SEC Regulation S-P — Incident Response, Vendor Oversight and Records, Built and Run
If you are an SEC-registered investment adviser, broker-dealer, investment company or transfer agent, the 2024 amendments to Regulation S-P changed what the SEC expects from your IT. You now need a written incident response program, a plan to notify affected customers within 30 days, and documented oversight of every service provider that touches customer information. We build and run the technical side of that program.
Every firm’s compliance date has now passed: larger entities on December 3, 2025, smaller entities on June 3, 2026. If your program still lives on paper, now is the time to make it real.
Regulation S-P in plain English
Regulation S-P has long required SEC-regulated firms to safeguard customer records. In May 2024 the SEC adopted amendments that turned a general duty into specific, checkable requirements. They took effect on August 2, 2024, with compliance phased in by firm size.
Who it applies to. “Covered institutions”: SEC-registered investment advisers, broker-dealers (including funding portals), investment companies and registered transfer agents. Larger entities include advisers with $1.5 billion or more in regulatory assets under management and fund groups with $1 billion or more in net assets; most other firms fall in the smaller-entity group. Both deadlines have now passed.
| What the amended rule requires | What it means in practice |
|---|---|
| Incident response program | Written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information, including assessing what happened and containing it |
| Customer notice | Tell affected individuals as soon as practicable, and no later than 30 days after you become aware, when their sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization — unless a reasonable investigation shows harm is not reasonably likely |
| Service-provider oversight | Written policies to oversee service providers through due diligence and monitoring, so they protect customer information and notify you no later than 72 hours after becoming aware of a breach in a system they maintain |
| Broader scope | Safeguards and disposal duties now cover “customer information” more broadly, including information you hold about customers of other financial institutions |
| Recordkeeping | Written records of your policies, incident investigations, the basis for any decision not to notify, service-provider oversight, and the notices you send |
You keep the obligation. You may use a service provider to send notices for you, but you remain responsible for making sure affected individuals are told. The same holds for the program itself.
What we do, and what we don’t. Regulation S-P has no certificate to earn — whether your firm meets it is a judgment for your compliance officer, your counsel and, ultimately, the SEC examiner. CRC Cloud does not issue compliance certifications, and we do not give legal advice. We build and run the controls, document them, find the gaps and close them, and have the evidence organized before the examiner asks. If they flag something, we remediate it fast. Align, implement and prepare — never certify or guarantee.
The Regulation S-P controls we implement and operate
The technical program the rule requires is the security operation we run every day:
Incident Response Support
A written incident response plan for the technical side of your program: how an incident is detected, contained, investigated and recovered from, and what evidence is kept. When something happens, containment is included in your plan; helping you find out what was accessed, so the notice decision rests on facts, is quoted project work.
Prompt Notice to You
If we discover a breach affecting your systems or data, our agreement commits us to tell you within 72 hours, and within 24 hours on Secure IT. That matches the rule’s service-provider standard, and on Secure IT it gives you a head start on your 30-day customer clock.
Service-Provider Oversight Documentation
The rule expects you to document how you oversee us. We complete your security questionnaires and due-diligence requests, provide documentation of the controls we run, and support your periodic reviews, so your vendor file on us is complete.
MFA, Access Control & Encryption
Multi-factor authentication on every system that holds customer information, least-privilege access, and encryption at rest and in transit, including email — the controls that keep a lost laptop or a stolen password from becoming a customer notice.
Backups You Can Trust
Encrypted backups with the most recent 30 days locked against change or deletion, so a ransomware event becomes a recovery exercise instead of a crisis.
Records You Can Show an Examiner
Incident records, control documentation, access reviews and change records, organized and ready to hand to an examiner as evidence of what is actually running — with continuous monitoring and log collection behind them.
What stays your responsibility
The rule places the obligation on your firm, and some parts of it can’t be handed to an IT provider:
- Adopting the written policies and procedures, and having them approved under your compliance program
- Deciding whether an incident requires customer notice, and drafting and sending the notices (we supply the technical facts)
- Overseeing your other service providers: custodians, CRM and portfolio platforms, and anyone else who touches customer information
- Your privacy notices, your annual compliance review and your regulatory filings
- Legal interpretation of the rule — for that, talk to your compliance counsel
Where Regulation S-P readiness lives in our plans
MFA, encryption, monitoring, backups and incident response support are the substance of Secure IT, built on Core IT’s foundation, and Secure IT carries our 24-hour breach-notice commitment. Already have internal IT or an outsourced compliance consultant? Co-Managed IT adds the security depth alongside them. See every published rate →
Regulation S-P is one lane of a wider practice. See how we approach the closely related FTC Safeguards Rule and the rest on our compliance hub →
Regulation S-P, asked and answered
We’re a small RIA. Does this apply to us?
If you are registered with the SEC, yes. Smaller entities had until June 3, 2026, and that date has passed. If you are state-registered rather than SEC-registered, ask your compliance counsel which privacy and security rules apply to you — the FTC Safeguards Rule often does.
Does CRC Cloud count as one of our service providers under the rule?
If we manage systems that hold or process your customer information, you should treat us as one and document your oversight of us. We make that easy: completed security questionnaires, documentation of the controls we run, and a commitment in our agreement to notify you of a breach within 72 hours, or 24 hours on Secure IT.
Can you send the customer notices for us?
The decision to notify, and the content of the notice, belong to your firm and your counsel. That decision depends on knowing what was accessed and when. Containing an incident is included in your plan; helping you investigate and recover afterward is project work, quoted in writing before it starts, and a formal forensic investigation is done by a specialist firm you or your insurer engage, with our cooperation.
Will working with you make us compliant?
No IT provider can promise that, and anyone who does is overselling. Compliance is your firm’s program and an examiner’s judgment. What we do is make sure the technical controls your program describes are actually running, and that you can prove it.
What happens on the free assessment?
Thirty minutes with the owner. We look at where your customer information lives, which controls are in place, and where the gaps are against what the rule expects. A written quote follows within one business day. No pitch deck, no obligation.
Priced openly, like everything else we do. SEC Regulation S-P work carries a published uplift of +20% on the per-user plan and per-server management fee — documentation, evidence and audit support are real recurring hours, so we price them instead of hiding them in a quote. Secure IT is the starting point for compliance work — Core IT is not an option for a regulated environment, because the frameworks lean on the monitored layer it adds. On Secure IT that is $300 per user per month — covering the incident-response documentation, oversight records and examiner support. Backup, private cloud resources and add-ons stay at their flat published rates. See the full compliance uplift table →