The SEC\u2019s amendments to Regulation S-P expand what firms must do to detect, respond to, and recover<\/strong> from any unauthorized access to customer information\u2014and to notify affected individuals promptly.<\/p>\n We align your IRP to the lifecycle regulators expect: identify<\/strong> (assets\/data), protect<\/strong> (controls), detect<\/strong> (monitoring\/logging), respond<\/strong>, and recover<\/strong>\u2014drawing on industry frameworks (e.g., NIST) as guides<\/i>, not prescriptions.<\/p>\n What this looks like in practice<\/strong><\/p>\n We implement workflows to:<\/p>\n Advisers can\u2019t outsource responsibility. We help build written policies and procedures<\/strong> requiring oversight of service providers\u2014including due diligence, ongoing monitoring, breach detection expectations, 72-hour<\/strong> provider-to-firm notifications, and (where agreed) provider-issued customer notices.<\/p>\n Key controls we implement<\/strong><\/p>\n We operationalize retention of: IR policies\/procedures (including disposal), detection and response artifacts, customer notices (or determinations that notice wasn\u2019t required), any Attorney General delay letters, and records of provider-issued notices on the firm\u2019s behalf.<\/p>\n We run targeted trainings so officers and staff understand roles and the new timing standards, and we conduct exercises to validate that procedures work end-to-end.<\/p>\n Registered investment advisers\u2014including RIAs to private funds\u2014are covered institutions<\/strong> under Reg S-P. Safeguarding obligations can extend to customer information received from other financial institutions<\/strong> even without a direct firm-to-individual customer relationship.<\/p>\n SEC examiners tailor scope to your services and data flows<\/strong> across on-prem, cloud, vendors, and partners, looking for evidence that policies match practice. We prepare you for the initial information request<\/strong>, walkthroughs\/testing, and documentation of your risk program, controls, and IRP.<\/p>\n Protecting Investor Data Under the Updated Regulation S-P What changed, what it means, and what we\u2019re doing together Why this matters now The SEC\u2019s amendments to Regulation S-P […]<\/p>\n","protected":false},"author":2,"featured_media":19679,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[112,134,113,3,139,102,103,16,25,15,106,137,24,89,115,90,26,127],"tags":[],"class_list":["post-19677","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bec","category-breaches","category-business-email-compromise","category-cyber","category-fraud","category-hedge-fund","category-investment-adviser","category-malware","category-pii","category-privacy","category-private-equity","category-private-funds","category-ransomware-attack","category-regulatory","category-ria","category-sec","category-table-top","category-technology"],"yoast_head":"\nWhat\u2019s new at a glance<\/h3>\n
\n
How we\u2019re helping investment advisers comply<\/h2>\n
1) Build and tune a fit-for-purpose Incident Response Program<\/h3>\n
\n
2) Operationalize the 30-day notification standard<\/h3>\n
\n
3) Strengthen third-party oversight and breach intake<\/h3>\n
\n
4) Recordkeeping and evidence<\/h3>\n
5) Training and table-top testing<\/h3>\n
What investors can expect if something happens<\/h2>\n
\n
Special notes for private fund advisers<\/h2>\n
What exam teams are focusing on (and how we prepare you)<\/h2>\n
Action checklist (we\u2019ll drive this with you)<\/h2>\n
\n