For a small adviser, Regulation S-P compliance is bought before the breach

The week

June 3, 2026 was the compliance date for smaller entities under the SEC’s May 2024 amendments to Regulation S-P. Smaller entities include registered investment advisers with less than $1.5 billion in assets under management, as well as smaller broker-dealers and other covered firms. Larger entities had been required to comply since December 3, 2025. The amendments cover broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents. They require a written incident response program and notice to affected individuals within 30 days of becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. They also require oversight of service providers, including 72-hour breach notice to the firm, and new recordkeeping. The SEC’s Division of Examinations had already named Regulation S-P in its fiscal 2026 priorities, published in November 2025.

Earlier in this series we covered the 2024 amendments and their 72-hour vendor clause, and then the notification presumption that took effect for larger firms in December 2025. This article is about the smaller firms that crossed the line in June 2026, and about money rather than drafting. A large broker-dealer has a security team, retained counsel and a playbook. A twelve-person advisory firm has a chief compliance officer who also runs operations, an outsourced IT provider and a custodian. It cannot build an incident response capability. It has to buy one, and the purchases have to be made before anything goes wrong.

Those purchases fall into three groups that follow the rule’s sequence of events. Response capacity is the people who will investigate. Evidence is the records that let the firm decide whether to notify. Notification capacity is the means to reach customers within 30 days. A gap in any one of them shows up as a failure of the whole program.

Response capacity: the people who will investigate

The rule requires procedures to detect, respond to and recover from unauthorized access to customer information. For a small firm, that means named outside resources: a forensic firm, breach counsel and an IT provider that knows its role. A plan that assigns analysis to an internal team that does not exist will not survive the first incident.

Cyber insurance shapes this purchase more than most firms realize. Many policies require the insured to use the carrier’s panel of forensic firms and lawyers, and to notify the carrier promptly. If the written program names a different firm, the first hours of an incident can be lost reconciling the two. The better approach is to choose from the panel, record the contacts and claim process in the plan, and confirm the policy covers the costs the rule now makes likely: investigation, notification and customer support.

Retainers deserve a hard look. Some forensic firms offer pre-negotiated terms with no upfront fee. Others require a paid retainer that buys guaranteed response times. The outsourced IT provider’s contract should state what it will do in an incident, such as preserving logs, isolating accounts and supporting forensics, and at what rates. Many managed service agreements are silent on this. A thirty-minute tabletop exercise with all three parties tests whether the arrangements work before they are needed.

Evidence: the records that decide whether to notify

Earlier in this series we argued that the evidence a firm keeps before an incident decides how many customers it must notify. A firm can avoid notice only if a reasonable investigation supports a finding of no likely substantial harm or inconvenience. Without logs that show what an intruder saw, notice defaults to everyone in the affected system. For a small firm that argument has a twist. Almost none of the evidence sits on systems it runs.

A typical small adviser’s customer data lives in four places it rents: a cloud email and file suite, the custodian’s platform, a CRM or planning application, and the laptops its IT provider manages. Each holds its own audit trail on its own terms. In the cloud suite, detailed audit records and longer retention are often tied to the subscription tier, so the decision is made at purchase, usually by whoever bought the licenses. The CRM vendor decides what it logs and how long it keeps it. The IT provider’s remote management and endpoint tools record what happened on devices, under the provider’s account.

That makes evidence a procurement item with three parts. The first is the license: checking the tier of each cloud service against what an investigation would need, with the forensic firm on the insurer’s panel advising on which records matter. The second is access: written terms, in contracts or onboarding documents, for how quickly each vendor will export logs and records to the firm or its investigators during an incident. The third is ownership: confirming that logs held in the IT provider’s tools belong to the firm and survive a change of provider.

This is the practical side of the service provider oversight requirement. A vendor’s 72-hour notice tells a firm that something happened. Only the vendor’s records can tell it to whom. For a small firm, a tested export path from the custodian and the CRM is worth more than a signed attestation.

Notification capacity: reaching customers within 30 days

If notice is required, it must generally go out as soon as practicable and no later than 30 days after the firm becomes aware of the incident. Producing a notice is a small task. Producing hundreds or thousands of accurate notices to current mailing addresses, with a call line to answer questions and any credit monitoring offer arranged, is not. Breach notification vendors do this work, often through the insurer’s panel, and their terms are far better arranged in advance.

The rule allows a firm to have a service provider send notices on its behalf, but the obligation stays with the firm. That arrangement must be agreed before an incident. State breach notification laws apply alongside the federal rule and differ by state, so counsel should map how the timelines interact for the states where the firm’s clients live. The firm should also be able to pull a current client contact list quickly, which is harder than it sounds when data sits across the custodian, the CRM and planning software.

The cost case is clearest at this stage. A firm that arranges notification support during an incident pays emergency rates, negotiates under a 30-day clock and may write to every client because it cannot prove a narrower group was affected. Arranged in advance, the same support is a modest annual line alongside the insurance premium and the software tier. Smaller firms can also share effort. Industry associations, compliance consultants and some custodians offer template notices and vetted vendor lists. Those help, provided each firm still checks that the arrangements fit its own systems and policy.

With hindsight

From October 2026, the June date passed quietly, as compliance dates usually do. The first examinations under the amended rule are where the program will be judged. The Division of Examinations’ fiscal 2026 priorities said it would look at policies, controls, vendor oversight and governance under the rule. Examiners can be expected to ask for the incident response program, evidence of testing and the service provider inventory. For small firms, the weakest points remain the ones that cost money: log retention on cloud services, defined incident roles in managed IT contracts and pre-arranged notification support. Firms that aligned their plan with their insurance panel and confirmed their logging settings are better placed than those that only filed a policy document. Organizations should confirm their obligations with counsel, since the rule includes definitions and exceptions that matter in specific cases.