Regulation S-P compliance software for RIAs and broker-dealers that need the incident response program and vendor oversight on record

Regulation S-P compliance software helps an SEC-registered adviser, broker-dealer, investment company or transfer agent run the safeguards program required by 17 CFR 248.30. It keeps the incident response program, the customer notification procedure, service provider oversight and the required records in one dated place with owners, so the firm can show an examiner the program is real.

Broker-dealers, funding portals, investment companies, SEC-registered investment advisers and transfer agents registered with the SEC or another appropriate regulatory agency. State-registered advisers are not covered by the federal rule, although their state may impose similar safeguarding and breach notice duties.

By June 3, 2026. Larger entities, which for advisers means $1.5 billion or more in assets under management, had to comply by December 3, 2025. Industry groups asked the SEC for a six-month extension and it was not granted, so the amended rule now applies to every covered firm.

Written policies and procedures reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. They must cover assessing the nature and scope of the incident, containing and controlling it, and notifying affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

As soon as practicable, but no later than 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The notice describes the incident, the type of information involved, the date, how to contact the firm and steps to protect against identity theft. The Attorney General can request a delay for national security or public safety.

Written policies for oversight, including due diligence and monitoring, of service providers, reasonably designed to ensure each provider protects against unauthorized access to customer information and notifies you as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains.

Yes. A covered firm may enter into a written agreement under which its service provider notifies affected individuals on its behalf. The firm still owns the obligation, so the agreement, the provider's procedure and proof that notices went out on time all belong in your records.

Written records of the safeguards and disposal policies, each detected incident of unauthorized access and the response, any investigation that concluded notice was not required, the service provider oversight policies and the written agreements with providers. Registered advisers keep them for five years under their books and records rule; broker-dealers and funds follow their own retention periods.

Complies publishes $47, $119 and $299 a month billed yearly, and the Regulation S-P library is on every paid plan, with vendor due diligence from $119. Comply (formerly RIA in a Box), Smartria, Ncontracts and Venminder did not publish software prices on their own sites when we checked in October 2026.

Only if your gap is the safeguards program. Complies covers Regulation S-P, the risk register, vendor oversight, policies and dated evidence. It does not run code of ethics attestations, personal trading surveillance, marketing review or communications archiving, so firms that need those keep a suite or archiving vendor and use Complies for the cybersecurity and vendor side.