IT Checklist for Financial Advisors: Reg S-P and Security

If you run a small advisory firm, your IT has three jobs beyond keeping the computers working: protect customer information, prove that you protect it, and keep business communications for as long as the rules say. As of June 3, 2026, every SEC-registered adviser, large or small, must also have a written incident response program and be able to notify affected customers within 30 days of a breach. This guide covers the software involved, the rules, the risks, and a checklist you can copy.

This is IT guidance, not legal or compliance advice. Your chief compliance officer or compliance consultant decides how the rules apply to your firm.

The Software a Small Advisory Firm Actually Runs

Most of an advisory firm’s sensitive data lives in other companies’ cloud systems. Your IT work is mostly about controlling who can sign in to them, and from which devices.

Layer	Common examples	What IT has to get right
Custodian portal	Schwab Advisor Center, Fidelity Wealthscape, Altruist	Unique login per person, multi-factor authentication (MFA), fast removal when someone leaves
CRM (client relationship manager)	Redtail CRM by Orion, Wealthbox, Salesforce	MFA, role-based access, export controls
Planning software	eMoney, MoneyGuidePro, RightCapital	MFA, secure client portal instead of emailed PDFs
Portfolio reporting	Orion, Black Diamond, Tamarac	Same sign-in controls, vendor due diligence file
Email and files	Microsoft 365 or Google Workspace	MFA, encryption, retention, device management
Email archive	Smarsh, Global Relay, or Microsoft Purview retention	Captures every business mailbox, searchable, tamper resistant

Two things follow from this table. First, your email account is the master key, because password resets for almost every other system land there. Second, each vendor in the table is a “service provider” under the rules below, and you are expected to oversee them.

Which Rules Apply to Your Firm?

It depends on how you are registered.

• SEC-registered investment advisers and broker-dealers are covered by the SEC’s Regulation S-P, the privacy and safeguards rule for customer information.
• State-registered advisers (in California, those licensed through the Department of Financial Protection and Innovation) are not covered by Regulation S-P. The FTC lists “investment advisors that aren’t required to register with the SEC” among the businesses covered by its Safeguards Rule, which has similar requirements. We cover it in our FTC Safeguards Rule guide.
• Registered representatives of a broker-dealer follow their firm’s written supervisory procedures, which usually dictate approved devices, email, and archiving. Ask your home office before changing anything.

California’s breach notification law applies to all of the above in addition to the federal rules.

What Does Amended Regulation S-P Require?

The SEC adopted amendments to Regulation S-P on May 16, 2024. According to the SEC’s small entity compliance guide, larger entities had to comply by December 3, 2025, and smaller entities by June 3, 2026. For advisers, “larger” means $1.5 billion or more in assets under management, so nearly every small firm fell under the June 2026 date. As of September 2026 we found no SEC announcement extending either date. Both have passed, which means the requirements apply now.

In practical terms, the amendments require covered firms to:

1. Keep a written incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. It must include steps to assess the incident and to contain it.
2. Notify affected individuals as soon as practicable, and no later than 30 days after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice is not required if, after a reasonable investigation, the firm determines the information is not reasonably likely to be used in a way that causes substantial harm or inconvenience. That determination has to be documented.
3. Oversee service providers. Your policies must be designed to ensure that vendors protect customer information and tell you about a breach of their systems as soon as possible, and no later than 72 hours after they become aware of it.
4. Dispose of customer information properly. The disposal rule now covers both customer and consumer information.
5. Keep written records that document compliance.

What This Means for Your IT

• You need logs that can answer “what did the attacker see?” Turn on and retain sign-in and mailbox audit logs in Microsoft 365 or Google Workspace. Without them, you cannot make the harm determination in item 2, and the safe assumption becomes notifying everyone.
• You need a current list of where customer information lives: every system in the table above, plus laptops, phones, scanners, and any old file server.
• You need a vendor file: each provider’s security documentation and the contract language on breach notice.
• You need a wipe and disposal process for retired computers, copier hard drives, and departing employees’ phones.

What Do SEC and FINRA Examiners Look At?

The SEC Division of Examinations’ fiscal year 2026 priorities describe cybersecurity as a perennial priority. The document names governance, data loss prevention, access controls, account management, and response and recovery from incidents, including ransomware. It also says the Division will examine compliance with the amended Regulation S-P, including incident response programs, and with Regulation S-ID, the identity theft red flags rule.

For broker-dealers, FINRA’s 2026 Annual Regulatory Oversight Report lists the threats it observes at member firms: ransomware, data breaches, phishing by email, SMS, and QR code, new account fraud, account takeovers, imposter websites, and insider threats. The effective practices it lists are a useful benchmark for any advisory firm:

• MFA for login access to firm systems
• Reviewing unusual activity, such as wire requests to third-party accounts
• Watching for newly registered imposter domains and fake social media profiles
• Regular staff training on spotting and reporting phishing
• Clear policies for personal devices used for work
• Monitoring vendor risk

How Long Do Advisers Have to Keep Email?

For SEC-registered advisers, Advisers Act Rule 204-2 requires keeping written communications, sent and received, that relate to recommendations and advice, the receipt or delivery of funds or securities, and the placing of orders. Records must be kept in an easily accessible place for at least five years from the end of the fiscal year of the last entry, the first two in an appropriate office of the adviser. Electronic storage is allowed if records are indexed, protected from loss or alteration, backed up separately, and can be produced promptly.

For broker-dealers, Exchange Act Rule 17a-4 requires keeping business communications for three years, the first two in an easily accessible place, on a system that is either non-rewriteable or keeps a complete time-stamped audit trail.

What that means in practice:

• A normal mailbox is not an archive. Staff can delete messages, and Microsoft deletes a mailbox’s data 30 days after its license is removed unless a hold or retention policy is in place.
• Most firms keep everything rather than trying to sort “advice” email from the rest. Your compliance officer sets the retention period.
• Options include a dedicated archive such as Smarsh or Global Relay, or retention policies in Microsoft Purview. Our guide to Microsoft 365 email archiving explains how the built-in option works.
• The rules are written around the communication, not the tool. If business advice is given in a messaging app, that channel needs to be captured too, or prohibited in your written policy.

The Specific Risks for an Advisory Firm

• Email account takeover. An attacker who gets into an adviser’s mailbox can read client conversations and send a believable request to move money. The FBI’s 2025 Internet Crime Report recorded 24,768 business email compromise complaints with about $3.05 billion in reported losses. See our guide to business email compromise.
• Fraudulent disbursement requests. A client’s own email may be the one that is compromised. A firm rule to confirm every third-party wire by voice, using a number already on file, matters more than any software.
• Lost or stolen laptops holding downloaded statements and tax documents. Full-disk encryption (BitLocker on Windows, FileVault on Mac) keeps the data unreadable to whoever finds the device. California’s breach notification law is triggered by unencrypted personal information, so encryption changes the outcome of a lost laptop.
• Imposter websites and profiles that copy your firm’s name to collect client logins.
• Offboarding gaps. A former employee who still has a custodian login or a synced phone is unauthorized access waiting to happen.

A Copyable IT Checklist for Advisory Firms

Copy this into a document and mark each line yes, no, or not sure.

1. Every person has their own login to the custodian portal, CRM, and planning software. No shared passwords.
2. MFA is on for email, custodian, CRM, planning software, and the password manager. Authenticator app or security key where the vendor allows it. (Why multi-factor authentication matters.)
3. Admin accounts are separate from everyday accounts.
4. Every laptop and desktop is encrypted, patched automatically, and runs managed endpoint protection.
5. Phones that receive firm email have a passcode and can be remotely wiped of firm data.
6. Sign-in and mailbox audit logging is on, and logs are retained long enough to investigate an incident.
7. Email is archived for the period your compliance officer has set, including former employees’ mailboxes.
8. Files containing customer information are sent through a client portal or encrypted email, not as plain attachments.
9. Backups exist for Microsoft 365 or Google Workspace data and any local files, and a restore has been tested.
10. There is a written incident response plan with names, vendor contacts, and the 30-day notification clock. (Our incident response plan guide has a starting structure.)
11. There is a vendor list with each provider’s security documentation and breach notice terms.
12. There is a written onboarding and offboarding checklist, and access is removed the same day someone leaves.
13. Guest Wi-Fi is separate from the office network.
14. Retired computers, drives, and copiers are wiped or destroyed, and the disposal is recorded.
15. Staff complete security training at least annually, and new hires get it in their first week.

Questions to Ask Any IT Provider

• How will you document our controls so we can hand evidence to an examiner or our compliance consultant?
• Who at your company will have administrator access to our email and files, and how is that access protected and logged?
• If you become aware of a security incident that touches our data, how fast will you tell us, and will you put a 72-hour maximum in the contract?
• How do you handle email retention, and who signs off on the retention period?
• What happens on the day an employee leaves?
• What do you do if one of our vendors is breached?
• What is outside your scope?

Good answers are specific and in writing.

When a Small Firm Does Not Need More

A one-person practice that works entirely in the custodian’s and vendors’ cloud systems, on one encrypted laptop with MFA everywhere, may not need ongoing IT support. A one-time setup review plus the written documents above can be enough. The documents and the evidence are still required. The size of the program scales with the firm.

Common Questions

Does Regulation S-P Apply to a State-Registered Adviser?

No. The amended Regulation S-P covers broker-dealers, investment companies, SEC-registered investment advisers, funding portals, and transfer agents. The FTC says its Safeguards Rule covers investment advisors that are not required to register with the SEC, and it has comparable requirements: a written security program, risk assessment, MFA, encryption, and an incident response plan.

Is the Regulation S-P Deadline Still Ahead for Small Firms?

No. The compliance date for smaller entities was June 3, 2026, and for larger entities it was December 3, 2025. If your firm does not yet have a written incident response program, service provider oversight procedures, and a way to meet the 30-day notification requirement, treat it as overdue and work with your compliance consultant now.

Does Microsoft 365 Meet the Email Retention Rules by Itself?

Not by default. A standard mailbox lets users delete mail, and a mailbox’s data is deleted 30 days after its license is removed unless a hold or retention policy applies. Retention policies and archiving can be configured in Microsoft 365, or you can use a dedicated archive. Whichever you choose, your compliance officer should approve the configuration and test a retrieval.

When Does the 30-Day Notification Clock Start?

Under the amended rule, notice is due as soon as practicable, and not later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. California’s breach law, Civil Code 1798.82, also sets a 30 calendar day deadline for notifying affected California residents.

How Coastal Growth Co. Can Help

We are based in Laguna Hills and work with small offices across Orange County, on site and remotely. For an advisory firm, we can review your setup against the checklist above, configure MFA, device encryption, logging, and email retention in Microsoft 365 or Google Workspace, and put together the IT evidence your compliance consultant asks for. We handle the technology and leave the regulatory judgment to your compliance professionals. See our managed IT services and cloud and email services, or contact us to describe what you need. Scope and price are agreed before any paid work starts.