How to Document a Reg S-P Safeguards Exception

Does Regulation S-P allow exceptions to a safeguards policy?

The rule is silent on exceptions, so any exception or risk acceptance has to be justified against the policy itself. 17 CFR 248.30(a)(1) requires every covered institution to "develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information." Paragraph (a)(2) requires those policies to be reasonably designed to ensure the security and confidentiality of customer information, protect against anticipated threats, and protect against unauthorized access or use that could result in substantial harm or inconvenience to a customer.

Nothing in that text creates an exception process. That leaves the burden with the firm. When an examiner finds a control your written policy describes and your systems do not enforce, the default reading is that the firm is not following its own policy. A documented, approved and time-limited exception gives you a different answer: the gap is known, the risk was weighed, and someone accountable decided how to handle it.

The SEC chose flexibility when it adopted the 2024 amendments. The adopting release describes policies tailored to each firm's size, complexity and activities. A written exception is one way a firm exercises that flexibility on the record.

Why do undocumented exceptions turn into exam findings?

Examiners compare the written policy to what is actually happening. The SEC Division of Examinations' fiscal year 2027 priorities say examinations will focus on whether firms have developed, implemented and maintained reasonably designed policies and procedures for safeguarding customer information, including response programs and oversight of service providers.

A typical example: the policy says multi-factor authentication is required on every system that holds customer information, and one legacy portfolio accounting system cannot support it. If nobody recorded why, the gap reads as a failure to implement the policy. If the firm can produce a dated exception with compensating controls, an approver and a replacement plan, the discussion moves to whether the firm's risk decision was reasonable. That is a far better conversation to have in an exam.

What should a Reg S-P exception record include?

Each record should answer the questions an examiner will ask, in one place:

• Policy reference: the section of your written safeguards policies being waived.
• Scope: the system, account, user or vendor covered, and what customer information it holds.
• Reason: why the control cannot be applied now, in business terms.
• Risk: how the gap affects the objectives in 248.30(a)(2), stated plainly.
• Compensating controls: what reduces the risk while the exception is open, such as restricted access, network isolation, added monitoring or extra review.
• Approval: who approved it, their role and the date. The approver should be the person who administers the compliance program, usually the CCO, and never the person requesting the exception. See who owns and signs a Reg S-P program.
• Expiry: a fixed end date and the plan to close the gap.
• Review history: each review date and its outcome.

For a broader template that also covers the FTC Safeguards Rule, see our guide to logging security policy exceptions.

Is a policy exception the same as risk acceptance?

Not quite. Risk acceptance is a decision to live with a known risk for a period of time. A policy exception records that the firm is departing from its own written policy, and it normally contains a risk acceptance along with compensating controls and an end date. For Reg S-P, put both in one record so an examiner can see the departure, the risk accepted and who accepted it.

Where should exception records be kept, and for how long?

Keep them with your Reg S-P records, because each one changes how your written policies operate in practice. The rules do not name exception logs, so the retention schedule for the policies themselves is the useful reference point.

Advisers must keep the written policies required by 248.30(a)(1) under Rule 204-2(a)(25)(i), and records documenting the annual review of compliance policies under Rule 204-2(a)(17)(ii). Under Rule 204-2(e)(1), those records are generally kept for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser. Broker-dealers must keep their 248.30(a)(1) policies "until three years after the termination of the use of the policies and procedures" under Rule 17a-4(e)(14).

Keeping exception records on the same schedule as the policies they modify lets you show an examiner what your policy meant in practice at any point in that period. For SEC-registered advisers, the annual review under Rule 206(4)-7(b) is the natural point to re-approve or close every open exception.

What about exceptions that involve a service provider?

Handle them with extra care, because 248.30(a)(5)(i) is specific. Your policies must be reasonably designed to require oversight of service providers, "including through due diligence and monitoring," and to ensure they notify you no later than 72 hours after becoming aware of a breach of a customer information system they maintain.

A vendor that will not commit to that notice window, or will not complete your due diligence, is a likely reason for a firm to need an exception. The record should show what the firm did about it: the contract amendment requested, the vendor's response, the deadline to replace the vendor, and how the firm would learn of an incident in the meantime. Advisers must keep documentation of service provider contracts under Rule 204-2(a)(25)(v). Broker-dealers must keep them under Rule 17a-4(e)(14)(v) until three years after the contract ends. Our guide to Reg S-P service provider contracts covers the amendment language.

How do you keep exceptions from becoming permanent?

Give every exception an owner and an end date, and review the list on a schedule. Practical steps:

• Set a maximum term, such as 90 days or until the next annual review, after which the exception lapses unless someone re-approves it.
• Report open exceptions to senior management as part of the annual compliance review.
• Check that compensating controls are still in place and working.
• Close each exception in writing when the control is fixed, with the date and the evidence.

An exception renewed several times without progress means the policy and the business no longer match. At that point, change the policy or change the system, and document which one you chose.

What should you do this quarter?

Turn the gaps you already know about into records, then put them on a review cycle:

• List every known gap between your written safeguards policies and your actual controls, including MFA, encryption, logging, disposal and vendor terms.
• Write an exception record for each gap using the fields above, or fix it.
• Get each record approved by the person who administers your compliance program.
• Add an exceptions section to your annual review under Rule 206(4)-7, or to your broker-dealer's annual testing under FINRA Rule 3120.
• Confirm every service provider that holds customer information has the 72-hour notice in its contract, and open a dated exception for any that do not.

How does s90 help?

s90 keeps a risk register for each client that records every exception with its compensating controls, approver and expiry date, and our Technology Posture Report gives you dated evidence of which controls are actually in place. Our agreements include 72-hour breach notification and 24-hour evidence production, so s90 will not need an exception on your service provider list. If you would like a second set of eyes on your open exceptions before your next exam, we are glad to help.