In May 2024 the SEC adopted amendments to Regulation S-P that require broker-dealers, investment advisers, investment companies and transfer agents to keep written policies for an incident-response programme able to detect, respond to and recover from unauthorized access to customer information, and to notify affected individuals as soon as practicable and no later than 30 days after becoming aware of an incident. Larger entities had to comply by December 3, 2025; smaller entities have until June 3, 2026. If you are a smaller firm, that date has passed and the programme should be live.
1. The Three Clocks
Morrison Foerster's summary of the release sets out the three numbers that drive the plan. Service providers must notify the covered institution as soon as possible but no later than 72 hours after becoming aware of a breach. The institution must notify affected individuals as soon as reasonably practicable, and not later than 30 days after learning of unauthorized access or use. And the records of all this must be kept: three years for broker-dealers and transfer agents, five for registered investment advisers, six for investment companies.
2. Build the Programme as a Project
Write the work down as tasks with owners: inventory the service providers that receive, maintain or process customer information; get each one's breach-notice commitment in writing; draft the incident playbook and the customer-notice template; train the staff who will run it. Lowenstein's 2025 client alert lists much the same steps, including amending service-provider contracts to require breach notice within 72 hours and preparing customer-notice templates. A recurring task for the annual vendor review keeps the inventory from going stale.
3. Make the Incident Itself a Template
When an incident starts, nobody should be inventing the checklist. Keep an incident project template whose tasks are due relative to the day the firm became aware: containment, scoping, the sensitive-customer-information assessment, the notice decision, and the 30-day notice deadline. Discussion in the incident project is journaled under compliance mode, so the record of who decided what, and when, already exists when an examiner asks.
4. Your Project Tool Is a Service Provider Too
If customer information sits in your project tool, the vendor belongs on the inventory. Ask where data is processed, what encryption is used, and whether a SOC 2 report exists. Kavanah's security page answers those plainly: production data is processed in the United States, data is encrypted at rest with per-workspace keys for credentials, and its SOC 2 Type II observation period is underway with no report yet.
Our project management software for financial services page lists the rest of the vendor questions worth asking, and how Kavanah answers each one.
