The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours.
\nThe SEC’s final rule amending Regulation S-P, published in the Federal Register on June 3, 2024, requires brokers and dealers, investment companies, registered investment advisers, funding portals and transfer agents to adopt written policies and procedures for an incident response program covering unauthorized access to or use of customer information. It took effect August 2, 2024, with an 18-month compliance period after publication for larger entities and 24 months for smaller ones, so both periods had ended by June 2026.
\nCovered institutions must give clear and conspicuous notice to each individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after becoming aware of the incident, unless a reasonable investigation finds it is not reasonably likely to be used in a way that causes substantial harm or inconvenience. Larger entities include registered investment advisers with $1.5 billion or more in assets under management and broker-dealers that are not small entities.
\nEach program must include policies and procedures for overseeing service providers through due diligence and monitoring, designed to ensure they protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. The final rule dropped a proposed written-contract requirement, but the SEC says that does not lower the substantive oversight standard.
\nUse this for SEC-registered firms in the categories the rule names and for providers that handle their customer information. Other financial institutions, such as those under the FTC Safeguards Rule, follow different requirements.
\nDSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. Add the 30-day notice workflow to the incident response plan, keep notice templates ready, test the plan with key providers, and keep records of the oversight and each notice decision.
\nReview each provider agreement or written assurance for the 72-hour notice, run a tabletop exercise that includes a provider breach, and confirm notice decisions and timing are documented.
\nFederal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688). Reviewed October 19, 2026.
", "content_text": "The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours.\nSource facts\nThe SEC’s final rule amending Regulation S-P, published in the Federal Register on June 3, 2024, requires brokers and dealers, investment companies, registered investment advisers, funding portals and transfer agents to adopt written policies and procedures for an incident response program covering unauthorized access to or use of customer information. It took effect August 2, 2024, with an 18-month compliance period after publication for larger entities and 24 months for smaller ones, so both periods had ended by June 2026.\nCovered institutions must give clear and conspicuous notice to each individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after becoming aware of the incident, unless a reasonable investigation finds it is not reasonably likely to be used in a way that causes substantial harm or inconvenience. Larger entities include registered investment advisers with $1.5 billion or more in assets under management and broker-dealers that are not small entities.\nEach program must include policies and procedures for overseeing service providers through due diligence and monitoring, designed to ensure they protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. The final rule dropped a proposed written-contract requirement, but the SEC says that does not lower the substantive oversight standard.\nApplicability\nUse this for SEC-registered firms in the categories the rule names and for providers that handle their customer information. Other financial institutions, such as those under the FTC Safeguards Rule, follow different requirements.\nDSE recommendation\nDSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. Add the 30-day notice workflow to the incident response plan, keep notice templates ready, test the plan with key providers, and keep records of the oversight and each notice decision.\nVerification\nReview each provider agreement or written assurance for the 72-hour notice, run a tabletop exercise that includes a provider breach, and confirm notice decisions and timing are documented.\nOfficial reference\nFederal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688). Reviewed October 19, 2026.", "content_markdown": "The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours.\n\n## Source facts\n\nThe SEC’s [final rule amending Regulation S-P](https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm), published in the Federal Register on June 3, 2024, requires brokers and dealers, investment companies, registered investment advisers, funding portals and transfer agents to adopt written policies and procedures for an incident response program covering unauthorized access to or use of customer information. It took effect August 2, 2024, with an 18-month compliance period after publication for larger entities and 24 months for smaller ones, so both periods had ended by June 2026.\n\nCovered institutions must give clear and conspicuous notice to each individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after becoming aware of the incident, unless a reasonable investigation finds it is not reasonably likely to be used in a way that causes substantial harm or inconvenience. Larger entities include registered investment advisers with $1.5 billion or more in assets under management and broker-dealers that are not small entities.\n\nEach program must include policies and procedures for overseeing service providers through due diligence and monitoring, designed to ensure they protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. The final rule dropped a proposed written-contract requirement, but the SEC says that does not lower the substantive oversight standard.\n\n## Applicability\n\nUse this for SEC-registered firms in the categories the rule names and for providers that handle their customer information. Other financial institutions, such as those under the FTC Safeguards Rule, follow different requirements.\n\n## DSE recommendation\n\nDSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. Add the 30-day notice workflow to the incident response plan, keep notice templates ready, test the plan with key providers, and keep records of the oversight and each notice decision.\n\n## Verification\n\nReview each provider agreement or written assurance for the 72-hour notice, run a tabletop exercise that includes a provider breach, and confirm notice decisions and timing are documented.\n\n## Official reference\n\n[Federal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688)](https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/", "url": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "SEC Regulation S-P now requires incident response programs, 30-day customer notices and 72-hour provider alerts", "item": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/#article", "identifier": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/", "url": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/", "headline": "SEC Regulation S-P now requires incident response programs, 30-day customer notices and 72-hour provider alerts", "description": "The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run…", "abstract": "The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours.", "articleBody": "The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours.\nSource facts\nThe SEC’s final rule amending Regulation S-P, published in the Federal Register on June 3, 2024, requires brokers and dealers, investment companies, registered investment advisers, funding portals and transfer agents to adopt written policies and procedures for an incident response program covering unauthorized access to or use of customer information. It took effect August 2, 2024, with an 18-month compliance period after publication for larger entities and 24 months for smaller ones, so both periods had ended by June 2026.\nCovered institutions must give clear and conspicuous notice to each individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after becoming aware of the incident, unless a reasonable investigation finds it is not reasonably likely to be used in a way that causes substantial harm or inconvenience. Larger entities include registered investment advisers with $1.5 billion or more in assets under management and broker-dealers that are not small entities.\nEach program must include policies and procedures for overseeing service providers through due diligence and monitoring, designed to ensure they protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. The final rule dropped a proposed written-contract requirement, but the SEC says that does not lower the substantive oversight standard.\nApplicability\nUse this for SEC-registered firms in the categories the rule names and for providers that handle their customer information. Other financial institutions, such as those under the FTC Safeguards Rule, follow different requirements.\nDSE recommendation\nDSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. Add the 30-day notice workflow to the incident response plan, keep notice templates ready, test the plan with key providers, and keep records of the oversight and each notice decision.\nVerification\nReview each provider agreement or written assurance for the 72-hour notice, run a tabletop exercise that includes a provider breach, and confirm notice decisions and timing are documented.\nOfficial reference\nFederal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688). Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:28:07+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "SEC Regulation S-P now requires incident response programs, 30-day customer notices and 72-hour provider alerts" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Explainer", "Important priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 424, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Federal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688)", "url": "https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm" } } ] } }