How to prepare for an SEC exam: build an evidence binder from your MSP's reports

When an SEC exam request letter arrives, the chief compliance officer has a short window to show that cybersecurity and privacy policies operated as written. For RIAs and broker-dealers that outsource IT, the most practical way to prepare for an SEC exam is to treat the MSP's monthly reports as compliance records long before the letter comes.

What is an exam-ready evidence binder?

It is an organized, dated set of records showing that a firm's written cybersecurity and privacy policies were carried out during the review period. Examiners read policies to learn what a firm says it does, and they request evidence to see whether it did. For RIAs and broker-dealers that outsource IT, much of that evidence already exists in the managed service provider's monthly reports. The binder is the step that turns those reports into compliance records.

Why does an MSP report need to become a compliance record?

An MSP report needs to become a compliance record because the regulatory obligations sit with the firm. Advisers Act Rule 206(4)-7 requires written policies reasonably designed to prevent violations and a review, at least annually, of their adequacy and the effectiveness of their implementation. Regulation S-P requires written safeguards policies and an incident response program, and 248.30(a)(5) requires oversight of service providers, including through due diligence and monitoring. A monthly report that sits unread in an IT inbox satisfies none of these until someone reviews it, records the exceptions and keeps it.

The SEC's Division of Examinations described what goes wrong in its September 14, 2026 risk alert on adviser annual compliance reviews. Staff observed advisers that created testing records and recommendations but did not keep them in their books and records, policies that delegated functions to others without explaining how the adviser would oversee those functions, and recommended changes that were never implemented. Each of those is a gap a binder is designed to close.

What do SEC cybersecurity exams look for?

SEC cybersecurity exams look at governance, data loss prevention, access controls, account management, and incident response, including ransomware, according to the Division of Examinations' fiscal year 2026 examination priorities. For Regulation S-P, the priorities say examiners will review whether firms have written policies and procedures addressing administrative, technical and physical safeguards for customer information. They also identify policies, internal controls, vendor oversight and governance as focus areas for Regulations S-P and S-ID.

The Division publishes new priorities each fiscal year, so check the current edition before an exam (we track what the latest SEC exam priorities mean for RIAs). A binder organized around these areas lets the chief compliance officer answer a request letter by pulling a section instead of starting a project.

Which MSP reports map to which policies?

Start with the written policy, then find the report that shows it operating. A typical map looks like this:

• Access controls and account management: monthly user access reviews, multifactor enrollment reports, privileged account listings, and onboarding and offboarding tickets that show access removed on a departure date.
• Data loss prevention: data loss prevention alerts and how each was resolved, email encryption usage, and external sharing reports from the document platform.
• Patch and vulnerability management: patch compliance by device, vulnerability scan summaries, and any exceptions with approved remediation dates.
• Endpoint protection: a device inventory showing security agent status, plus detection and response summaries.
• Backup and resilience: backup success rates and, most important, the results of restore tests.
• Incident response: the security incident log, including events that were investigated and closed without any customer information affected.
• Training: phishing simulation results and training completion records.
• Service provider oversight: the provider's own security attestations, the firm's due diligence questionnaire, and confirmation that breach notice terms meet the 72-hour standard in 248.30(a)(5).

Reports that show only green dashboards are weak evidence. The exceptions, and what happened to each one, are what demonstrate that a control is operating.

How should the binder be organized and retained?

Organize it by policy section and by month, so a reviewer can follow one control across the year or see every control for a single month. Each monthly packet should record the date the report was received, who reviewed it, the exceptions noted and the follow-up taken. Keep the binder in a repository the firm controls, so the evidence stays with the firm if the IT provider changes.

Retention follows the books and records rules. Records documenting the annual review under Rule 206(4)-7 are themselves required books and records under Rule 204-2(a)(17)(ii), kept for at least five years. Rule 204-2(a)(25) requires SEC-registered advisers to keep Regulation S-P records, including safeguards policies, documentation of unauthorized access incidents, service provider oversight policies and service provider contracts, for at least five years. Broker-dealers keep comparable records under Rule 17a-4(e)(14), with three-year periods that run from creation for incident records and from termination for policies and contracts. For FINRA members, the same material can support the report behind the CEO's annual Rule 3130 certification.

Who should review the reports each month?

The chief compliance officer or a compliance delegate should review the reports each month, with technical support from the provider. The risk alert found policies that delegated functions without describing how the adviser oversaw them, and an IT report reviewed only by the IT provider that produced it is a version of that problem. A workable pattern is a monthly compliance review, a short meeting with the provider on open exceptions, and a sign-off recorded in the binder. Quarterly, the firm can sample a few items, such as one departed employee or one critical patch, and trace each from report to resolution.

What should you do this quarter?

Most of this is one-time setup:

• List every report the MSP sends and the policy section each one supports. A report with no policy, or a policy with no report, is worth a closer look.
• Ask the provider to include exceptions and their status in each report, in addition to summary metrics.
• Assign a reviewer and a monthly sign-off date, and record both in the binder.
• Load the last three months of reports into the structure and test whether a sample request, such as proof that a terminated employee's access was removed, can be answered within a day.
• Add the binder to the scope of the next annual review under Rule 206(4)-7 so the review tests it.
• Confirm the provider agreement sets a timeline for producing evidence on request.

How does s90 help?

s90 provides managed IT and security for RIAs, broker-dealers and dual-registered firms in Los Angeles and Orange County. Our client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, so a CCO answering an examiner's request has a defined turnaround for the technical records behind it. If you would like help mapping your current IT reporting to your written policies, we are glad to work through it with you.