Proof your client information is protected and your response plan is ready.

Regulation S-P requires SEC-registered firms to protect client information, run a written incident response program, oversee the service providers who touch client data, and notify affected clients after unauthorized access. Compliance: Reg S-P gives you quarterly evidence that those safeguards are in place and working, without you having to ask.

Up to$500,000Cyber WarrantyBacked by Cork Inc.

Book a call What the rule asks for

At a glance

Package: Compliance: Reg S-P
Evidence: Compliance Posture Report, quarterly
Stacks on: Complete IT: Managed or Co-Managed

Does this apply to you?

It likely applies if your firm is one of these:

An investment adviser registered with the SEC
A broker-dealer
An investment company or transfer agent

What the rule asks for, and what you receive.

01
Have a written incident response program
Detection, a response runbook, and regular tests of it
The program, the test records, the incident log
02
Notify affected clients when sensitive information is exposed
The facts your notification decision needs: what was exposed, when, and whose
A timeline record for every incident
03
Oversee the service providers who touch client information
An inventory of those providers and a regular review of each
The provider list, with review dates
04
Safeguard client records and information
Access controls, multi-factor sign-in, encryption and access reviews
Control status and access review records
05
Keep records showing all of the above
Documentation, kept current
The Compliance Posture Report itself