Data Breach Notification Requirements
What Are Data Breach Notification Requirements for RIAs? Following the 2024 Regulation S-P amendments, SEC-registered advisers with an incident affecting sensitive customer information generally must notify affected individuals within 30 days of discovering unauthorized access, unless the firm determines the information hasn’t been or is unlikely to be misused. State-registered advisers may also be subject […]
Regulation S-P
What Is Regulation S-P? Regulation S-P requires two main things: a privacy notice given to clients at the start of the relationship (and periodically afterward, depending on firm practices) explaining what personal information the firm collects and how it’s shared, and a written information security program describing the administrative, technical, and physical safeguards the firm […]
Cybersecurity Risk Assessment
What Is a Cybersecurity Risk Assessment? A thorough cybersecurity risk assessment typically inventories the systems and data the firm relies on (client portals, custodial platforms, email, file storage), evaluates access controls and authentication practices, reviews third-party vendor security (particularly custodians and software providers with access to client data), and identifies gaps against the firm’s written […]
Cybersecurity Policy
What Is a Cybersecurity Policy for RIAs? While cybersecurity isn’t governed by a single standalone SEC rule the way some other compliance areas are, it intersects with Regulation S-P’s information security program requirement and is a consistent focus in SEC examination priorities. A well-built cybersecurity policy typically addresses access controls and authentication, data encryption, employee […]