A new SEC rule quietly became mandatory for every registered investment adviser this summer. Here’s what it actually requires, why so many firms are behind, and what examiners are checking for right now.
Somewhere between December 2025 and June 2026, a regulation most advisory firms had never heard of became one they were legally required to comply with. Regulation S-P, the SEC’s amended Safeguards Rule, finished its two-year rollout this summer, and now it applies to every SEC-registered investment adviser, regardless of size. If your firm checked the compliance box and moved on, it’s worth pausing on a less comfortable question: does your incident response plan actually work when something goes wrong, or has it never been tested outside of a binder?
So what actually changed in June?
Regulation S-P isn’t new. It’s been on the books since 2000. What changed is that the SEC finally gave it teeth. The amended version, adopted in 2024, requires covered firms to build a written cybersecurity and incident response program, not just a privacy policy that sits in a drawer. It sets a 30-day clock for notifying clients after discovering a breach involving their sensitive information. And it requires firms to lock in writing that their vendors will tell them about a breach on the vendor’s end within 72 hours.
The rollout was staggered by firm size. Advisers managing more than $1.5 billion had to comply by December 2025. Everyone else, which is most of the RIA industry, had until June 3, 2026.
Why does “compliant on paper” not mean “compliant”?
Because the SEC has already shown, with a real enforcement action, that it’s checking whether the policy is real, not just filed. In November 2025, the agency settled with a registered advisory firm for $325,000 after email account takeovers across its branch offices exposed thousands of client records. The problem wasn’t a sophisticated hack. It was that the firm had no written information security policy anyone actually followed.
The SEC named Regulation S-P compliance an examination priority for fiscal year 2026. That means it’s not a background rule examiners might get to eventually. It’s one of the things they’re actively looking for.
That last number is the one worth sitting with. Fewer than six in ten firms have actually put more money behind the problem, even as attacks on advisers keep climbing. The average firm managing $250 million or more now spends roughly $15,000 a year on cybersecurity, up from $12,000 the year before, according to Schwab’s benchmarking research. That’s progress. It’s not the same as readiness.
“Most breaches in financial advisory firms start with identity, not infrastructure.”
— A security researcher describing the RIA threat landscape, IT Brew, 2026
Isn’t this my custodian’s problem to solve?
No, and this is the part firms get wrong most often. Vendor relationships are where Regulation S-P actually bites, because most advisers are only as secure as the custodians, portfolio management platforms, and back-office processors they rely on every day. A custodian locking down its own systems does nothing to protect the email server, CRM, or planning software your firm licenses separately. Your obligations under the amended rule follow your client data, not your vendor’s marketing claims about how secure they are.
That distinction matters more than ever, because third-party involvement in financial sector breaches has been climbing. It’s simply easier for an attacker to compromise one shared vendor than to individually target a thousand advisory firms downstream.
What are examiners actually going to ask for?
Firms that treat this as a real operating standard, rather than a filing requirement, tend to organize their response around the same five things.
For firms without a dedicated security leader, this is exactly the gap a fractional CISO is built to close. Someone senior enough to build a defensible program, without the cost of a full-time executive hire most independent and mid-sized firms can’t justify.
