Industry
Compliance
GLBA
A quarterly user access review checklist for RIAs and broker-dealers: which systems to include, how to run each cycle, and the dated evidence that shows an examiner your access controls work.
CIS Controls
California requires reasonable security but never defines it. The Attorney General pointed to the CIS Controls as the minimum, and a breach lawsuit under the CCPA turns on that question. Here is how to use CIS as your baseline and your evidence.
SEC Regulation S-P
An AI vendor due diligence checklist for Reg S-P: when an AI tool becomes a service provider, what Regulation S-P requires before client data goes in, which records to keep, and what SEC examiners are focused on in FY2027.
SEC Regulation S-P
An employee pastes a client statement into a personal ChatGPT account. Here is how an RIA or broker-dealer works through it under amended Regulation S-P, from the first hour to the notice decision and the records an examiner will ask for.
SEC Regulation S-P
Since the 2024 amendments, the Reg S-P disposal rule covers customer information, and firms must keep records proving they followed it. Here is how RIAs and broker-dealers should retire laptops, copiers and phones, and what evidence to keep.
SEC Regulation S-P
Reg S-P applies the same way to broker-dealers and SEC-registered advisers, so dual registrants can run one program. The two sides diverge on recordkeeping, supervision and accountability. Here is how to coordinate them.
SEC Regulation S-P
Reg S-P requires written oversight of third-party service providers, and your MSP is usually one. Here is what a well-run MSP relationship should give your firm: 72-hour breach notice, a clear system list, oversight evidence and incident support.
SEC Regulation S-P
Regulation S-P has no exception process, so an undocumented gap reads as a firm not following its own safeguards policy. Here is what a Reg S-P exception record should include, where to keep it, and how to stop exceptions becoming permanent.
AECNIST SP 800-171
VPN appliances are a top target, and a VPN gives remote users more access than they need. Here is how AEC firms can replace a VPN with zero trust network access step by step without disrupting projects.
CMMC
A marked spec pasted into a public chatbot can start a 72-hour DFARS 7012 clock. This scenario for AEC firms on defense work covers the reporting decision, the first hour, filing with DC3, evidence preservation and who else to notify.
FINRA
Rule 17a-4 does not name AI chats, but it covers business communications whatever tool produced them. How broker-dealers decide which AI histories are records and capture them in a compliant archive.
Financial ServicesSEC Regulation S-P
No SEC rule names AI, but Rule 206(4)-7 already requires written procedures that your staff's AI use has to fit inside. Here is what the AI section of a small RIA compliance manual should cover and how to write it so an examiner can test it.
New articles for your industry
