Introduction
An investment adviser's cybersecurity policy does two jobs. It satisfies regulators, and it tells your people how to protect client information, keep the business running, and show that leadership is paying attention.
This guide covers SEC-registered advisers, exempt reporting advisers, state-registered RIAs, private fund advisers, and firms juggling state, federal, and contractual duties. Rules change, so treat this as a practical orientation, not legal advice. Confirm your obligations with qualified securities counsel.
The stakes are real. In November 2025, the SEC fined M Holdings $325,000 for Regulation S-P and S-ID violations, partly because its policies were never applied at branch offices.
Key Takeaways
- Your obligations depend on registration status, account types, data handled, vendors, and state rules.
- A sound policy covers risk, safeguards, detection, response, recovery, training, vendors, testing, and records.
- Separate effective rules from the withdrawn 2022 SEC proposal before updating policies or disclosures.
- Boards need evidence of implementation, clear decision rights, and escalation thresholds.
Which Cybersecurity Rules Apply to Investment Advisers?
Registration status sets the framework
Classify your firm first. Registration status determines which cybersecurity rules apply:
- SEC-registered: Generally required at $110 million or more in regulatory assets under management; existing registrants may remain at $90 million or more
- Exempt reporting advisers: Report to the SEC without registering (for example, advisers to only venture capital funds or small private funds)
- State-registered advisers: Answer primarily to state regulators
- Dual registrants: Carry both adviser and broker-dealer duties
A state-registered RIA is not automatically subject to every SEC adviser requirement. Washington, for example, expressly requires written physical and cybersecurity policies. The NASAA model rule, adopted in 2019, calls for tailored written policies, annual review, and client privacy-policy delivery, but it is a model, not a nationwide law.
Regulation S-P and customer information
The 2024 amendments to Regulation S-P took effect August 2, 2024. Larger advisers ($1.5 billion or more in AUM) had to comply by December 3, 2025. Smaller advisers must comply by June 3, 2026. Verify current dates on SEC.gov before relying on them.
Core requirements include:
- Written policies to detect, respond to, and recover from unauthorized access to customer information
- Assessing the nature and scope of an incident, then containing it
- Notice to affected individuals within 30 days of awareness when sensitive information was, or is reasonably likely to have been, misused
- Service providers notifying you within 72 hours of a breach
- Documented oversight of those providers
- Five-year retention of related records
The 30-day and 72-hour clocks serve different recipients. Do not merge them.
Regulation S-ID and identity-theft red flags
S-ID applies only if you offer or maintain covered accounts. Authority to withdraw client funds or direct third-party payments can make an account a transaction account. Authority only to deduct advisory fees does not.
If covered, you need a written program that identifies red flags, detects them, responds, and is updated periodically. The December 2022 SEC risk alert flagged missing account assessments, generic programs, and weak provider oversight.
Other overlapping obligations
- FTC Safeguards Rule: Reaches advisers not required to register with the SEC, subject to FTC jurisdiction.
- State breach laws: All 50 states, DC, and territories have them, with varying definitions and deadlines, according to the NCSL summary.
- State rules: Massachusetts 201 CMR 17.00 and New York's Part 500 can apply depending on how you are licensed and whom you serve.
- Contracts and insurance: Client agreements and cyber-insurance policies often impose their own notice terms.
What is proposed, withdrawn, and effective
The SEC proposed adviser cybersecurity rules in February 2022 (IA-5956). That proposal would have required Form ADV-C within 48 hours of a significant incident and new Form ADV Part 2A Item 20 disclosure. The SEC withdrew it on June 12, 2025, and says it does not intend to issue final rules.
Two common errors still show up. The four-business-day deadline belongs to Form 8-K Item 1.05 for public companies, not advisers. Exam priorities are staff statements, not new law. Do not add ADV language or reporting clocks without confirming the governing source.
What Should an Investment Adviser Cybersecurity Policy Include?
Rule 206(4)-7 requires written compliance policies, annual review, and a designated administrator. Your cybersecurity policy should plug into that structure. The NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) make a useful organizing map, though it is not an SEC mandate.
Governance, scope, and accountability
Name the covered systems and the client and firm data they hold. Then assign people:
- The CCO owns policy administration
- An executive owns enterprise risk
- IT or security owns control operation
- Legal owns notification analysis
- The board or committee receives reporting
Define who decides, who shares, and who advises across policy guardrails, incident escalation, exceptions, and risk acceptance. Set escalation thresholds in terms of money, downtime, client harm, and legal duty. Risk acceptances should carry time limits.
Risk assessment and information inventory
Make this an ongoing process, not an annual event. Map systems, data flows, access privileges, critical vendors, and gaps. Look for concentration around one cloud, one identity provider, or one managed-service provider. Scale the depth to your size, complexity, and use of outsourced services.
Administrative, technical, and physical safeguards
Describe control ownership and operating expectations, not product names. Cover:
- Least-privilege access and removal of stale accounts, especially former employees and contractors
- Multi-factor authentication for remote access, email, and admin consoles
- Encryption and secure communications
- Patching that prioritizes internet-facing and identity systems first
- Protected backups with confirmed restoration
- Remote-work, device, and physical records controls
The SEC's 2020 credential-compromise alert tied client losses to password reuse and easily guessed usernames. Basic controls matter.
Detection, monitoring, and vulnerability management
Define how alerts are reviewed, anomalies investigated, and evidence preserved. You do not need a perfect SIEM, but logging should be good enough to tell whether suspicious activity occurred. Tie each detection step to a response procedure and a management report.
Incident response and recovery
Write the workflow: triage, severity, containment, investigation, eradication, recovery, communications, legal review, client protection, and lessons learned. Capture forensic images and decision notes in parallel with restoration, not afterward.
Keep internal escalation separate from external duties to regulators, states, clients, law enforcement, insurers, and counterparties. Verify every deadline against the current source.
Workforce, vendor, and records controls
Cover training, acceptable use, phishing resistance, credential handling, onboarding, offboarding, and discipline. For vendors, require due diligence, contract notice terms, monitoring, and incident notification. Retain records of policy approval, training, assessments, testing, vendor reviews, incidents, and remediation. Rule 204-2 generally sets five-year retention, with the first two years in an appropriate adviser office.
How Should Firms Govern and Implement the Policy?
Build a policy-to-practice operating model
Translate each regulatory requirement into an assigned control, a named owner, a milestone, and inspectable evidence. A decision-rights map (RACI) makes this concrete. Involve compliance, legal, technology, operations, HR, and business leadership in the review.
Establish board and executive oversight
Boards and committees should receive concise updates on:
- Current risk posture and material changes
- Significant incidents and open exceptions
- Vendor exposure and test results
- Decisions the board needs to make
Keep reporting plain: what changed, why it matters, who owns the response, and what decision is required.
Formal reporting is typically quarterly, with monthly metrics when risk is elevated. A one-page summary plus one page of detail works better than a 50-page register nobody reads.
Test, review, and update the program
- Run periodic risk assessments and policy reviews
- Hold a 90-minute tabletop with legal, finance, communications, and operations
- Test phishing awareness and backup restoration
- Conduct vulnerability assessments
- Document findings, owners, due dates, accepted risks, and changes made
Manage third-party and cloud risk
Third-party involvement shows up in 48% of breaches in Verizon's 2026 DBIR, though that dataset is not adviser-specific.
Tier vendors by business impact. Start with the top 10 to 20. Tier 1 vendors need:
- A named security owner
- Defined contract duties
- Access controls and monitoring
- A tested incident-notice path Request a dependency map and continuity workaround for any vendor that could take you down.
Outsourcing does not transfer responsibility. Morgan Stanley Smith Barney paid $35 million after using a moving vendor with no data-destruction experience and failing to monitor the work. The adviser remains accountable for vendor failures.
When external cyber leadership may help
Firms without dedicated cyber leadership may benefit from a board advisor or interim or fractional CISO. The practical value shows up in:
- Clearer decision rights
- An inspectable governance model
- A roadmap with named owners
- Better communication among board, management, compliance, and technical teams Tyson Martin works in this advisory role, advising and validating rather than operating security or providing legal interpretation.
Incident Response, Records, and Examination Readiness
Prepare for competing notification requirements
Build a notification matrix. For each obligation, record the trigger, affected information, recipient, deadline, content, and permitted exceptions.
| Obligation | Clock |
|---|---|
| S-P individual notice | No later than 30 days after awareness |
| S-P provider notice to adviser | No later than 72 hours after provider awareness |
| FTC notice (covered institutions, 500+ consumers) | No later than 30 days after discovery |
| State breach laws, contracts, insurance | Varies; verify each |
S-P allows no notice if a reasonable investigation finds substantial harm is not reasonably likely, and the Attorney General can delay notice for national security or public safety.
Maintain defensible records
Organize the evidence now, not during an exam:
- Approved policy and management approvals
- Risk assessments and data inventories
- Training and access-review records
- Vendor reviews and contracts
- Test results, tabletop after-action reports, and restore logs
- Incident logs and remediation records
Records should prove implementation, not just show a template. Nothing should close without an owner and a next date.
Prepare for regulatory review
Examiners compare what you wrote with what you do: policies against tickets, logs, training records, contracts, and Form ADV statements. Gaps between stated and actual practice draw findings.
Enforcement history shows the pattern. In 2021, the Cetera entities described breaches as recent when they had known of them for at least six months, and the five respondents collectively owed $300,000. In 2022, UBS paid $925,000 over a deficient identity-theft program. Both involved written programs that did not match practice.
A Practical Implementation Checklist
Establish the current state
Start with:
- A registration and obligation inventory
- An information and system map
- A vendor list and access review
- A review of the existing policy and incident plan
- A gap assessment
Label each requirement as legally applicable, contractual, or risk-based. Many controls are recommendations, not mandated technology choices. Counsel should make that call.
Convert requirements into an executable plan
Group actions into:
- Near-term safeguards
- Governance fixes
- Documentation updates
- Testing
- Longer-term resilience
Give each action an owner and an evidence requirement. A 90-day plan with owners and measurable outcomes helps sequence the work. No timeline here is a regulatory deadline, except dates the applicable rule itself sets.
Create a recurring oversight dashboard
Keep it short and decision-ready:
- Risk trends and material exceptions
- Overdue remediation, especially high-risk items
- Tier 1 vendor count, dependencies, and renewals in the next 90 days
- Testing outcomes and incidents
- Decisions needed
Stable trend metrics beat technical trivia. If one vendor causes repeated incidents, that is a decision point for leadership. Pair the dashboard with advice from qualified securities counsel on legal questions.
Frequently Asked Questions
What should a cybersecurity policy include?
A cybersecurity policy should cover governance, risk assessment, administrative, technical, and physical safeguards, access control, vendor oversight, training, monitoring, incident response, recovery, testing, and recordkeeping.
Are RIAs regulated by the SEC?
Some are. Others are state-registered or exempt reporting advisers. Cybersecurity obligations depend on registration status, business activities, and applicable federal and state rules.
What cybersecurity regulations apply to investment advisers?
Potentially Rule 206(4)-7, Regulation S-P, Regulation S-ID, the FTC Safeguards Rule, NASAA model rules and state laws, breach-notification statutes, and contract terms. Confirm applicability for your firm.
Does every RIA need a written cybersecurity policy?
Written policies are commonly required or expected under adviser, state, privacy, and safeguards frameworks. Verify the exact obligation and scope for your registration and activities.
What is Regulation S-P for investment advisers?
It governs privacy, safeguards, disposal, and incident response for customer information. Confirm scope and compliance dates (December 3, 2025 and June 3, 2026) on SEC.gov.
How often should an investment adviser review its cybersecurity policy?
Review after material business, technology, vendor, regulatory, or incident changes, and on a recurring risk-based schedule. Rule 206(4)-7 requires annual review of compliance policies; anything beyond that is prudent practice.
