Cybersecurity for a small investment adviser: Reg S-P, Reg S-ID and state exams

A one-adviser firm answers to the same cybersecurity rules as a hundred-adviser firm, with a shorter list of exemptions than most people expect. This guide sets out which rules reach a solo or two-person advisory practice, what each one asks for in writing, and the five controls worth finishing this quarter.

Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. That is our offer. The rules below apply to your firm whether or not you ever buy anything from us.

Who regulates you

Your registration decides your rulebook, and there are only two answers. An adviser registered with the Securities and Exchange Commission answers to the Commission. An adviser registered with one or more states answers to those state securities regulators.

If you are registered with the Commission, two rules carry the cybersecurity obligations: Regulation S-P at 17 CFR Part 248, which covers safeguarding and disposal of customer information and now breach notification, and Regulation S-ID at 17 CFR 248.201, the identity theft red flags rule. The Commission's 2024 amendments to Regulation S-P apply to "broker-dealers (including funding portals), investment companies, registered investment advisers, and transfer agents," which the Commission calls covered institutions (SEC fact sheet).

If you are registered with a state, Regulation S-P does not reach you, because you are not a Commission registrant. Two things fill the gap. Your state securities regulator sets its own requirements, and many states have adopted or adapted the information security model rule package that the North American Securities Administrators Association adopted for investment advisers, which requires advisers to adopt policies and procedures on information security and to deliver their privacy policy (NASAA). Separately, the Federal Trade Commission's Safeguards Rule at 16 CFR Part 314 lists "investment advisors that aren't required to register with the SEC" among the thirteen examples of financial institutions it covers (FTC guidance).

One footnote matters for very small firms. Section 314.6 says that sections 314.4(b)(1), (d)(2), (h) and (i) "do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers" (16 CFR 314.6). Those four are the written risk assessment, continuous monitoring or annual penetration testing with semi-annual vulnerability assessments, the written incident response plan, and the annual report to the governing body. Four provisions come off. The rule does not, and neither does the written information security program itself.

What changed in Regulation S-P

The 2024 amendments added a breach-notification duty and an incident response program to a rule that had only asked for safeguards. The Commission adopted them on 16 May 2024, and they became effective on 2 August 2024.

Four requirements are worth reading closely:

• An incident response program, in writing. It must be reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information, and must include procedures to assess the nature and scope of an incident and to contain and control it.
• Service-provider oversight, in writing. The program must include written policies and procedures requiring oversight of service providers, through due diligence and monitoring, and designed to ensure a service provider notifies the firm as soon as possible and no later than 72 hours after becoming aware of a breach involving customer information.
• Customer notice within 30 days. The firm must give notice "as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred." Notice is not required if, after a reasonable investigation, the firm determines the sensitive customer information has not been and is not reasonably likely to be used in a manner resulting in substantial harm or inconvenience.
• Records of compliance. Covered institutions other than funding portals must make and keep written records documenting compliance with the safeguards rule and the disposal rule.

The compliance dates have both passed. Larger entities had to comply by 3 December 2025 and smaller entities by 3 June 2026 (SEC small entity compliance guide). For an investment adviser, larger means $1.5 billion or more in assets under management and smaller means everything below that, so a solo firm was in the second group and is now past its date (adopting release 34-100155).

Read that as a present-tense obligation. If you are Commission-registered and the incident response program is not written down, the gap is live today, not pending.

Regulation S-ID, the rule people forget

Regulation S-ID applies only if your firm offers or maintains covered accounts, and deciding that is itself a requirement. The rule obliges registered broker-dealers and investment advisers to periodically determine whether they offer or maintain covered accounts, and then, if they do, to develop and implement a written identity theft prevention program designed to detect, prevent and mitigate identity theft.

A covered account is one the firm offers or maintains primarily for personal, family or household purposes that involves or permits multiple payments or transactions, plus any other account with a reasonably foreseeable identity-theft risk to clients or to the firm. The Commission's examinations staff has said this reaches "some registered investment advisers (e.g., registered investment advisers who can direct transfers or payments from individual accounts to third parties based on the individual's instructions or who act as agents on behalf of individuals)" (SEC Risk Alert).

If you can move money out of a client account on the client's instruction, work through that definition carefully with your compliance counsel. The program has to identify the red flags that are actually relevant to your accounts, detect them, respond to them and be updated as risks change. The staff's most common finding was firms that listed the examples from Appendix A of the rule regardless of whether those flags had anything to do with the firm's own accounts, and firms that never carried out the periodic covered-account assessment at all.

New York advisers who also hold an insurance license

New York's cybersecurity regulation, 23 NYCRR Part 500, follows the license, not the advisory registration. It applies to entities "operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization" under New York's Banking, Insurance or Financial Services Laws. An adviser is not a Department of Financial Services licensee by virtue of being an adviser. An adviser who also holds a New York insurance license usually is.

Most small firms qualify for the limited exemption in section 500.19(a), which applies to a covered entity with any one of: fewer than 20 employees and independent contractors including affiliates; less than $7,500,000 in gross annual revenue in each of the last three fiscal years; or less than $15,000,000 in year-end total assets.

The limited exemption removes a lot, and a licensee still has to do all of this (DFS small business resources):

• Maintain a cybersecurity program (section 500.2) and written cybersecurity policies (section 500.3).
• Limit access privileges (section 500.7(a)) and, if passwords are used, keep a written password policy that meets or exceeds industry standards (section 500.7(b)).
• Conduct risk assessments (section 500.9).
• Implement third-party service provider policies and procedures (section 500.11).
• Use multi-factor authentication where the rule requires it (section 500.12).
• Maintain an asset inventory and limit data retention (section 500.13).
• Provide cybersecurity awareness training, including social engineering, for all personnel at least annually (section 500.14(a)(3)).
• Notify the Department: the annual compliance notification by 15 April, a cybersecurity incident no later than 72 hours after determining it occurred, and an extortion payment within 24 hours of making it (section 500.17).
• File a Notice of Exemption. A limited exemption under 500.19(a) does not need resubmitting every year, but the exemptions you rely on must be stated on your annual compliance notification.

The annual filing is a Certification of Material Compliance if you were materially compliant, and an Acknowledgment of Noncompliance if you were not. The second one is a real option with a remediation timeline attached, which is better than a certification you cannot support.

This section applies to New York licensees. If you are licensed in another state, check that state's own rule rather than assuming this one travels.

Why the browser is the control point for a one-adviser firm

A one-adviser firm has no server, no file room and almost no software installed locally, so nearly every piece of client data passes through a browser tab. The custodian portal, the customer relationship management system, planning software, e-signature, email, the state and federal filing portals and, if you hold an insurance license, the carrier portals: all of them are websites.

That makes the exposure concrete rather than theoretical, and it comes down to two actions. The first is a download to a personal computer, which is how a client list or a statement leaves the firm's control and lands in a folder no policy covers. The second is a paste into a personal AI chat, which is the same event with no file to find afterwards.

Neither is a malware problem, so neither is something endpoint protection decides. Both are decisions about what a work app is allowed to do, which is why the browser is the place to make them.

Obsidian Ridge deploys and manages the Island Enterprise Browser for firms of any size, including a one-person firm, at $18 per user per month, month to month with no minimum number of users, with zero-configuration initial onboarding and CISSP-led support for businesses in the Research Triangle and anywhere in the United States. Managed browser policies give your business control over work-app access and how client data is copied, downloaded, uploaded or printed. For each work app, a download, a copy and paste, an upload, a print or a screen capture can be allowed, watermarked or blocked. See the managed browser for the terms and what is included.

What to do this quarter

Five controls a solo adviser can finish without staff, in this order:

1. Write the incident response program. Who you call, how you assess scope, how you contain, and how you decide whether the 30-day client notice is required. A short document that matches your firm beats a long one that describes someone else's.
2. Turn on multi-factor authentication everywhere, then prove it. Email, the custodian portal, the CRM, the planning tool and every administrator account. Export the coverage report from your identity provider and keep it; that export is the evidence an examiner and an underwriter both ask for.
3. Do the covered-account determination in writing. One page recording whether you offer or maintain covered accounts, how you decided, and the date. If the answer is yes, the identity theft prevention program follows.
4. List your service providers and get their breach-notice commitment in writing. Custodian, CRM, planning software, email, document storage, the IT person. Regulation S-P now wants oversight and a 72-hour notice from them, so this is a contract question, not only a technical one.
5. Decide what each work app may do with client data. Downloads, copy and paste, uploads, printing and screen capture, app by app. This is the control that closes the gap the other four leave open.

The Readiness Sprint costs $1,500 to $3,500 once for a 7-business-day engagement. The deliverable is the same at each scope: a signed evidence pack and a record of controls and gaps. The Readiness Sprint organizes agreed control evidence and gaps; it does not transfer your firm's legal responsibility or substitute for compliance counsel. If a renewal is coming, start with free help on the carrier's questionnaire or the questionnaire worksheet. The financial services programme describes what we operate, and GLBA, the SEC, and your small advisory covers the Safeguards Rule side in more detail.

Nothing here is legal advice. Which rules reach your firm depends on your registrations, your licenses and the accounts you maintain, and that determination belongs to you and your compliance counsel.

Sources

Fetched 13 October 2026.

• SEC press release 2024-58: adoption, covered institutions, the 30-day notice.
• SEC fact sheet, Enhancements to Regulation S-P: incident response program, service-provider oversight, records.
• SEC small entity compliance guide: scope of customer and sensitive customer information, the 72-hour service-provider notice, compliance dates of 3 December 2025 and 3 June 2026.
• SEC adopting release 34-100155: the rule text and the $1.5 billion adviser threshold separating larger from smaller entities.
• SEC Risk Alert on Regulation S-ID: covered accounts, which advisers are reached, the most frequent findings.
• FTC Safeguards Rule guidance: advisers not required to register with the SEC.
• 16 CFR 314.6: the fewer-than-5,000-consumer exception and exactly which four provisions it removes.
• NASAA information security model rule package: the state-level information security and privacy requirements.
• NY DFS individual and small business resources: the 500.19(a) thresholds and the sections a limited-exemption licensee must still satisfy.