GLBA, the SEC, and Your Small Advisory: Which Cybersecurity Rules Actually Apply

If you run a registered investment adviser, an insurance agency, or a small wealth-management firm, you're under cybersecurity rules — the question is which ones, and the answer depends on how you're registered.

The good news for a small firm drowning in acronyms: the rules point at nearly the same control set, so one well-built program satisfies the regulator and the cyber-insurance carrier at once. This guide untangles which rules apply to you.

The GLBA Safeguards Rule (the broad one)

The Gramm-Leach-Bliley Act's Safeguards Rule (16 CFR Part 314) applies to a broad, deliberately non-bank set of "financial institutions."

The FTC's enumeration of covered businesses explicitly includes investment advisers that aren't required to register with the SEC — and the agency describes that list as examples, not an exhaustive set (FTC).

Insurance agencies, finance companies, and state-registered advisers commonly fall in.

If the Safeguards Rule applies, it requires a written information security program built on a risk assessment, a designated Qualified Individual, and specific safeguards:

• Access controls
• Encryption of customer information at rest and in transit
• Multi-factor authentication
• Logging

A breach-notification duty rides along: notify the FTC within 30 days of discovering a breach affecting at least 500 consumers (FTC).

SEC and FINRA (for registered firms)

SEC-registered advisers generally fall under SEC oversight rather than the FTC's Safeguards Rule, but the destination is similar.

In May 2024 the SEC amended Regulation S-P (SEC Press Release 2024-58) to require broker-dealers, registered investment advisers, investment companies, and transfer agents to adopt a written incident-response program and to notify affected individuals of certain breaches as soon as practicable and no later than 30 days after becoming aware.

Compliance was required by December 3, 2025 for larger firms and June 3, 2026 for smaller firms — so for most small advisers, it is in effect now.

Cybersecurity has also been a recurring SEC exam priority for years, and broker-dealers carry parallel FINRA expectations around protecting customer data and records.

The exact rule that governs you depends on your registration, and some of this area continues to evolve — so confirm your specific obligations with your compliance counsel.

But the controls don't really change between regimes: documented program, MFA, encryption, access control, monitoring, incident response, vendor oversight.

Why the overlap is good news

For a firm that handles client funds and account access, the cyber-insurance questionnaire reads almost exactly like a compliance file.

That's not a coincidence — both the regulator and the underwriter are pricing the same risks: account takeover, unauthorized transfers, and breach of client financial data.

That means you don't build three programs. You build one, mapped to the Safeguards elements (or the SEC's), and use the single evidence package to answer the examiner and the application. The priority controls for this vertical:

• MFA on everything — email, the custodian/portfolio systems, remote access. Account takeover is the precursor to client-fund fraud and unauthorized trades.
• Identity threat detection on the productivity tenant, watching for the takeovers that precede fraud.
• Funds-transfer verification — out-of-band confirmation and dual authorization on client withdrawals and bank-detail changes, the control that stops a social-engineered transfer.
• A documented WISP and incident-response plan, plus vendor oversight — the elements the Safeguards Rule and the SEC's S-P amendments both call for.

What to do next

Treat the compliance program and the cyber-insurance posture as one project — they're the same controls.

The Cyber Insurance Readiness Sprint maps your firm against the Safeguards (or SEC) control set and the cyber questionnaire in a fixed-scope, seven-business-day engagement, and produces the WISP, the risk assessment, and the evidence package that answers both an exam and an application.

See the Financial Services & Insurance Agencies security page for how the program runs.

The bottom line

If you're a non-SEC adviser or an insurance agency, the GLBA Safeguards Rule likely applies and requires a written program with MFA and encryption. If you're SEC-registered, the SEC's framework (including the 2024 Regulation S-P amendments) governs instead — but asks for the same controls.

Either way, build one program, document it once, and it answers the regulator and the carrier together. Confirm the precise rule with your compliance counsel; get the controls right regardless.

If you run a solo or two-person practice, cybersecurity for a small investment adviser goes deeper on Regulation S-P's incident response and 30-day notice duties, Regulation S-ID's covered-account test, and what a New York insurance licensee still owes under a limited exemption.

Want to know whether your firm's security would survive an exam — or an underwriter? Book a financial-services readiness assessment.