How should you run the first annual review of your Reg S-P incident response program?

Does Regulation S-P require an annual review of the incident response program?

Regulation S-P does not set its own review calendar. 17 CFR 248.30 requires a written incident response program, and the annual review obligation comes from the rules that already govern your compliance program: Advisers Act Rule 206(4)-7 for SEC-registered advisers, and FINRA's supervisory testing and certification rules for broker-dealers.

Rule 206(4)-7(b) requires an adviser to review its policies and procedures "no less frequently than annually" for adequacy and effectiveness. Most advisers fold their Reg S-P procedures into the same compliance manual, so the incident response program is now part of that annual review. For a FINRA member, Rule 3130 requires the CEO to certify each year that the firm has processes to establish, maintain, review, test and modify its written compliance policies and supervisory procedures.

The SEC also expects the program to move with the firm. In the 2024 adopting release, the Commission said covered institutions "generally should consider reviewing and updating the assessment procedures periodically," and gave the same guidance for containment and control procedures.

Before you schedule the review, confirm who owns and approves the program. The rule does not name a signatory, so we walk through the options in who should own and sign your Reg S-P program.

Why is this year's review different?

This is the first annual review since the incident response program became mandatory. Larger entities had to comply with the amended rule by December 3, 2025, and smaller entities by June 3, 2026, according to the SEC's small entity compliance guide. Earlier reviews could only ask whether the program was written. This one can ask whether it works.

Examiners are asking the same question. The Division of Examinations' fiscal year 2026 priorities say that after the compliance dates the Division "will examine whether firms have developed, implemented, and maintained policies and procedures" under the amendments, with a focus on "firms' policies and procedures, internal controls, oversight of third-party vendors."

What should the review test against the rule?

Test each element the rule names, in the order an incident would hit them. Rule 248.30(a)(3) requires a program "reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures." That breaks into four questions:

• Assessment: can your team "assess the nature and scope" of an incident and identify which systems and types of customer information were involved? Ask who would pull the logs and how long it would take.
• Containment: do you have documented steps to "contain and control the incident," including disabling accounts, isolating devices, and resetting credentials at your custodian and CRM?
• Notification: can you deliver notice "as soon as practicable, but not later than 30 days" after becoming aware of unauthorized access, as Rule 248.30(a)(4) requires? Check that the notice template, mailing process and contact data actually exist.
• The no-notice determination: if your firm decides after "a reasonable investigation" that information is not reasonably likely to be used in a way that causes substantial harm or inconvenience, is there a written process for making and documenting that call?

Are your service providers held to the 72-hour standard?

Your written policies must be designed so that each service provider tells you about a breach within 72 hours, and the annual review is the time to confirm they do. Rule 248.30(a)(5) requires written policies and procedures for oversight of service providers, "including through due diligence and monitoring," reasonably designed to ensure each provider will notify you "as soon as possible, but no later than 72 hours after becoming aware" of a breach in security affecting customer information.

Pull the list of vendors that touch client data: custodian portals, CRM, financial planning software, document management, email archiving, and your IT provider. For each, confirm whether the contract or a written attestation addresses the 72-hour notice, and record what due diligence you performed this year. Your firm remains responsible for making sure affected individuals are notified even when a provider handles the notice on your behalf.

What records should the review produce?

The review should produce records that map to the recordkeeping rules the amendments added. For advisers, Rule 204-2(a)(25) covers the written Reg S-P policies and procedures, documentation of any detected unauthorized access, records of notification determinations, and service provider contracts. Rule 204-2(a)(17)(ii) separately covers "any records documenting the investment adviser's annual review" of your policies. Under Rule 204-2(e)(1), these are kept for five years, the first two in an appropriate office of the adviser.

For broker-dealers, Rule 17a-4(e)(14) sets the retention periods. Policies and procedures are kept until three years after the firm stops using them. Documentation of detected unauthorized access and of notification determinations is kept for three years from when it was made. Service provider contracts are kept until three years after the contract ends.

If no incident occurred this year, write that down. A short, dated memo confirming that no unauthorized access was detected, signed by the person who checked, is a better record than silence.

How do you run the review this quarter?

A practical sequence for a first annual review:

• Schedule a 60-minute tabletop exercise with the CCO, operations lead and IT provider. Walk through one realistic scenario, such as a compromised adviser mailbox with client statements attached.
• Time each step: detection, assessment, containment, the notification decision, and drafting the notice. Note every place someone said "I'm not sure who does that."
• Re-confirm the service provider list and the 72-hour notice terms for each vendor that holds customer information.
• Update the written program for anything the tabletop exposed, and date the revision.
• File the tabletop notes, vendor confirmations and revised program together as the annual review record.

Is this legal advice for my firm?

No. This article describes what Regulation S-P and the related recordkeeping rules require, with links to the primary sources. How they apply to your firm depends on your registration, size, and service providers, and your compliance counsel should make that call.

How s90 helps

s90 runs IT for advisory firms and broker-dealers in Los Angeles and Orange County, and our agreements commit us to the timelines your program depends on: notice of a breach within 72 hours and production of evidence within 24 hours of a request. We can facilitate the tabletop, supply the technical logs and timelines, and help assemble the review record. If your first annual Reg S-P review is on the calendar, we would be glad to help you prepare.