The Securities Exchange Commission’s (SEC) long-awaited Regulation S-P updates are being rolled out. These policies were effective for large firms on December 3rd, 2025. Smaller firms have until June 3rd, 2026, to implement these policies.

There are four key components for firms to consider under the new requirements:

  • Incident Response Program;
  • Customer Notification;
  • Service Provider Due Diligence; and
  • An Annual Notice.

A firm’s incident response plan should detail each and every action a firm would take in specific cybersecurity scenarios. The regulators expect to see programs that effectively guide the firm in responding to an event, placing clients first.

Customer notification within 30 days of an incident is required under the updated regulations. Firms must notify all customers whose sensitive information was accessed, or likely to be accessed as soon as practicable and no later than 30 days, subject to state law. The notice must describe details of the incident, the data that was accessed, and what action impacted individuals should take.

The importance of service provider due diligence cannot be overstated. When obtaining a customer’s data and placing it on other platforms, it is paramount to ensure it truly is safe. The regulators will expect to see documentation on your firm’s service providers because as the saying goes, you’re only as strong as your weakest link.

And finally, firms must provide an annual notice detailing the categories of information it shares and the categories of affiliates/non-affiliates with whom the non-public personal information is shared. This information should be reviewed for accuracy no less than annually. Anecdotally, this was a point of emphasis on examinations we have seen. Regulators asked for proof of delivery, verification of email addresses, and remediation efforts for any emails that failed to deliver.

As always, documentation is just as important as firm policy itself. Firms must be able to show proof that they are following through with their stated guidelines and procedures. If you cannot provide evidence of your compliance, you are not compliant.

Time permitting, this Fact Sheet is worth reviewing. To take a deep dive, the entirety of the rule can be viewed here.

If your firm could benefit from external testing, compliance support, or a wellness checkup, Essential Edge is here to help. Our team includes seasoned professionals with decades of experience working within RIAs, broker-dealers and dually registered firms. We welcome the opportunity to speak with you and explore how we can support your compliance needs and goals.

To learn more about our services and our team, please visit us at www.eeoutsourcing.com.

Originally published in Essential Insights, February 27, 2026. Download the original PDF