Interactive checklist · saved in your browser

Regulation S-P Compliance Checklist

A Regulation S-P compliance checklist is a rule-by-rule list of what the SEC's privacy and safeguards rule requires of an SEC-registered adviser: written safeguards (your WISP), an incident response program, 30-day customer breach notification, service-provider oversight, recordkeeping, and privacy notices. Use this interactive version to pressure-test your program against the amended rule (17 CFR Part 248): every item traces to the rule text and SEC Release 34-100155. Tick items off as you confirm them. Your progress is saved in this browser, not on our servers.

Last reviewed July 15, 2026 · every item cited to primary sources

Overall progress 0 / 26 complete

Safeguards Rule and your Written Information Security Program (WISP)

0 / 4

Regulation S-P's Safeguards Rule requires written administrative, technical, and physical safeguards for customer information. In practice, that written program is your Written Information Security Program (WISP). Use this section as the backbone of a WISP template and confirm each control is documented and current.

17 CFR § 248.30(a), (b) SEC Release 34-100155 Pillar guide: What is Regulation S-P?

Maintain written policies and procedures with administrative, technical, and physical safeguards to protect customer records and information (§ 248.30(a)).
Extend safeguards and disposal coverage to all customer information the firm holds, including nonpublic personal information about another institution's customers handled or maintained on the firm's behalf.
Take reasonable measures to protect customer and consumer information against unauthorized access when disposing of it (Disposal Rule, § 248.30(b)).
Confirm the safeguards, incident response, and disposal documents reference the amended rule, not the 2000-era version.

Written incident response program

0 / 5

The 2024 amendments require a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information (§ 248.30(a)(3)).

17 CFR § 248.30(a)(3) SEC Release 34-100155 Pillar guide: What is a Reg S-P incident response program?

Maintain a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.
Include procedures to assess the nature and scope of an incident and identify the customer information systems and the specific information involved.
Include procedures to contain and control the incident to prevent further unauthorized access or use.
Name who leads an incident, the systems and vendors in scope, and when counsel and insurers are engaged.
Ensure the program covers customer information held at service providers, not just information on the firm's own systems.

30-day customer breach notification

0 / 5

Section 248.30(a)(4) requires notice to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice goes out as soon as practicable, and no later than 30 days after the firm becomes aware.

17 CFR § 248.30(a)(4) SEC Release 34-100155 Pillar guide: How does the 30-day breach notification clock work?

Notify each affected individual as soon as practicable, and no later than 30 days after becoming aware that unauthorized access to or use of sensitive customer information occurred or is reasonably likely to have occurred.
Treat the 30-day clock as triggered by awareness, not final confirmation; conduct the reasonable investigation inside the 30 days.
Default to notice: skip notification only if, after a reasonable investigation, the firm determines the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience.
If the firm cannot determine which specific individuals were affected, notify every individual whose sensitive customer information resides in the affected system, unless a reasonable investigation shows their information was not accessed or used.
Prepare a notice template with the required content: a general description of the incident, the type of sensitive information involved, the date or date range if determinable, firm contact information, and identity-protection guidance (fraud alerts, reviewing account statements, and the FTC's identity-theft resources).

Service-provider oversight

0 / 5

Section 248.30(a)(5) makes vendor oversight a rule requirement. Written policies must require due diligence and monitoring reasonably designed to ensure providers protect customer information and notify the firm within 72 hours of a qualifying breach.

17 CFR § 248.30(a)(5) SEC Release 34-100155 Pillar guide: What does Reg S-P require for service providers?

Maintain written policies requiring oversight of service providers through due diligence and monitoring, reasonably designed to ensure providers protect customer information they receive or maintain on the firm's behalf.
Design policies reasonably to ensure each provider notifies the firm as soon as possible, and no later than 72 hours, after becoming aware of a breach resulting in unauthorized access to a customer information system.
Keep a current inventory of vendors with access to customer information.
Run documented due diligence before onboarding and on a recurring cycle, including how the firm ensures each provider will deliver the 72-hour notification.
Monitor for changes (SOC 2 report findings, subprocessor changes, incidents in the news) and keep the evidence file examiners will ask for.

See how RegFin runs vendor due diligence

Recordkeeping

0 / 5

The amendments added recordkeeping requirements that, for advisers, fold into the Rule 204-2 books-and-records requirements. During an exam, a decision that notice was not required only counts if the investigation and determination were written down at the time.

17 CFR § 248.30(c) SEC Release 34-100155 Pillar guide: recordkeeping and privacy notice changes

Make and maintain written documentation of the policies and procedures the rule requires.
Keep records of any incident and the firm's response, and of any determinations made, including the basis for any 'investigated, no notice required' determination.
Keep records of the customer notices the firm sends.
Keep documentation of service-provider oversight.
Preserve adviser records under Rule 204-2 for five years, with the first two years in an easily accessible place.

Privacy notices

0 / 2

Regulation S-P's original privacy-notice obligations still apply. The amendments also conformed the annual privacy notice to the FAST Act exception.

17 CFR Part 248, Subpart A SEC Release 34-100155 Pillar guide: What is Regulation S-P?

Give customers initial (and where applicable annual) notices describing what nonpublic personal information the firm collects and shares, and let consumers opt out of certain sharing with nonaffiliated third parties.
Document eligibility for the FAST Act annual-notice exception rather than assuming it: a firm need not deliver an annual privacy notice if it shares nonpublic personal information only under exceptions that don't trigger opt-out rights and hasn't changed its policies and practices since its last notice.

This checklist is general information for compliance professionals, not legal advice. Verify each item against the linked primary sources and your firm's specific facts.

Turn this checklist into a running program

RegFin keeps the vendor file, incident records, policy versions, and exam-ready evidence trail Regulation S-P assumes, all in one place, building as you work.

Book a demo

Regulation S-P Compliance Checklist

Safeguards Rule and your Written Information Security Program (WISP)

Written incident response program

30-day customer breach notification

Service-provider oversight

Recordkeeping

Privacy notices

Turn this checklist into a running program

Get this checklist as a PDF

Check your inbox