Regulation S-P: the 72-hour clock is now your problem

What changed in June 2026

The SEC's amendments to Regulation S-P were adopted in May 2024 with a staggered compliance date. Larger advisers had to comply by December 2025; smaller entities (registered investment advisers with under $1.5 billion in assets under management) by June 3, 2026. If your firm is in the $350 million to $1.5 billion range, the amended rule has applied to you since this summer.

Three things are new, and each one is something an examiner can ask to see.

1. A written incident response program

The safeguards rule now requires written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. “Written” is the operative word. A firm that handles incidents well but has nothing on paper does not meet the standard.

The program has to cover assessment of the incident, containment and control, and notification to affected individuals.

2. The 30-day client notice

If sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, affected individuals must be notified as soon as practicable and no later than 30 days after the firm becomes aware. The notice has to describe the incident, the data involved, and what the individual can do to protect themselves. The only way out of the notice is a documented determination that the information has not been and is not reasonably likely to be used in a way that would result in substantial harm or inconvenience.

The practical consequence: within days of an incident you need to know which client records were in scope. For a firm whose client data lives in Microsoft 365, a custodian portal, and a CRM, that means audit logging has to be on before the incident, not after.

3. The 72-hour vendor clock

Service providers have to notify you within 72 hours of becoming aware of a breach in their systems that involves your customer information. Your written policies must require this of them and you must be able to show how you oversee it. In practice that means a vendor inventory, contract language, and a diligence file for every provider that touches client data: your custodian, CRM, portfolio accounting, document storage, email, and your IT provider.

What an examiner will ask for

• The written incident response program, with a date and an owner.
• The service provider inventory and the diligence or contract language supporting the 72-hour requirement.
• Evidence of recordkeeping: incident logs, notification decisions, and the reasoning behind any decision not to notify.
• The disposal policy for customer information, which the amendments also extended.

Where small advisers get stuck

Most small advisory firms have a Chief Compliance Officer who also runs operations, and a managed IT provider who keeps the laptops working. Neither has been asked to produce a document that connects the two. The incident response program is exactly that document: it names who declares an incident, who pulls the logs, who talks to clients, who talks to the custodian, and how each step is recorded.

If you want to see what your firm would have to show today, that is what our assessment produces. We map your actual systems and vendors against the amended rule and hand you the gap list and the written program. Request an assessment.