The Deadline Has Passed — Now the Exams Begin
If your firm manages less than $1.5 billion in regulatory assets under management, June 3, 2026 was your compliance date for the SEC's amended Regulation S-P. That deadline is now behind you. What comes next is the part that matters operationally: exam staff showing up to test whether your written policies match your actual practices. The SEC's Division of Examinations explicitly named Regulation S-P as a priority for FY 2026 examinations, and examiners have been briefed on exactly what to look for. This post covers what the rule requires, where firms are most likely to be caught short, and the concrete steps you should take now to be ready.
What Changed Under the Amended Rule
The original Regulation S-P was adopted in 2000. The SEC amended it in May 2024 for the first time in over two decades, updating the framework to reflect modern cybersecurity realities. Larger RIAs — those at or above the $1.5 billion AUM threshold — were required to comply by December 3, 2025. Smaller RIAs had until June 3, 2026.
The amendments touch four areas that did not exist in the original rule or were significantly underdeveloped. First, the amended rule expands the definition of covered information to include all nonpublic personal information in an RIA's possession, not just information the firm collected directly. Second, firms must implement a written incident response program. Third, the rule requires firms to notify affected customers within 30 days of discovering a qualifying data breach. Fourth — and the piece most firms underestimate — firms must establish vendor management programs that require service providers to notify the RIA within 72 hours of becoming aware of a security incident involving the RIA's customer information.
Why the SEC Will Focus on These Four Areas in Exams
The SEC's Division of Examinations held two Compliance Outreach Program events specifically about these amendments — one for large firms in September 2025 and one for small firms in January 2026 — to brief advisers on exam team expectations and notice and production mechanics. That level of pre-deadline outreach signals that examiners are not approaching this as a paperwork review. They are expecting firms to demonstrate that policies are operational, not theoretical.
The practical reality, as multiple compliance practitioners have noted, is that most RIAs already maintain some form of information security policies. The amended rule's real impact is on how firms respond to breaches, notify customers, and document third-party vendor oversight in ways that examiners can actually evaluate. Examiners will not be satisfied with a policy that describes a process that does not match how the firm actually operates.
The Vendor Management Gap Is the Biggest Risk
Of the four new requirement areas, vendor management is where smaller RIAs tend to have the largest gap. The rule requires RIAs to establish and maintain a written vendor oversight program. A defensible program includes a vendor inventory that identifies every third party that touches customer information, a risk-tiering framework that distinguishes critical from non-critical providers, contract language that operationalizes the 72-hour notification requirement, and annual attestations or independent audit reports where appropriate.
The 72-hour vendor notification clock is particularly important to understand. Your vendor's obligation to notify you runs from when the vendor becomes aware of a security incident involving your customer information — not from when you find out. If your service agreements do not explicitly require that notification, you have a gap that examiners will flag. Consider reviewing every material vendor contract now and adding the required notification language where it is absent.
The 30-Day Customer Notification Clock Requires a Defined Trigger
The 30-day customer notification clock runs from when your firm becomes 'aware' of a qualifying incident. Firms that have not internally defined what 'aware' means — which employee role makes that determination, what threshold or signal starts the clock, and how that determination gets documented — are exposed. The clock can begin running before anyone in your organization realizes it has started. Your incident response program should define the internal escalation path explicitly: who receives the initial alert, who makes the awareness determination, who owns the customer notification process, and how all of that gets logged.
Recordkeeping: The Rule Has Books-and-Records Implications
The amended rule adds explicit requirements to maintain written records documenting compliance. That means incident handling records, vendor oversight files, and customer notification documentation all need to be retained in a manner consistent with applicable SEC recordkeeping rules. If an exam team asks for evidence that you ran a tabletop exercise, reviewed a vendor's SOC 2 report, or sent a customer notification within the required window, you need to be able to produce it. Policies without documentation trails are policies that do not exist for exam purposes.
State-Registered RIAs: Watch This Space
The amended Regulation S-P applies to SEC-registered investment advisers, not state-registered advisers. If your firm is state-registered, the amended rule does not bind you directly. However, many state regulators treat federal frameworks as a benchmark when developing their own examination expectations. Consider monitoring your state regulator's guidance and examination reports for signs that similar standards are being adopted at the state level.
What to Do Now: A Practical Checklist
The following steps are organized by urgency. None of them require you to build something from scratch — the goal is to confirm that what you built before June 3 is actually operational and documented.
Confirm your vendor inventory is complete. Identify every service provider that accesses, processes, stores, or transmits customer information on your firm's behalf. This is the foundation of your vendor oversight program. If your inventory is incomplete, prioritize closing those gaps now.
Audit your vendor contracts for the 72-hour notification requirement. Pull the agreements for your highest-risk vendors — custodians, portfolio management systems, CRMs, cloud storage providers — and confirm that each contract includes language requiring notification to your firm within 72 hours of the vendor becoming aware of a qualifying incident. Where the language is missing, consider whether to add it via contract amendment or side letter.
Test your incident response program. Consider running a tabletop exercise that walks through a realistic breach scenario — a vendor notifying you of unauthorized access to client data, for example. Document the exercise, the participants, the findings, and any remediation steps taken. This documentation is exactly what examiners will request.
Define your internal 'awareness' trigger. Your incident response procedures should explicitly state which role or function makes the determination that the firm is 'aware' of a qualifying incident, and what evidence supports that determination. The 30-day customer notification clock runs from that moment.
Review your customer notification template. You should have a draft notification ready to customize for actual incidents. Confirm it covers what the rule requires and that the distribution process — including how you would reach clients whose contact information may have been compromised — is documented.
Ensure recordkeeping obligations are mapped. Identify where incident records, vendor oversight documentation, and customer notification records will be retained, for how long, and by whom. The amended rule's documentation requirements have direct implications for your obligations under Rule 204-2 (the Books and Records Rule).
Update your written policies to match current practice. Examiners will compare your policies to your actual systems, vendors, and escalation paths. If your written program was drafted before certain vendors were onboarded, or before your current incident response structure was in place, update it. Boilerplate that does not map to your firm's actual operations is a liability, not a protection.
The Bottom Line
The June 3, 2026 deadline was not the finish line — it was the starting gun for examinations. The SEC has been transparent that Regulation S-P compliance will be a priority in exams conducted through the rest of this year. Firms that can demonstrate a documented, tested, and operationally grounded program will be in a materially better position than firms that have a policy binder but cannot show it in action. The gap between those two categories is what examiners are trained to find. As of September 1, 2026, there is still time to close it before your firm's next exam cycle — but that window is narrowing.