Cybersecurity & Reg S-P

Client data protection has moved to the center of RIA compliance. The SEC's amendments to Regulation S-P require covered firms to maintain a written incident response program, notify affected individuals after certain breaches of sensitive customer information, and oversee the service providers that touch that data — on top of the safeguards and disposal obligations firms already carried.

The articles in this topic cover what the amended rule requires, how to build and test an incident response program, and how to run vendor due diligence so a service provider's breach doesn't become your firm's deficiency.