Cybersecurity for RIAs

There is no single SEC cybersecurity rule for investment advisers, but an SEC-registered adviser is still required to have a written cybersecurity program. The obligation comes from Regulation S-P (safeguards, incident response and customer notice), Regulation S-ID (identity theft red flags), the compliance rule, Rule 206(4)-7, and the books and records rule, Rule 204-2. Examiners test all four.

This guide explains where each obligation comes from, what a working program contains, and what the Division of Examinations has said it will look at.

Why there is no dedicated rule

In February 2022 the Commission proposed a cybersecurity risk management rule for advisers and funds (Release 33-11028, File No. S7-04-22, published at 87 FR 13524 on 9 March 2022). It would have required written cybersecurity policies, confidential reporting of significant incidents to the Commission, disclosure of cybersecurity risks and incidents, and related records.

The Commission withdrew that proposal on 12 June 2025, together with the 2022 proposal on outsourcing by investment advisers and a number of other pending proposals (withdrawal notice published in the Federal Register on 17 June 2025, effective that day). The notice says the Commission does not intend to issue final rules on those proposals, and that any future action would start with a new proposal.

So the withdrawn proposal is not a requirement and is not a safe harbor. What binds an adviser today is the set of existing rules below.

Where the obligations come from

Regulation S-P

Rule 30 of Regulation S-P (17 CFR 248.30) requires written policies and procedures that address administrative, technical and physical safeguards for customer information. The 2024 amendments (Release IA-6604, 89 FR 47688, effective 2 August 2024) added three things that make it the center of an adviser's cybersecurity program:

• a written incident response program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information
• notice to affected individuals as soon as practicable and no later than 30 days after becoming aware of the unauthorized access, unless a documented reasonable investigation finds no likely substantial harm or inconvenience
• service provider oversight, including a requirement that providers notify the adviser within 72 hours of becoming aware of a breach affecting a customer information system they maintain

Compliance was required from 3 December 2025 for larger entities and from 3 June 2026 for smaller entities, so the amended rule now applies to every SEC-registered adviser. Our Regulation S-P compliance checklist covers the amendments in detail.

Regulation S-ID

Regulation S-ID (17 CFR 248.201) applies to an SEC-registered adviser that is a financial institution or creditor under the Fair Credit Reporting Act and offers or maintains covered accounts. A covered account is an account held primarily for personal, family or household purposes that is designed to permit multiple payments or transactions, and any other account with a reasonably foreseeable risk of identity theft.

Rule 248.201(c) requires every adviser to periodically determine whether it has covered accounts, with a risk assessment that considers how accounts are opened, how they are accessed, and the firm's previous experience with identity theft. An adviser that can move money out of client accounts should work through that determination rather than assume the rule is for broker-dealers, and should write the conclusion down either way.

A firm with covered accounts needs a written Identity Theft Prevention Program that identifies relevant red flags, detects them, responds to them, and is updated periodically. The initial program must be approved by the board or a board committee (a firm without a board designates a senior management employee), staff must be trained, and service provider arrangements must be overseen (Rule 248.201(d) and (e)).

Rule 206(4)-7

The compliance rule requires written policies and procedures reasonably designed to prevent violations of the Advisers Act, reviewed at least annually. When the Commission adopted it (Release IA-2204, December 2003), it listed issues it expects those policies to address where relevant. Three of them are cybersecurity in all but name:

• safeguards for the privacy protection of client records and information
• the accurate creation of required records, and their maintenance in a manner that secures them from unauthorized alteration or use and protects them from untimely destruction
• business continuity plans

A ransomware attack that locks the firm out of its records is a books and records problem and a business continuity problem as well as a privacy one.

Rule 204-2

The 2024 Regulation S-P amendments added Rule 204-2(a)(25), which requires an adviser to keep:

• its Regulation S-P safeguards and disposal policies
• written documentation of any detected unauthorized access to or use of customer information, and of the response and recovery
• documentation of each investigation and notification determination, including the basis for it and a copy of any notice sent
• its service provider oversight policies and the related contracts

Under Rule 204-2(e)(1) these are kept for five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser.

What examiners say they will look at

The Division of Examinations' priorities for fiscal year 2026 (published 17 November 2025) call cybersecurity "a perennial examination priority" and say particular attention will be on firms' policies and procedures for:

• governance practices
• data loss prevention
• access controls
• account management
• response to and recovery from cyber-related incidents, including ransomware attacks

The Division also said it will look at training and security controls that firms use to identify and mitigate new risks from artificial intelligence and polymorphic malware, including how firms operationalize information from threat intelligence sources, and at firms' operational resiliency.

For Regulation S-ID, the priorities say the Division will assess whether programs are reasonably designed to identify and detect red flags, particularly during customer account takeovers and fraudulent transfers, and whether they include training on identity theft prevention. For Regulation S-P, the Division will examine whether firms have developed, implemented and maintained policies and procedures that meet the amended rule. Across both, examinations will focus on policies and procedures, internal controls, oversight of third-party vendors, and governance.

The gap between policy and practice

The Commission's enforcement record makes one point repeatedly: a written policy that is not implemented is a violation in itself.

On 30 August 2021 the SEC announced settled actions against five Cetera entities, Cambridge Investment Research and its advisory affiliate, and KMS Financial Services (Press Release 2021-169). In each case, email accounts of representatives or advisers were taken over, exposing the personal information of thousands of customers and clients. The SEC found violations of Rule 30(a) of Regulation S-P. Cambridge discovered the first takeover in January 2018 but did not adopt firm-wide enhanced email security until 2021. KMS adopted written policies requiring additional security in May 2020 and did not fully implement them until August 2020. Two of the Cetera entities were also found to have sent breach notices with misleading language, in violation of Section 206(4) and Rule 206(4)-7.

The SEC's statement at the time: "It is not enough to write a policy requiring enhanced security measures if those requirements are not implemented."

What a working program includes

1. An inventory of systems and data. Where client information lives: devices, email, CRM, portfolio and planning software, custodian portals, file storage, and paper.
2. A written risk assessment that names the threats that matter for this firm, such as email account takeover, wire fraud, lost devices, and a vendor breach.
3. Access controls. Each person has only the access their job needs. Access is removed promptly when someone leaves. Shared logins are eliminated. Multi-factor authentication is used where it is available, especially on email and custodian platforms.
4. Account management and data loss prevention. Rules for what can be sent outside the firm, encryption of devices and transmissions, and procedures for verifying instructions to move money.
5. An incident response program that meets Regulation S-P: who leads, how an incident is assessed and contained, how the notice decision is made and recorded, and how the 30-day clock is tracked from awareness.
6. Vendor oversight. An inventory of service providers with access to customer information, risk-based diligence before engagement and periodically after, and contracts that require the 72-hour breach notice.
7. A Regulation S-ID determination, and if the firm has covered accounts, an Identity Theft Prevention Program approved as the rule requires.
8. Business continuity that assumes the firm's systems may be unavailable: backups that are tested, and a way to reach clients and custodians.
9. Training at hire and at least annually, covering phishing, account takeover and the firm's own procedures for verifying instructions.
10. Testing. A tabletop exercise of the incident response plan, a review of user access lists, and a check that every departed employee's access was removed.
11. Annual review under Rule 206(4)-7 that tests whether the controls were followed, not only whether the policy still reads correctly. See our annual compliance review checklist.
12. Records under Rule 204-2(a)(25), kept from the day they are made.

Common findings

• A policy that describes controls the firm does not actually use.
• Multi-factor authentication required on paper but not turned on for every account.
• No Regulation S-ID determination, on the unwritten assumption that the rule does not apply to advisers.
• An incident response plan that has never been exercised.
• Vendors with access to client data and no diligence file.
• Former employees whose access to email or a custodian portal was never removed.

Common questions

Is there an SEC cybersecurity rule for investment advisers?

Not a standalone one. The Commission proposed one in 2022 and withdrew the proposal on 12 June 2025. An SEC-registered adviser's cybersecurity obligations come from Regulation S-P, Regulation S-ID where it applies, Rule 206(4)-7 and Rule 204-2.

Does a small or solo RIA need a written cybersecurity policy?

If it is registered with the SEC, yes. Regulation S-P requires written safeguards policies and an incident response program, and has no size exemption. The program can be short, but it should describe what the firm actually does.

Does Regulation S-ID apply to investment advisers?

It can. It applies to an SEC-registered adviser that is a financial institution or creditor under the Fair Credit Reporting Act and offers or maintains covered accounts. Every adviser must make the periodic covered account determination, and an adviser that can direct transfers or payments from client accounts should look at it carefully.

What does the SEC look for in an adviser cybersecurity exam?

According to the fiscal year 2026 priorities: governance, data loss prevention, access controls, account management, incident response and recovery (including ransomware), training and controls for AI-related and polymorphic malware risks, operational resiliency, and compliance with Regulations S-P and S-ID, including oversight of vendors.

Do state-registered advisers have to follow Reg S-P and S-ID?

No. Both apply to advisers registered or required to be registered with the SEC. State-registered advisers should check their state securities regulator's requirements, the FTC's rules under the Gramm-Leach-Bliley Act, and state breach notification laws.

Start from a template

Luna's privacy and identity theft policy template covers Regulation S-P and Regulation S-ID, the vendor oversight policy template covers service providers with access to client information, and the business continuity plan template covers recovery when systems are unavailable. If the firm uses AI tools, our guide to AI compliance for RIAs covers vendor diligence and recordkeeping.