Regulators have made it clear that cybersecurity compliance belongs to the CCO now, and no longer only to the IT team. The SEC's amended Reg S-P, combined with FINRA's ongoing exam focus on third-party vendor risk, means your firm needs documented controls, tested workflows, and retrievable records. If you're building that program or filling in gaps, here's what the current requirements actually look like in practice.
TLDR:
- Reg S-P now requires a written incident response plan, 30-day breach notification, and documented vendor oversight. Every covered firm must comply.
- SEC and FINRA examiners test whether your cybersecurity controls are implemented and followed. A written policy is only the starting point.
- Your vendor relationships are a compliance exposure: Reg S-P requires documented oversight of every third party that touches customer data.
- Employee training records and signed attestations are standard exam requests. Verbal assurances don't hold up without dated, retrievable records.
- Greenboard centralizes vendor due diligence, risk assessments, attestations, and communications archiving in one defensible system of record.
Why cybersecurity shifted from an IT problem to a compliance problem
For most of the past decade, cybersecurity at a financial advisory firm looked like an IT problem. The compliance team handled policies; the tech team handled the actual security infrastructure. That division made intuitive sense, right up until regulators decided it didn't. The SEC's Office of Compliance Inspections and Examinations flagged cybersecurity controls as a deficiency in examinations well before the amended Reg S-P took effect, noting in multiple exam cycles that firms lacked documented incident response procedures and couldn't show that written policies were actually being followed. In other words, regulators weren't citing IT failures. They were citing compliance failures.
The shift wasn't abrupt, but it was real. As the SEC expanded Regulation S-P to require written incident response programs, breach notifications, and documented vendor oversight, those obligations landed squarely in the compliance program. They require policies, procedures, testing, recordkeeping, and evidence of follow-through. That's compliance work, regardless of who manages the firewall.
FINRA has moved in the same direction. Cybersecurity now appears alongside fiduciary duty as a standing exam focus, and examiners are asking whether a firm's controls are documented, supervised, and enforced. The CCO, not the IT director, is expected to answer those questions, adding one more item to why compliance becomes a bottleneck at growing firms.
What the SEC cybersecurity rules actually require
The regulatory picture as of late 2026 has clarified considerably, after the SEC withdrew its standalone cybersecurity proposal in 2025 and finalized Reg S-P amendments instead.
The 2024 amendments to Regulation S-P are the primary obligation for registered investment advisers and broker-dealers. They require a written incident response program, notification to affected individuals within 30 days of a qualifying breach, and documented oversight of service providers that handle customer data. Larger entities hit their compliance deadline in December 2025; smaller entities' deadline was June 3, 2026. Every covered firm is expected to be fully compliant.
The SEC's broader standalone cybersecurity risk management proposal for investment advisers was formally withdrawn in 2025. That doesn't reduce the pressure. Reg S-P's requirements cover incident response, safeguarding, and recordkeeping in enough depth that the practical compliance burden remains substantial. Reg S-ID adds identity theft prevention program requirements on top of that for firms that qualify.
What matters most right now for broker-dealers and advisers alike: the written program, the 30-day clock, and the paper trail.
How SEC and FINRA examiners assess cybersecurity compliance
Knowing what the rules require is one thing. Knowing how examiners test for them is a different question entirely.
The SEC's 2026 examination priorities call out cybersecurity as part of its focus on the effectiveness of advisers' compliance programs. Examiners are not checking whether a written policy exists. They're asking whether it has been tested, followed, and documented over time. A policy that lives in a folder and never gets reviewed is a liability, not a defense.
FINRA's 2026 Annual Regulatory Oversight Report flags a specific area of concern: third-party vendor risk. Examiners have observed an increase in cyberattacks and outages at vendors used by member firms, and they expect firms to have supervisory procedures covering outsourced functions.
In practice, the examiner checklist tends to focus on:
- Written incident response program and evidence that it has been tested, beyond simply being drafted
- Vendor oversight documentation, including due diligence records for outsourced functions
- Training records showing employees have been informed of their cybersecurity obligations
- Logs confirming the firm can detect, respond to, and notify affected individuals within the 30-day window
The common thread is documentation, which matters as much for financial advisors as for the firms they work for. Regulators want to see what you did, when you did it, and who approved it.
| Requirement | Rule / authority | What examiners want to see |
|---|---|---|
| Written incident response program | Reg S-P (amended 2024) | Dated plan, evidence it has been tested, not simply drafted |
| 30-day breach notification | Reg S-P (amended 2024) | Documented workflow showing the firm can identify and notify within the window |
| Service provider / vendor oversight | Reg S-P; FINRA Rule 3110 | Risk-tiered vendor inventory, due diligence records, contracts with security requirements, ongoing monitoring |
| Written risk assessment | Reg S-P; SEC exam priorities | Recurring assessments with version history; findings that led to actual control changes |
| Employee training and attestations | Reg S-P; FINRA exam focus | Dated training logs by employee, signed acceptable-use attestations renewed on a defined schedule |
| Identity theft prevention program | Reg S-ID | Written program for qualifying firms covering detection, prevention, and response to red flags |
| Communications supervision | Rule 204-2; FINRA Rule 3110 | Approved-channel archive, evidence of review, no gaps from unapproved tools |
Written policies and risk assessments as compliance evidence
A written information security policy is the foundation regulators expect to find first. Without it, every other control you have is harder to defend, because there's no documented framework tying it together.
The policy needs to cover how the firm identifies risks, what safeguards are in place, and how incidents get handled. But the document itself is only part of the requirement. Examiners also want to see a formal risk assessment process showing that the firm actively reviewed its vulnerabilities and updated its controls in response. A risk assessment done once and never revisited signals a program that exists on paper, not in practice.
A few things regulators look for in this area:
- A written information security policy tied to specific firm operations, not a generic template
- Documented risk assessments conducted at regular intervals, and when material changes occur
- Evidence that assessment findings led to actual changes in controls or procedures
- Version history or dated records showing the policy has been reviewed and updated over time
Under the amended Reg S-P requirements, firms must maintain written records documenting compliance. Your risk assessment can't just happen in a meeting. It has to produce a record that an examiner can pull and review.
Vendor and third-party oversight as a cybersecurity obligation
Most financial advisory firms rely on dozens of vendors: portfolio management software, custodians, cloud storage, email providers, document systems. Each one that touches customer data is now a compliance exposure.
Reg S-P's service provider provisions require firms to oversee any third party that accesses, maintains, or transmits sensitive customer information, and that third-party oversight must be documented. FINRA Rule 3110 reinforces this from the supervision side: outsourcing a function doesn't outsource the supervisory obligation that goes with it.
FINRA has observed an increase in vendor cyberattacks at third-party providers used by member firms, and the concern has made it into exam conversations. A breach at a vendor you use is your compliance problem if you can't show you vetted them, set contractual expectations, and monitored their security posture over time.
What a CCO needs to show in an exam
- A current inventory of vendors with access to customer data, with each one risk-tiered by sensitivity and access level
- Due diligence records for each material vendor, updated on a defined schedule and not left to gather dust after onboarding
- Contracts that include data security requirements and breach notification obligations
- Evidence of ongoing monitoring, not a one-time review at procurement
The gap most firms, including hedge funds with complex vendor networks, have is that last point. Initial due diligence gets done, years pass, the vendor relationship expands, and no one runs a formal review. That gap is exactly what examiners probe.
Employee training, attestations, and the human risk factor
Firewalls and encryption protect the perimeter. Employees are a different story.
Regulators understand that most cybersecurity incidents trace back to human behavior: a phishing link clicked, an unapproved file-sharing tool used, a personal device synced to client data. That's why training records and attestations have become a standard part of what examiners ask for, right alongside your written policy.
The compliance parallel is straightforward. If you already run annual code-of-ethics acknowledgments and outside business activity attestations, cybersecurity attestations follow the same logic. Employees confirm they've read the acceptable use policy, understand data handling requirements, and know how to report a suspected incident. Without a signed attestation, you're relying on verbal assurances that don't survive an exam.
What examiners want to see in this area:
- Dated training completion records for each employee, tied to a specific cybersecurity curriculum
- Signed attestations on acceptable use policies and data handling procedures, renewed at a defined interval
- A process for employees to report unapproved tools or suspicious activity, with evidence that reports get documented
- Records confirming new hires complete training before accessing client systems
The through-line is retrievability. If an examiner asks who completed training and when, you need to pull that record in minutes, not reconstruct it from email threads.
Communications supervision as a cybersecurity signal
Electronic communications records serve a dual purpose that often gets overlooked. They're a books-and-records obligation under Rule 204-2 and a supervision requirement under FINRA Rule 3110, but they're also one of the clearest windows into whether sensitive client data is staying inside supervised channels.
Examiners pay attention to whether advisors were using approved communication tools or routing client conversations through personal email and unapproved messaging apps. An archive gap, or an advisor conducting business through a channel that never gets captured, raises both a supervision finding and a cybersecurity concern at the same time.
Behavioral signals matter here too. Unusual file transfers, client data sent to external recipients, or spikes in unapproved channel usage can indicate phishing compromise or unauthorized data sharing before a formal incident is ever reported. A well-run communications supervision program catches those patterns. A random-sampling approach that relies on keyword flags tends to miss them.
Building a cybersecurity compliance program that holds up in an exam
Start with a gap analysis. Pull your current program against the Reg S-P checklist and identify what's missing, undocumented, or untested. That exercise alone usually surfaces three or four items needing immediate attention before an examiner finds them first.
From there, the practical priorities are straightforward:
- Written incident response plan with a tested 30-day notification workflow, one that has been exercised and verified in practice
- Formal risk assessment on a recurring schedule, with findings documented and controls updated in response
- Vendor inventory with due diligence records for every third party touching customer data, reviewed annually
- Employee training logs and signed attestations, retrievable by name and date
- Policy version history showing the program has been actively maintained
The exam-readiness test is simple: if an examiner walks in tomorrow and asks for any of these, how long does it take you to produce them? If the answer involves rebuilding records from email threads or shared drives, that's where to focus first, and it's often a sign a firm needs a system of action and not a patchwork of disconnected tools.
How Greenboard fits into a firm's cybersecurity compliance program
Every requirement covered in this article produces a document, a record, or a workflow. The question is whether those pieces live in one place or across spreadsheets, shared drives, and disconnected tools.
Greenboard is built around that exact problem. Our third-party compliance module automates vendor due diligence, pulling public data and flagging key risk points so a review that used to take a week takes hours, the same approach behind a $7.5 billion RIA case study on Greenboard. Firm compliance runs risk assessments as a continuous process, not a once-a-year exercise, with version history and dated records examiners can pull on demand. Employee attestations and training acknowledgments are tracked by name and date inside the same system. Communications archiving runs on WORM-based, 17a-4 compliant infrastructure with SOC 2 Type 2 certification, capturing eComms across approved channels in a searchable, retrievable archive, part of a broader compliance platform built to connect these workflows.
More than 600 financial firms run their compliance programs on Greenboard. The architecture is designed to be defensible above all else, because when an examiner walks in, documentation that can be produced in minutes matters more than documentation that technically exists somewhere. Book a Greenboard demo to see how it works for your firm.
Final thoughts on financial adviser cybersecurity and exam readiness
Regulators have been clear about what they want to see, and the firms that struggle in exams are usually the ones whose documentation exists somewhere but takes days to pull together. Your incident response plan, vendor records, and training logs should be the easy part of an exam. Getting that infrastructure in place now means fewer surprises later.
FAQ
What does the SEC's amended Regulation S-P actually require financial advisors to have in place right now?
Every covered firm must have a written incident response program, a documented process for notifying affected individuals within 30 days of a qualifying breach, and oversight records for any service provider that handles customer data. Both the large- and small-entity compliance deadlines have passed, so full compliance is expected across the board as of mid-2026.
How do SEC and FINRA examiners test cybersecurity compliance during an exam?
In practice, examiners want to see a dated incident response plan, vendor due diligence records, employee training logs with signatures, and evidence that risk assessment findings actually changed something in your controls. A written policy on its own is not enough.
Can a financial advisory firm satisfy Reg S-P's vendor oversight requirements without running formal due diligence on every third party?
No. Reg S-P requires documented oversight for any third party that accesses, maintains, or transmits customer data, and FINRA Rule 3110 makes clear that outsourcing a function does not outsource the supervisory obligation attached to it. A risk-tiered vendor inventory with dated due diligence records, contractual data security requirements, and evidence of ongoing monitoring is what an examiner expects to pull.
How do small financial firms keep up with SEC cybersecurity compliance requirements without a large compliance team?
The practical answer is to build around retrievability, not volume. If your written program, risk assessments, vendor records, and training logs are organized and can be produced in minutes, a small team can run a defensible program. The firms that struggle are those whose records are scattered across email threads and shared drives, not those with lean headcount.
How does Greenboard help financial advisors meet Reg S-P's recordkeeping and vendor oversight requirements?
Greenboard's third-party compliance module automates vendor due diligence and cuts review time from roughly a week to one to two hours, with cited sources and structured risk evaluations. Firm compliance runs risk assessments as a continuous process with version history and dated records built in, and employee attestations are tracked by name and date inside the same system, so everything an examiner asks for is retrievable from one place, not reconstructed from scattered files.
