Your Reg S-P incident response program, exam-ready in a week

The deadline, and what missing it costs

The SEC’s 2024 amendments to Regulation S-P took effect August 2, 2024, with a tiered compliance schedule. For registered investment advisers, a “larger entity” is one with $1.5 billion or more in assets under management — they had to comply by December 3, 2025. Everyone below that threshold is a smaller entity, and the deadline was June 3, 2026.

• A written incident response program reasonably designed to detect, respond to and recover from unauthorized access to customer information — including procedures to assess the nature and scope of an incident, to contain and control it, and to notify affected individuals (17 CFR §248.30(a)(3)).
• Service-provider oversight, through due diligence and monitoring, reasonably designed to ensure providers protect customer information and notify you no later than 72 hours after becoming aware of a breach of a customer information system they maintain (§248.30(a)(5)(i)). You must start your own response program when that notice arrives — and the duty to notify affected individuals stays with you even if a vendor does the notifying (§248.30(a)(5)(iii)).
• Customer notification as soon as practicable, but not later than 30 days after becoming aware that unauthorized access occurred or is reasonably likely to have occurred, unless you determine after a reasonable investigation that the sensitive customer information has not been and is not reasonably likely to be used in a manner resulting in substantial harm or inconvenience (§248.30(a)(4)(i), (iii)). The notice has eight mandatory content elements (§248.30(a)(4)(iv)).
• Records: the policies, the documentation of any incident and your response, the written determination of whether notice was required and the basis for it, the vendor-oversight policies, and any vendor agreement — kept per 17 CFR §275.204-2, five years, the first two in an easily accessible place.

There is no per-day statutory fine here. The consequence is simpler and more likely: an examination. The SEC Division of Examinations named Regulation S-P in its fiscal year 2026 priorities. After the compliance dates, that means checking whether the program actually exists.

What that costs when it does not: the Commission charged R.T. Jones Capital Equities Management under the safeguards rule — Rule 30(a) of Regulation S-P — after a breach exposed the personal information of about 100,000 people. The finding was that the firm had failed to adopt any written policies and procedures for nearly four years. The penalty was $75,000, and the breach itself was never shown to have harmed a single client. The charge was for not having the document.

What Tideward Reg S-P gives you

A written incident response program.

Tailored to your firm’s size and systems, mapped clause by clause to §248.30(a)(3) through (a)(5) — so an examiner can see which paragraph each section answers.

A vendor pack.

An inventory worksheet for every provider that touches customer information, a due-diligence questionnaire, a monitoring cadence, and ready-to-send 72-hour notice language to put in front of each vendor.

Customer notice templates.

Containing all eight required elements, in three variants — confirmed breach, suspected breach with unidentified individuals, and vendor-caused breach.

The determination memo template.

The most commonly missing record: the written investigation and reasoning behind deciding that no notice was required. The rule requires the basis, not just the conclusion.

A tabletop exercise and its log.

Plus the recordkeeping file structure, pre-labelled for the five-year retention requirement — so your file shows the program was tested, not just written.

Who this is for

SEC-registered investment advisers under $1.5 billion in regulatory assets under management — smaller entities under the amendments — with no in-house compliance department, where the CCO is also the founder, the operations lead, or the person who happens to be good with computers.

Not for you if you have a dedicated compliance team, outside counsel already on retainer for this, or an enterprise GRC platform. You are served.

Why you can check this yourself

Every requirement cites the rule it comes from.

The incident response program, the 72-hour vendor notice, the 30-day customer notice and its eight content elements, and the five-year retention each carry their CFR paragraph. You can read the rule next to the document that answers it.

The enforcement example is a real, decided case.

R.T. Jones Capital Equities Management was charged under Rule 30(a) and paid $75,000 for having adopted no written policies and procedures. That is the shape of the risk: the missing document, not the breach.

We never see the data the rule protects.

Nothing in the kit requires client records, account data or system credentials. We ask about your firm’s shape — how many people, which vendors touch customer information, where it is stored.

Price

One fixed, published price. Compliance consultants quote this kind of work by the hour or as part of a retainer, and you cannot find out what it costs without a call. You can find out here.

Questions

Is this legal advice?

No, and it is important that you read it that way. Tideward Reg S-P is a document and software kit built directly from the rule text. It does not create an attorney-client relationship, it is not a substitute for counsel, and it does not certify your firm as compliant — no vendor can. Your obligations stay yours. Firms with unusual structures, or with an incident already in progress, should talk to a lawyer, not buy a kit.

Do you need access to our client data?

No. Nothing in this kit requires client records, account data, or system credentials. We ask about your firm’s shape — how many people, which vendors touch customer information, where it is stored. We never see the information the rule is written to protect.

We are past June 3, 2026. Are we already in trouble?

Not automatically. The deadline passing is not itself a finding; an examination with no program to show is. Having a dated, written, tested program now is materially better than having one later, and far better than having none when the examiner asks.

Is not our existing cybersecurity policy enough?

Usually not. Most pre-2024 policies cover safeguards under the original rule but predate the three new obligations: the incident response program with its assessment and containment procedures, the 72-hour vendor notification requirement, and the 30-day customer notice with its eight mandated content elements. Those are the gaps this kit fills.

What if our vendor will not agree to 72-hour notice?

The amendments dropped the proposed requirement for a written contract with service providers; what you need is policies and procedures reasonably designed to require that oversight and notification. The vendor pack includes the escalation path and how to document a vendor that will not cooperate — which is itself a record worth having.

What do we actually have to do after we buy it?

Read it, fill in your firm’s specifics, adopt it, run the tabletop once, and file it. Budget three to four hours. If you want it done with you rather than for you, the walkthrough hour is included.