# SEC Regulation S-P now requires incident response programs, 30-day customer notices and 72-hour provider alerts > The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours. - Canonical URL: https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-19T00:28:07+00:00 - Modified: 2026-10-19T01:55:07+00:00 - Last reviewed by DSE: 2026-10-19 - Resource type: Explainer - DSE priority: Important - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours. ## Potentially affected SEC-registered broker-dealers, investment companies, investment advisers, funding portals and transfer agents, and the IT, cloud and software providers that hold their customer information. ## DSE recommendation DSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. ## Article The SEC’s Regulation S-P amendments require broker-dealers, investment companies, registered advisers, funding portals and transfer agents to run incident response programs, notify affected people within 30 days of learning of likely unauthorized access to sensitive customer information, and oversee providers that must report breaches within 72 hours. ## Source facts The SEC’s [final rule amending Regulation S-P](https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm), published in the Federal Register on June 3, 2024, requires brokers and dealers, investment companies, registered investment advisers, funding portals and transfer agents to adopt written policies and procedures for an incident response program covering unauthorized access to or use of customer information. It took effect August 2, 2024, with an 18-month compliance period after publication for larger entities and 24 months for smaller ones, so both periods had ended by June 2026. Covered institutions must give clear and conspicuous notice to each individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, as soon as practicable but not later than 30 days after becoming aware of the incident, unless a reasonable investigation finds it is not reasonably likely to be used in a way that causes substantial harm or inconvenience. Larger entities include registered investment advisers with $1.5 billion or more in assets under management and broker-dealers that are not small entities. Each program must include policies and procedures for overseeing service providers through due diligence and monitoring, designed to ensure they protect customer information and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. The final rule dropped a proposed written-contract requirement, but the SEC says that does not lower the substantive oversight standard. ## Applicability Use this for SEC-registered firms in the categories the rule names and for providers that handle their customer information. Other financial institutions, such as those under the FTC Safeguards Rule, follow different requirements. ## DSE recommendation DSE recommends that covered firms list every service provider with access to customer information and confirm each will report a breach to them within 72 hours. Add the 30-day notice workflow to the incident response plan, keep notice templates ready, test the plan with key providers, and keep records of the oversight and each notice decision. ## Verification Review each provider agreement or written assurance for the 72-hour notice, run a tabletop exercise that includes a provider breach, and confirm notice decisions and timing are documented. ## Official reference [Federal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688)](https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm). Reviewed October 19, 2026. ## Primary reference - Name: Federal Register (GovInfo) — Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Final Rule (89 FR 47688) - Authority: www.govinfo.gov - URL: https://www.govinfo.gov/content/pkg/FR-2024-06-03/html/2024-11116.htm - Source publication date: Not stated by the source ## Citation and use Preferred citation: “SEC Regulation S-P now requires incident response programs, 30-day customer notices and 72-hour provider alerts,” DSE Security, https://update.dsesecurity.com/updates/sec-regulation-s-p-amendments-incident-response-30-day-notice-72-hour-service-provider/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.