Confirm Regulation S-P applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Financial · US Securities and Exchange Commission
SEC Regulation S-P (2024 amendments)
Written incident response program and 30-day customer notice. Smaller RIAs became subject June 3, 2026.
Rather skip the call? Get a fixed-fee SEC Reg S-P quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry SEC Reg S-P, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no SEC Reg S-P package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the SEC Reg S-P-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what SEC Reg S-P expects you to have in place.
- A written information security programScoped to the customer information you hold, owned by a named individual.
- Risk assessmentDocumented, repeated on a schedule, and driving what you actually implement.
- Core controlsMFA, encryption in transit and at rest, access reviews, secure configurations, patching and logging.
- Third-party oversightService providers assessed, contracted and monitored for how they protect the data you give them.
- Incident response and noticeA written plan, rehearsed, that meets the notification windows your regulator sets.
- Testing and reportingPeriodic testing of the controls and a report to leadership or the board.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for SEC Regulation S-P
The 2024 amendments ask for a written incident response program, oversight of service providers, and notice to affected customers within 30 days of discovering unauthorized access. For a small adviser that is a program, a vendor list and a rehearsed plan.
We write the program, map the vendors, run the tabletop and keep the evidence your examiner asks for.
What holds client records: tick what applies
Tick what applies and we show what the written program must cover.
The steps
Six steps from "does SEC Regulation S-P apply to us?" to evidence you can show
The whole SEC Regulation S-P journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- Laptops encryptedPassing
- MFA on every accountPassing
- Backups restored this quarterPassing
- Access reviewed this quarterPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for SEC Regulation S-P
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What SEC Regulation S-P costs, in plain numbers
Here is what is published, with who published it and when.
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on SEC Reg S-P, in plain words.
Questions
SEC Regulation S-P questions we get every week
What is Regulation S-P?
An SEC rule that requires broker-dealers, investment advisers, investment companies, funding portals and transfer agents to protect customer information. The 2024 amendments added a written incident response program, service-provider oversight and customer breach notice. It sits alongside Regulation S-ID on identity theft. We help firms put each piece in writing and in practice.Source: SEC compliance outreach, Regulation S-P
When did the amended Regulation S-P take effect?
Larger entities had to comply by 3 December 2025 and smaller entities by 3 June 2026, as FINRA's 2026 oversight report confirms. Both dates have passed, so examiners can now ask for the new program elements at any firm. If your policies predate the amendments, review them now.Source: FINRA 2026 Annual Regulatory Oversight Report, cybersecurity
What must the incident response program include?
Written policies and procedures reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information, including assessing what happened, containing it, and notifying affected customers when required. It should name people, steps and contacts. We write it short enough that staff actually follow it, then rehearse it.Source: SEC compliance outreach, Regulation S-P
How fast must customers be notified?
As soon as practicable and no later than 30 days after the firm becomes aware that unauthorized access to sensitive customer information occurred or is reasonably likely to have occurred, unless the firm reasonably determines the information has not been and is not reasonably likely to be used in a way that causes substantial harm. Document that reasoning either way.Source: SEC compliance outreach, Regulation S-P
What do the amendments require for service providers?
Firms must oversee service providers through due diligence and monitoring, including making sure providers notify the firm as soon as possible, and no later than 72 hours, after a breach affecting customer information. Keep a vendor list, contract terms and review records. Our vendor oversight template covers custodians, CRMs and IT providers.Source: SEC compliance outreach, Regulation S-P
How does Regulation S-P relate to Regulation S-ID?
Reg S-P protects customer information and now requires incident response and notice; Reg S-ID requires an identity theft red flags program for covered accounts. The SEC cited both in its November 2025 order against M Holdings Securities after branch email takeovers. Build them together, since the same controls, such as MFA and call-backs, support both.Source: SEC order, M Holdings Securities, 25 Nov 2025
Do you certify SEC Reg S-P compliance?
No. We do not certify, and the regulator, examiner or independent auditor for SEC Reg S-P has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with SEC Reg S-P?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do SEC Reg S-P separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Financial: PCI DSS · FTC Safeguards · NYDFS 500 · FINRA · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for SEC Reg S-P.
Book the demo and see how one control set carries SEC Reg S-P and everything else you owe. Or leave your details and an engineer replies within one business day.