. The saving can turn into a broad notice later.
• Trusting a vendor attestation instead of testing an export. A signed form does not produce records at 9 p.m. on a Friday.
• Leaving notification to the moment. Emergency rates and a running clock are the worst conditions to negotiate in.

Where a small firm’s plan usually breaks

1. Does our incident plan name a specific forensic firm, breach counsel and notification vendor, are they on our insurer’s panel, and does the plan say whom we call first?
2. What does our managed IT contract say the provider will do in an incident, at what rates, and who owns the logs held in its tools?
3. What audit records do our email, file, CRM and other systems keep, and for how long?
4. How quickly would our custodian and CRM vendor export logs and client data during an investigation, and have we ever tested it?
5. When did we last run a tabletop exercise, and what did we fix afterward?

A final check underlies all five: whether the firm could produce an accurate, current mailing list of affected clients within a few days.

With hindsight

The June date passed without fuss, as compliance dates usually do. There was no rush of headlines, which is normal. The real test of a rule like this comes later, when a firm has an incident or an examiner arrives.

The first examinations under the amended rule are where the program will be judged. The Division of Examinations’ fiscal 2026 priorities said it would look at policies, controls, vendor oversight and governance under the rule. Examiners can be expected to ask for the incident response program, evidence of testing and the service provider inventory. A firm that can hand over a plan naming real providers, a record of a tabletop and a list of vendors with their incident terms is in a very different position from one that can produce only a policy.

For small firms, the weakest points remain the ones that cost money: log retention on cloud services, defined incident roles in managed IT contracts and pre-arranged notification support. Each is cheap compared with an incident handled without it, but each requires someone to make a decision and a purchase.

Firms that aligned their plan with their insurance panel and confirmed their logging settings are better placed than those that only filed a policy document. A principal or managing partner can take a practical step this autumn: ask the compliance lead to walk through the plan against a simple scenario and point to where each name, contract and setting is recorded.

The rule also changed the conversation between small firms and their vendors. Custodians, CRM providers and managed IT firms now serve many clients asking the same questions about incident notice, log exports and record ownership. Firms that asked early, and got answers in writing, have something concrete to show for it.

Organizations should confirm their obligations with counsel, since the rule includes definitions and exceptions that matter in specific cases.