As smaller firms comply with the Securities and Exchange Commission\u2019s changes to Regulation S-P, experts are warning reps to ensure their incident response plans for cybersecurity events are up to date and workable.<\/p>\n
The Reg S-P changes were passed in late 2024, which updated (and expanded) firms\u2019 responsibilities for safeguarding consumer data. Firms with over $1.5 billion in managed assets had a Dec. 3, 2025, compliance date, while firms below the threshold face a deadline this week, on June 3.<\/p>\n
Among the changes are requirements to update incident response programs, a 30-day requirement for consumer notification, and a 72-hour deadline for vendors to inform RIAs of cyber incidents.\u00a0<\/p>\n
In a discussion with\u00a0Wealth Management,\u00a0Michael Cocanower, the founder and CEO of RIA IT consulting firm itSynergy, said responses from clients about the Reg S-P ran the gamut from complete preparedness to total surprise.\u00a0According to Cocanower, RIAs\u2019 backup and disaster recovery\/business continuity plans did not serve as replacements for an incident response plan, which details how a firm will respond to a cybersecurity attack, and he said RIAs had complained that there was little guidance available on how to craft such a plan.<\/p>\n