Larger broker-dealers, investment advisers, investment companies and transfer agents had to comply with the amended Regulation S-P from December 3, 2025; smaller ones from June 3, 2026. Every covered firm now needs a written incident response program, notice to affected individuals within 30 days, and oversight of service providers. What changed and how to make it work on AWS.
The SEC adopted the amendments on May 16, 2024. They were published on June 3, 2024, giving larger entities 18 months and smaller entities 24 months to comply. Both dates have passed, so the requirements now apply to every covered institution: broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A written incident response program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information.
Notice to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization: as soon as practicable and no later than 30 days after becoming aware, unless the firm determines the information is not reasonably likely to be used in a way that causes substantial harm.
Policies for overseeing service providers through due diligence and monitoring, including requiring them to notify the firm promptly of breaches.
Broader coverage of customer information, and records showing compliance.
Thirty days is short if the first two weeks go to working out what was accessed. The program has to produce that answer quickly, which means logging decided in advance.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Microsoft 365 Outage, November 12, 2026: What Is Down, What Microsoft Has Said, and What to Do
Outlook, Exchange Online, Teams, SharePoint, Copilot and Defender XDR went down worldwide on the afternoon of November 12. Microsoft says servers are failing health checks and overloading the rest. What we know, what happens to email sent to you in the meantime, and what to check once it is back.
Read
Law Firm Security in 2026: What Clients' Outside Counsel Guidelines Ask For, and How to Answer
Corporate clients increasingly send outside counsel guidelines and security questionnaires before engaging a firm. The requests are predictable: MFA, encryption, incident notification, data return and destruction at matter end, vendor controls. The ethical baseline (Model Rule 1.6(c) and ABA Opinion 483), the common asks, and how mid-sized firms meet them without an enterprise security team.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.