Form ADV season: does your cybersecurity language match reality?

For the chief compliance officer of an RIA, the cybersecurity paragraph in Form ADV Part 2A is often written once and rarely revisited. It is also the language an examiner can test most easily against the firm's systems, vendor files and due diligence answers, which makes it a good place to start before this year's annual amendment.

Does Form ADV require a cybersecurity disclosure?

No. Form ADV has no item dedicated to cybersecurity. The SEC proposed one in 2022, as part of a cybersecurity risk management rule for advisers that would have added cybersecurity risk and incident disclosure to the brochure, and withdrew that proposal on June 12, 2025, stating it does not intend to finalize it.

Most brochures say something about security anyway. Firms describe safeguards for client information, business continuity arrangements, or cybersecurity as a risk to client accounts and firm operations. Nothing requires that language, and once a firm publishes it, the language has to be true.

Why does a voluntary cybersecurity statement create exposure?

Form ADV is a filed document, and Section 207 of the Advisers Act makes it unlawful to willfully make an untrue statement of a material fact in a report filed with the SEC, or to omit a material fact required to be stated in it. A brochure that says client data is encrypted, that access requires multi-factor authentication, or that the firm tests its incident response plan every year is a set of factual claims an examiner can check against the firm's systems.

The same claims travel. They show up on the firm's website, in RFP and due diligence questionnaire answers, and in client letters. Under the Marketing Rule, an SEC-registered adviser's advertisement may not include an untrue statement of material fact, or a material statement of fact the adviser cannot substantiate on demand. The SEC has already acted on overstated technology claims: in March 2024 it settled charges against two advisers for misrepresenting their use of AI, with $400,000 in combined civil penalties. Statements about encryption and MFA are the same kind of checkable factual claim.

Where do cybersecurity statements and reality usually drift apart?

They drift wherever the language was written once and the environment kept changing. These are the claims worth testing every year:

• Encryption. "All client data is encrypted" has to hold for laptops, file shares, backups and email as well as the CRM.
• Multi-factor authentication. "MFA on all systems" fails if a custodian portal login, a planning tool or a shared admin account lacks it.
• Vendor oversight. "We oversee our service providers" needs documented reviews of the IT provider, CRM, planning software and any AI vendors added since the last update.
• Testing. "We test our incident response plan" needs a dated tabletop record and follow-up items.
• Incident response. Regulation S-P now requires covered advisers to maintain a written incident response program, including customer notification procedures. Any description in the brochure should match the written program.
• AI tools. New AI tools may handle client data in ways the brochure's description of safeguards never contemplated.

Drift is usually innocent. The brochure language was drafted years ago, often by an outside consultant, and the IT environment changed with every new hire, vendor and office move while nobody owned the comparison. That is why the check needs a named owner, usually the chief compliance officer, working from reports the IT provider produces on a schedule. If an examiner asks what supports a sentence in the brochure, a report dated close to the filing answers the question quickly and keeps the conversation short.

How does the annual amendment fit with the annual compliance review?

They should feed each other. Rule 204-1 requires the annual updating amendment within 90 days of fiscal year end, which is March 31 for calendar-year firms. If the brochure changed materially, Rule 204-3 requires delivering the updated brochure, or a summary of material changes with an offer of the brochure, to clients within 120 days. Separately, Rule 206(4)-7 requires reviewing compliance policies and procedures at least annually.

In a September 2026 risk alert on annual compliance reviews, the SEC's Division of Examinations listed policies that do not match the firm's practices, and weak oversight of delegated functions, among its observations. Cybersecurity is where that mismatch is easiest to find, because the evidence is technical and often sits with the firm's IT provider. Running the security check before the amendment lets the brochure reflect what the review actually found.

What should an adviser do before filing this year's amendment?

Treat every security sentence in the firm's public documents as a claim that needs evidence. A practical sequence for this quarter:

1. Collect every place the firm describes its security: Form ADV Part 2A, the privacy notice, the website, the standard due diligence questionnaire, the RFP library and client onboarding materials.
2. List each factual claim: encryption, MFA, testing, vendor oversight, backups, monitoring and incident response.
3. Match each claim to current evidence, such as an MFA coverage report, an encryption status report, a tabletop record or vendor review files. An SEC exam evidence binder built from your IT provider's reports keeps that evidence in one place.
4. Close the gap or correct the sentence. Either fix the control before filing, or rewrite the language to describe what the firm actually does.
5. Prefer descriptions of process to absolute claims. "We require multi-factor authentication for remote access to firm systems" is easier to support than "all systems are protected by MFA."
6. Align the other documents so the brochure, website and questionnaire answers say the same thing.
7. Keep the evidence with the annual review file. Rule 204-2(a)(17) requires advisers to keep records documenting the annual review.
8. Decide with compliance counsel whether any change is material and belongs in the Item 2 summary of material changes.

How does s90 help?

s90 gives advisers the technical evidence behind their cybersecurity language. Our Technology Posture Report and identity reports show MFA coverage, encryption status and device health, and our agreements commit to 72-hour breach notification and 24-hour evidence production, so a chief compliance officer can match each sentence in the brochure to a current report. Your compliance counsel writes the disclosure; we keep the facts behind it current. If you want a second look at your security language before this year's filing, we are happy to help.