The SEC has two sets of cybersecurity rules that matter to Los Angeles firms. Amended Regulation S-P requires broker-dealers, SEC-registered investment advisers, investment companies, funding portals and transfer agents to keep a written incident response program and to notify affected customers no later than 30 days after becoming aware of a breach. Public companies must report a material cyber incident on Form 8-K within four business days of deciding it is material.
Both rules are now in force. The Regulation S-P deadline for larger firms was December 3, 2025, and for smaller firms June 3, 2026. This guide covers what each rule requires, who it applies to, how they compare, and what a small advisory firm or broker-dealer should have on file today. If you want the wider picture first, our guide to security compliance shows how the SEC rules sit next to HIPAA, PCI and the FTC Safeguards Rule.
Which SEC cybersecurity rules apply to your firm?
It depends on what kind of firm you are. Regulation S-P is a privacy and data protection rule for regulated financial firms. The 2023 disclosure rules are for companies that file reports with the SEC, meaning public companies. A small registered investment adviser and a listed company face different obligations, and some firms face neither.
| Type of firm | SEC cyber rule that applies | Core obligation |
|---|---|---|
| Investment adviser registered with the SEC | Regulation S-P (2024 amendments) | Incident response program, 30-day customer notice, vendor oversight, records |
| Broker-dealer or funding portal | Regulation S-P (2024 amendments) | Same as above |
| Investment company (mutual fund, BDC) | Regulation S-P (2024 amendments) | Same as above |
| Registered transfer agent | Regulation S-P (2024 amendments) | Now covered by the safeguards rule as well as the disposal rule |
| Public company (files a 10-K) | Form 8-K Item 1.05 and Regulation S-K Item 106 | Report material incidents in four business days; describe the security program yearly |
| State-registered adviser in California | Not covered by Regulation S-P, which applies to SEC-registered advisers | Licensed and examined by the California DFPI; California breach notice law still applies |
That last row matters for many small firms in Los Angeles. The California Department of Financial Protection and Innovation says the states regulate investment adviser firms with less than $100 million in assets under management. Those firms answer to the DFPI rather than the SEC. They still have to follow California's breach notification law, which requires notice to any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, and a sample notice to the Attorney General when a single breach affects more than 500 residents. Ask your compliance counsel which federal privacy rule covers your firm; for many financial businesses outside SEC oversight, the answer is the FTC Safeguards Rule.
What the 2024 Regulation S-P amendments changed
The SEC adopted the amendments on May 16, 2024, and they took effect on August 2, 2024. The SEC first adopted Regulation S-P in 2000, and the amendments address the technology risks that have grown since then. According to the SEC's small entity compliance guide, the amendments do six things.
First, every covered firm needs written policies and procedures for an incident response program that is reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. Second, the program must include notice to affected individuals. Third, the firm must oversee its service providers, including a duty for them to report breaches within 72 hours. Fourth, the disposal rule now covers customer information as well as consumer information, and registered transfer agents now fall under the safeguards rule too. Fifth, firms must keep written records showing they comply. Sixth, the annual privacy notice requirement now includes a statutory exception from the FAST Act.
Regulation S-P compliance dates and size thresholds
The SEC gave larger firms 18 months and smaller firms 24 months from Federal Register publication. The size tests come from Table 3 of the adopting release. Any covered firm that does not meet the larger entity test counts as a smaller entity.
| Entity | Counts as a larger entity if | Compliance date |
|---|---|---|
| Registered investment adviser | $1.5 billion or more in assets under management | December 3, 2025 |
| Investment company | Net assets of $1 billion or more, together with its group of related funds, at the end of the most recent fiscal year | December 3, 2025 |
| Broker-dealer | Not a small entity under the Exchange Act (a small broker-dealer has total capital under $500,000 and no affiliation with a larger firm) | December 3, 2025 |
| Transfer agent | Not a small entity under the Exchange Act | December 3, 2025 |
| All other covered firms (smaller entities) | Below the thresholds above | June 3, 2026 |
A registered adviser managing $400 million is a smaller entity, so its deadline was June 3, 2026. Today, every covered firm should be operating under the amended rule, and an examiner can ask to see the program, the vendor oversight file and the records behind them.
What must a Reg S-P incident response program include?
It must include written procedures to assess, contain and notify. The firm has to assess the nature and scope of any incident involving customer information, identify the customer information systems and types of customer information that may have been accessed or used, and take appropriate steps to contain and control the incident to stop further unauthorized access or use. It then has to notify affected individuals unless an exception applies.
For a small firm, that means a plan people can follow on a bad day: who declares an incident, who calls the IT provider, who preserves logs and who drafts customer letters. A generic template that never names your custodian, CRM or email system will not hold up. Our step by step guide to building an incident response plan covers the roles, the first hour and the evidence to keep.
When do you have to notify customers after a breach?
You must notify affected customers as soon as practicable, but not later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The clock starts at awareness. It does not wait until you finish the forensic report.
The notice duty covers sensitive customer information, which the SEC describes as information that could create a reasonably likely risk of substantial harm or inconvenience if compromised. Examples include a Social Security number, or a user name or account number combined with a security code or other detail that could open the account. The notice must describe the incident, the data involved and what the customer can do to protect themselves.
There is one main exception. You do not have to notify if, after a reasonable investigation, you determine that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. That is a documented decision, not a hunch: the rule requires written records of the investigation, the basis for the decision and any notice sent. A firm may also have a service provider send notices on its behalf under a written agreement, but the legal responsibility stays with the firm.
Notice can be delayed only if the U.S. Attorney General decides it poses a substantial risk to national security or public safety and tells the SEC in writing. The first delay is up to 30 days. The Attorney General can extend it by up to 30 more days, and in extraordinary circumstances by a final period of up to 60 days.
Service provider oversight and the 72-hour vendor rule
Your incident response program must include written policies requiring oversight of service providers. That includes making sure each provider takes appropriate measures to protect customer information and notifies you as soon as possible, but no later than 72 hours after becoming aware of a breach that resulted in unauthorized access to a customer information system it maintains.
Think about who holds your clients' data: the custodian portal, CRM, planning software, document storage, email platform and your managed IT provider. Each needs to know about the 72-hour duty, and you need a record of how you checked them. A vendor inventory, a short security questionnaire, notice language in contracts and a yearly review will cover most of it. Our guide to third-party risk management walks through that process for small firms.
Recordkeeping and the annual privacy notice exception
The amendments require written records documenting compliance with the safeguards and disposal rules. That covers the safeguards, vendor oversight and disposal policies, records of each incident and the response, notice determinations and copies of notices, any Attorney General delay letter, and service provider contracts. Retention periods follow each firm type's existing books and records rule.
| Covered firm | How long to keep Reg S-P records |
|---|---|
| Registered investment adviser | Five years, the first two in an easily accessible place |
| Broker-dealer | Three years, in an easily accessible place |
| Investment company | Six years for records, the first two easily accessible; policies in effect at any time in the past six years |
| Transfer agent | Three years, in an easily accessible place |
Records live in email and messaging too, which is where many firms slip. If advisers text clients from personal phones, those messages may fall outside your archive entirely. Our guide to off-channel communications compliance explains how to close that gap.
The privacy notice change is good news for many small firms. You can skip the annual privacy notice if you share nonpublic personal information with unaffiliated third parties only when an opt-out exception applies, and you have not changed your disclosure policies since the last notice you sent. If your practices change, the rule sets when annual notices must resume.
How public companies report incidents: Form 8-K Item 1.05 and Form 10-K Item 106
On July 26, 2023, the SEC adopted disclosure rules for public companies. They have two halves. Form 8-K Item 1.05 is event driven: report a material incident fast. Regulation S-K Item 106 is annual: describe your cybersecurity program in the 10-K. Foreign private issuers make comparable disclosures on Forms 6-K and 20-F.
The four business day clock starts at the materiality decision
A company must decide whether an incident is material without unreasonable delay after discovery. If it is material, the company files an Item 1.05 Form 8-K, generally within four business days of that decision, as the SEC's fact sheet explains. The filing describes the material aspects of the incident's nature, scope and timing, and its material impact or reasonably likely material impact, including on financial condition and results of operations. The company does not have to publish technical details that would get in the way of its response or remediation.
Materiality is a securities law test, not a technical one: would a reasonable investor consider the incident important? Companies weigh financial effects and qualitative ones, such as harm to reputation or customer relationships. A small intrusion that threatens a key product line can be material, while a noisy attack with little business impact may not be. In May 2024, the SEC's Director of Corporation Finance said Item 1.05 is for incidents a company has determined to be material, and encouraged companies to report other incidents under a different item, such as Item 8.01.
The national security delay works much like the Reg S-P version: up to 30 days if the Attorney General finds a substantial risk to national security or public safety and notifies the SEC in writing, another 30 days if the risk continues, and a final 60 days in extraordinary circumstances. Most companies have been subject to Item 1.05 since December 18, 2023. Smaller reporting companies started on June 15, 2024, according to the SEC's small business compliance guide.
What the 10-K must say about risk management and governance
Starting with annual reports for fiscal years ending on or after December 15, 2023, Item 106 requires a company to describe its processes, if any, for assessing, identifying and managing material cyber risks, and whether those risks, including past incidents, have materially affected it or are reasonably likely to. It must also describe the board's oversight of cyber risk and management's role and expertise. That pushes accountability up to the board.
Private companies are not directly covered, but they feel it. Public companies have to describe how they oversee risks from third-party providers, so their vendors get security questionnaires and contract clauses. Companies preparing for an IPO need these processes working before they list.
Form 8-K vs Regulation S-P: how the two rules compare
The two rules protect different people. Item 1.05 protects investors in a public company. Regulation S-P protects the customers whose data a financial firm holds. A public broker-dealer holding company can face both after the same breach.
| Question | Form 8-K Item 1.05 | Regulation S-P (amended) |
|---|---|---|
| Who is covered | Public companies that file reports with the SEC | Broker-dealers, funding portals, investment companies, SEC-registered advisers, transfer agents |
| Who gets told | Investors, through a public filing | Affected individuals, through a direct notice |
| What triggers it | An incident the company determines is material | Unauthorized access to or use of sensitive customer information |
| When the clock starts | At the materiality determination | When the firm becomes aware of the unauthorized access or use |
| Deadline | Generally four business days | As soon as practicable, no later than 30 days |
| Main exception | Not applicable: only incidents determined to be material are reported | No notice if a reasonable investigation finds no likely substantial harm or inconvenience |
| National security delay | Yes, on Attorney General request | Yes, on Attorney General request |
| Vendor angle | Annual 10-K describes oversight of third-party risk | Vendors must notify the firm within 72 hours |
Where the SEC rules stand in 2026
One proposal you may have read about is gone. In 2022 the SEC proposed separate cybersecurity risk management rules for investment advisers, registered funds and business development companies. On June 12, 2025, the Commission formally withdrew that proposal, effective June 17, 2025, along with other pending proposals. The SEC said it does not intend to finalize them and would issue a new proposal if it acts again.
So for advisers and broker-dealers, the amended Regulation S-P is the SEC cybersecurity rule with deadlines attached. As of late October 2026, the SEC's list of proposed rules shows no proposal to change Item 1.05, Item 106 or Regulation S-P. Broker-dealers should also keep FINRA's expectations in view; our FINRA cybersecurity compliance guide covers those.
What the SEC has charged firms with
Two cases show where the risk sits. In September 2022, the SEC fined Morgan Stanley Smith Barney $35 million under the Regulation S-P safeguards and disposal rules after decommissioned hard drives and servers holding data on about 15 million customers were resold, some through an internet auction site. That was a disposal failure, the kind of plain IT process gap that small firms also have.
In October 2024, the SEC charged four public companies over misleading disclosures tied to the SolarWinds compromise, with penalties from $990,000 to $4 million. One company described its cyber risks as hypothetical after it had already suffered intrusions. The lesson for both audiences: describe what actually happened, and make sure the facts reach decision makers fast.
How a small adviser or broker-dealer gets ready
Most of the work is writing down what you do and proving it works. The table below is a starting checklist for a firm under Regulation S-P. A public company would add a materiality procedure, disclosure controls and board reporting.
| Requirement | What to have on file |
|---|---|
| Incident response program | Written plan naming roles, IT contacts, containment steps and the 30-day notice workflow |
| Detection | Endpoint protection, email filtering, MFA and log monitoring on systems that hold client data |
| No-harm determinations | Investigation notes and the written reasoning for any decision not to notify |
| Customer notice | Draft letter template with the required content, ready to fill in |
| Vendor oversight | Vendor list, due diligence answers, 72-hour notice terms in contracts |
| Disposal | Data wiping or destruction records for retired laptops, drives and copiers |
| Testing | A tabletop exercise each year, with notes and the fixes that came out of it |
Run a tabletop with your actual people. Pretend a phishing email gave an attacker access to an adviser's mailbox for three days. Who finds out first? How do you learn what client data was in that mailbox? Who makes the notice decision, and when does the 30-day clock start? The gaps you find become your work list.
How GlobeVM supports financial firms in Los Angeles
GlobeVM is a managed IT and cybersecurity provider in Los Angeles, CA, working with businesses since 1996. Every client plan includes firewall management, endpoint protection, email filtering and MFA, controls that support a Reg S-P program. We respond within 15 minutes, around the clock, and support clients in English and Farsi. See how we work with advisers and broker-dealers on our financial services IT page.
We can map your current setup against the incident response, vendor oversight and recordkeeping requirements, then keep the evidence current through the year. Our compliance and risk management services cover the documentation as well as the technical controls.
This guide is general information, not legal advice; confirm your firm's obligations with compliance counsel. Key sources: the SEC's Regulation S-P adopting release and small entity compliance guide, the SEC's 2023 public company fact sheet, and the SEC's June 2025 withdrawal notice. To check where your firm stands, call GlobeVM at (818) 405-9930.