A Regulation S-P Cybersecurity Checklist for Small RIAs

The amended Regulation S-P compliance dates have passed. Advisers with $1.5 billion or more in assets under management had until December 3, 2025. All other SEC-registered advisers had until June 3, 2026.

By now your firm should have written policies. Some firms had them drafted by counsel or a compliance consultant, and some came from a template. The harder question is whether the program behind those policies works, and whether you can show it.

A Regulation S-P cybersecurity checklist built from the rule text answers both questions.

Regulation S-P sets outcomes and leaves the controls to you

Regulation S-P is written as outcomes, not as a list of controls. The safeguards policies must be "reasonably designed" to protect customer information. The response program must be "reasonably designed to detect, respond to, and recover from" unauthorized access. The rule does not tell you to turn on MFA or encrypt laptops.

The outcome wording leaves room to fit the program to your firm. It also makes it hard to tell, from the policy alone, whether you are done.

A checklist turns each paragraph of the rule into a question you can answer with yes, partial, or no, and a document. We built our free Regulation S-P Cybersecurity Checklist that way. Each item names the paragraph it comes from and the proof you would keep.

The eight sections of the Regulation S-P checklist

Sections 1 to 6 follow the order of the rule. Sections 7 and 8 cover the books and records rule and Massachusetts law.

1. Written policies and scope

248.30(a)(1) and (a)(2) require written policies covering administrative, technical, and physical safeguards for customer information. The checklist also asks whether you know where customer information lives. You cannot protect data you have not located, so the first piece of evidence is a list of the systems that hold it: CRM, custodian portals, planning software, email, file storage, backups.

It also asks whether you know which records are sensitive customer information, defined in 248.30(d)(9). That includes things like Social Security numbers, and account numbers or usernames combined with the passwords or codes that open them. The definition matters later, because it decides who gets a notice.

2. Security controls

This is the one section where the rule is silent on specifics. The checklist lists common controls firms use to show their safeguards work: MFA on email and custodian portals, limited admin rights, access removed on a person's last day, encrypted laptops, patching, email authentication, secure file exchange with clients, logging, tested backups, and training.

These items are marked "Supports (a)(2)" or "Supports (a)(3)" rather than given a direct rule citation, because the rule does not name them. If you do not use one, write down why and what you do instead. That note is evidence too.

3. Incident response program

248.30(a)(3) requires a written program to detect, respond to, and recover from unauthorized access to or use of customer information. It must include steps to assess the scope of an incident and to contain and control it. The checklist also asks whether you have named people, an offline contact list, and a recent test of the plan.

4. Customer notification

248.30(a)(4) sets the notice rules. Notice must go out as soon as practicable, and no later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

Two terms do different work here. Becoming aware of unauthorized access to customer information starts the 30-day clock. Whether a given person's sensitive customer information was involved decides who gets the notice. The checklist asks whether your procedure handles both, whether it covers the case where you cannot tell whose information was involved, and whether your notice template has every item 248.30(a)(4)(iv) requires.

5. Service providers

248.30(a)(5) requires written policies and procedures for overseeing service providers through due diligence and monitoring. They must be reasonably designed to ensure each provider notifies the firm within 72 hours of becoming aware of a breach of a customer information system it maintains. The checklist asks for a vendor list, written procedures, a completed review for each vendor, and the contract terms or attestations behind them. Our post on proving your vendor reviews happened goes through this section in detail.

6. Disposal

248.30(b) requires written procedures for disposing of customer and consumer information, and reasonable measures in practice. The evidence here is simple: a disposal policy, and the wipe records or certificates of destruction for old devices and paper.

7. Records you can produce

Rule 204-2(a)(25) lists six Regulation S-P records an adviser must keep, from the safeguards policies to the disposal policies. Rule 204-2(e)(1) requires keeping them in an easily accessible place for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office. The last item in this section is a practical one: can someone other than the person who built the file find each record in a few minutes?

8. Massachusetts firms

If the firm owns or licenses personal information about Massachusetts residents, 201 CMR 17.03 requires a written information security program, and 17.03(2)(f) requires contracts that make service providers maintain appropriate security measures. Skip the section if it does not apply.

What a completed checklist gives your firm

The checklist checks your program against the rule and keeps the proof in one place. It does not replace the program. In practice it helps in five ways.

It finds the gaps before an examiner does. A No on the checklist is a known gap with an owner and a date. A gap found during an exam can end up in a deficiency letter.

It gives the annual review something concrete. Rule 206(4)-7(b) requires advisers to review their compliance policies at least once a year. Running the checklist, and keeping the completed copy, is a clear record that the Regulation S-P part of that review happened.

It builds an evidence index. The evidence column, filled in, is a map of where every record lives. When an examiner asks for your incident response plan, your vendor reviews, or your disposal records, you already know where they are.

It gets the CCO and the IT provider working from one list. Most items need both. The CCO knows what the policy says. The IT provider knows what is configured. Working through the list together puts those two answers side by side.

It sets priorities. The SEC's fiscal 2027 examination priorities say staff will evaluate response program policies and procedures, including customer notification procedures and oversight of service providers. That points to sections 3, 4, and 5. Fix the No answers there first.

Count a Yes without evidence as a No

A Yes with nothing in the evidence column is a No.

It is easy to say MFA is on for everyone. It is harder to attach the report that shows it. The report is the answer that holds up in an exam, and pulling it can turn up an account that was missed.

Six steps to run the checklist

1. Download the checklist. There is a PDF to print and a Word file to fill in.
2. Book a working session with your CCO and your IT provider.
3. Work through it in order. Mark each item and fill in the evidence column as you go.
4. Give every No and Partial an owner and a due date.
5. Keep the completed checklist with your annual compliance review records.
6. Run it again each year, and after any incident, new vendor, or major system change.

If you want help with the gaps, or want an outside review of the program, book a consult. We work alongside your CCO and your IT provider.

This post is general information, not legal advice. Confirm your firm's obligations with compliance counsel. SaberGuard assesses and advises; it does not warrant compliance.