For investment advisers

Regulation S-P and cybersecurity for investment advisers

For a fixed fee, SaberGuard writes the incident response program, vendor oversight procedures, and records amended Regulation S-P requires, starting with a read-only baseline of your Microsoft 365 or Google Workspace security settings.

Book a consultSee the fixed fee

For SEC-registered and Massachusetts state-registered advisers. Run a healthcare practice instead? See the healthcare page.

Which rules apply

Who your firm is registered with decides which rules apply

Not sure? The scoping call starts with this question.

Registered with the SEC

  • Regulation S-P, as amended in 202417 CFR 248.30

    Written safeguards for customer information, an incident response program, client notice as soon as practicable and no later than 30 days after you become aware of unauthorized access, oversight of service providers, and records of all of it.

  • Books and records; compliance programRules 204-2 and 206(4)-7

    The Regulation S-P records kept with your books, and an annual review of your compliance policies by your CCO.

  • Regulation S-ID17 CFR 248.201

    A written identity theft program, if your firm can direct transfers from individual clients' accounts to third parties.

Registered with the Massachusetts Securities Division

  • FTC Safeguards Rule16 CFR Part 314

    A written security program with a qualified individual in charge, MFA, encryption, vendor oversight, and notice to the FTC within 30 days of discovering a breach involving 500 or more consumers. Firms with information on fewer than 5,000 consumers are exempt from some parts.

  • Massachusetts data security regulation201 CMR 17.00

    A written information security program, which the Securities Division told advisers in 2010 it would ask to see on routine exams.

Regulation S-P does not apply to state-registered advisers. 201 CMR 17.00 applies to both kinds of firm if you hold personal information about Massachusetts residents.

Where advisers stand now

Both Regulation S-P compliance dates have passed

Advisers with $1.5 billion or more in assets under management had to comply with amended Regulation S-P by December 3, 2025. Every other SEC-registered adviser had until June 3, 2026.

The SEC's fiscal year 2027 examination priorities say staff will evaluate response program policies and procedures, including customer notification and oversight of service providers. Law firms have reported document requests to advisers. Foley Hoag lists requests for governance records and risk assessments, policies and the latest annual review, incident response materials, records of incidents, vendor records, and personnel lists.

Sources:SEC adopting release 34-100155SEC fiscal year 2027 examination prioritiesFoley Hoag on Reg S-P document requests

What the program includes

The records an examiner asks for, written for your firm

  • Gap review and risk register

    Your current policies and safeguards checked against each element of amended Regulation S-P, with the gaps listed in a risk register you keep.

  • Incident response program

    Written procedures to detect, respond to, and recover from unauthorized access to customer information, including how you decide whether clients must be notified and what the notice says.

  • Service-provider oversight

    Due diligence and monitoring procedures for every vendor that handles customer information, and a vendor register that records what each one holds and how it will notify you.

  • Records

    The written policies, procedures, and records Rule 204-2 requires for Regulation S-P, organized so you can produce them when asked.

  • Training and a tabletop

    A staff session on spotting and reporting incidents, and a tabletop exercise that tests the incident response program. Both are documented.

  • A baseline of your security settings

    Ward Agent reads your Microsoft 365 or Google Workspace configuration: MFA, admin roles, sharing settings, mail security, and accounts that should have been closed. It never reads email, files, calendars, or client records. The dated results go in your program file. Ward Agent's rules are mapped to the HIPAA Security Rule. A Regulation S-P evidence collector is coming soon.

The gap review also notes whether Regulation S-ID or 201 CMR 17.00 applies to your firm, and what adding either would cost. Your counsel handles any contract amendments with your providers.

How we work with your team

Alongside your CCO, your IT provider, and your compliance consultant

Your CCO stays in charge

The program feeds your CCO's annual review under Rule 206(4)-7. It does not replace the review.

Your IT provider keeps your systems

If you keep your provider, SaberGuard checks what it has set up and follows up on what is missing.

Your compliance consultant keeps their role

SaberGuard covers the security side alongside an outsourced CCO or compliance consultant.

What Massachusetts adds

  • A written information security program

    201 CMR 17.00 requires a WISP from any firm that holds personal information about a Massachusetts resident, whether it is registered with the SEC or the state. The Securities Division told advisers in 2010 that it would ask to see the program on routine exams.

  • Security terms in vendor contracts

    Massachusetts requires contracts that bind service providers to protect personal information (201 CMR 17.03(2)(f)). Regulation S-P requires oversight policies but not contracts.

  • State breach notices

    Under M.G.L. c. 93H, a breach affecting Massachusetts residents means notice to the Attorney General, the Office of Consumer Affairs and Business Regulation, and the residents, plus at least 18 months of free credit monitoring when Social Security numbers are exposed. The incident response program tracks the state and federal steps side by side; your counsel decides the wording of each notice.

What it costs

A fixed fee for the program, then advice as you need it

Regulation S-P program

For SEC-registered investment advisers

$5,000–$8,000fixed fee

  • Gap review against the amended Regulation S-P
  • A one-time Ward Agent baseline of your Microsoft 365 or Google Workspace security settings
  • Written incident response program and customer-notification procedure
  • Service-provider due diligence and monitoring procedures, with a vendor register
  • Recordkeeping set, a staff session, and a tabletop exercise

Advisers registered with the Massachusetts Securities Division instead of the SEC are quoted after a scoping call.

Core advisory

$1,000a month, up to 6 hours

A security lead on call for the decisions and paperwork that come up every month.

Program advisory

$2,000a month, up to 12 hours

A running security program with written records, for firms that answer to a regulator or a board.

Advice by the hour at $175, with no retainer. Managed security from $50 per user per month, with a $150 monthly minimum.

Full pricingHow managed security works

SaberGuard assesses and advises. It does not warrant or certify compliance or promise an audit or exam outcome.

Client stories

A firm we work with

Questions

What advisers ask before the first call

Find out where your firm stands.

A thirty-minute scoping call covers who you are registered with, which vendors handle client information, and which platform you run. You leave with a fixed fee and a start date.

Book a consultSee all services

SaberGuard assesses and advises; it does not warrant compliance.