SEC Regulation S-P: Pass the June 3 Deadline.

Yes. Reg S-P applies to SEC-registered investment advisers, broker-dealers, investment companies, and transfer agents. Small RIAs (covered persons under the threshold) had until June 3, 2026 to comply with the 2024 amendments — larger entities were already in scope as of December 3, 2025. State-registered advisers should consult counsel on state-specific safeguards rules, but most firms also benefit from aligning with Reg S-P even when not directly regulated.

Reg S-P (Privacy of Consumer Financial Information) governs how covered firms protect customer information and notify customers in the event of a breach. Reg S-ID (Identity Theft Red Flags) requires covered firms to maintain a written program for detecting, preventing, and mitigating identity theft. Both apply to RIAs under SEC custody rule but are separate rules with separate evidence requirements. A complete RIA compliance file addresses both — they are not interchangeable.

Yes — and it is the part most firms overlook. The 30-day customer-notification clock starts at incident discovery. Drafting a notification letter, identifying affected customers, and coordinating with outside counsel inside that window is not realistic without a pre-existing relationship. RIAs in the CT/NY/RI/MA footprint typically engage a regional cyber-incident-response counsel (Mullen Coughlin, BakerHostetler, Constangy, or Octillo) on retainer or preferred-counsel terms before any incident occurs.

Six artifacts: written IR program with named roles; service-provider oversight register with documented agreements; IR program test log (tabletop exercise record); endpoint XDR coverage report; backup restoration evidence; customer-notification template ready to populate. The examiner expects each as a discrete file, dated within the last twelve months for the test log and review register.

That is a Reg S-P deficiency on its face. The amendments require written agreements with service providers covering security and incident response, plus ongoing oversight. An IT vendor unwilling to produce a SOC 2 Type II report, sign a right-to-audit provision, or document their incident-response procedures is not a vendor a covered RIA can keep. Triton provides the SOC 2 attestation, the right-to-audit clause, and the incident-response procedure documentation as standard contract terms.

Yes. Custodian relationships do not relieve the covered firm of Reg S-P obligations for customer information held outside the custodian — including everything in your CRM, your portfolio accounting, your email, your file storage, and your paper records. The custodian secures custody of customer assets. The RIA secures custody of customer information. The two are different scopes; Reg S-P is about the second.

Yes. The Division of Examinations published Reg S-P amendments and the cybersecurity-related risk areas as priorities for the 2026 examination cycle. Routine RIA examinations starting in mid-2026 include Reg S-P artifact requests as a standard inspection element. The “we will document it after the deadline” posture does not survive an unannounced exam.

No. Dark web monitoring is a notification service, not a security strategy or a Reg S-P requirement. The amendments do not reference it. Given the scale of data breaches over the past decade, your firm’s information is already exposed. The correct investment is the proactive hardening the amendments actually require — not a monthly alert telling you something you cannot change. We do not bundle dark web monitoring and we do not endorse it as a Reg S-P strategy.