What must SEC-regulated firms now demonstrate under Regulation S-P?

Both implementation deadlines have passed: larger entities were due on 3 December 2025 and smaller entities on 3 June 2026. The amendments cover specified brokers and dealers, funding portals, investment companies, SEC-registered investment advisers and registered transfer agents; they do not apply to every business merely because it operates in financial services. (sec.gov)

The amendments require written incident-response policies and procedures and generally require customer notification as soon as practicable, but no later than 30 days after the institution becomes aware of the relevant unauthorised access or use, subject to the rule’s investigation and other provisions. They also address service-provider oversight and compliance records. (sec.gov)

What should the compliance owner do now?

Recommended action: sample completed incidents and exercises rather than accepting a policy-upload milestone as implementation evidence.

For each sample, ask the platform to show:

1. The affected institution and information.
2. When the relevant facts became known.
3. Who performed the investigation and notification assessment.
4. The rationale and approval for notifying—or not notifying.
5. The applicable deadline and escalation history.
6. The approved communication and delivery evidence.
7. Linked supplier actions and unresolved remediation.

Do not hard-code every privacy, cyber and supplier incident to the same trigger. Give counsel control over the decision fields and deadline logic, with restricted permissions where appropriate.

Buying implication: compare the proposed GRC incident workflow with existing security and privacy case-management systems. Require suppliers to demonstrate integration and decision traceability before adding a duplicate incident module.