Cybersecurity for small RIAs and financial firms.

SEC-registered investment advisers

Security controls and Regulation S-P

At Obsidian Ridge, we help small registered investment advisers meet SEC Regulation S-P security requirements with managed monitoring, client-data controls and documented evidence. We support your firm's compliance program; your firm remains responsible for legal decisions and customer notices.

Read our guide to security requirements for small registered investment advisers for the differences between SEC and state registration.

The SEC adopted the amendments in May 2024. They cover SEC-registered investment advisers, broker-dealers, investment companies, funding portals and transfer agents. Exempt reporting advisers are outside the investment-adviser scope.

For SEC-registered advisers, the compliance date was December 3, 2025 for firms with at least 1.5 billion dollars in assets under management, and June 3, 2026 for smaller firms. Both dates have passed. A small covered adviser needs the program in place now.

What your firm must have

• A written incident response program to detect, respond to and recover from unauthorized access to or use of customer information.
• Notice to affected individuals as soon as practicable and no later than 30 days after the firm becomes aware that an incident involving unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The notice covers sensitive customer information that was, or was reasonably likely to have been, accessed or used. A reasonable investigation can support an exception when the firm determines that the information has not been, and is not reasonably likely to be, used in a way that causes substantial harm or inconvenience.
• Service-provider oversight designed to reasonably ensure that a provider notifies the firm as soon as possible, and no later than 72 hours after becoming aware of unauthorized access to a customer information system it maintains. This is a regulatory oversight requirement, not a notification-time promise from Obsidian Ridge.
• Written records documenting compliance with the rule.

How our services support those requirements

• Safeguarding client information: Island Enterprise Browser lets us control downloads, copy and paste, printing and supported screen capture from work apps. It can block a file from reaching the local computer and log activity in custodian portals and other web apps. We confirm the apps, devices and policy settings in scope. See the vendor's data controls and activity logging.
• Detecting and responding: Managed detection and response watches computers, and identity threat detection and response watches supported work accounts. Huntress's analysts monitor and act around the clock. These controls support the incident response program; they do not replace the written plan or recovery arrangements.
• Keeping evidence: reports and documentation delivered under your agreed service scope support recordkeeping. The Readiness Sprint provides an evidence pack mapped to your insurer's questionnaire.
• Reviewing providers: our security documentation for your service-provider file supports your review of our role. Your firm still evaluates its providers and documents the required oversight and notification arrangements.

Sources: SEC adoption announcement, 2024 Regulation S-P final rule, and SEC small-entity compliance guide.

This is a general summary for educational purposes, not legal advice. Requirements depend on your specific circumstances and may change. Consult qualified counsel and the official SEC guidance.

One adviser is enough

Monthly coverage for a solo advisory firm

At Obsidian Ridge, we offer Ridge Core to a solo wealth management firm for $25 per person per month, month to month with no minimum. One person is fine: the plan includes managed detection and response for computers and identity threat detection for work accounts.

Our standalone Island Enterprise Browser service is $18 per user per month, month to month with no minimum number of users. One user is fine. We deploy and manage the browser; add-ons are priced separately.

Business setup is separate. Ridge Plus and Ridge Reserve are annual terms, billed monthly. The written incident response plan and annual ransomware exercise are part of Ridge Reserve, not the entry plan. See current pricing and scope.

Our financial-adviser service page explains the scope for a solo wealth management firm and how we work with its IT and compliance providers.

Custodian portals and web apps

Browser controls for custodian portals

For a small advisory firm that wants us to manage browser policies without a user minimum, we recommend Island Enterprise Browser. It lets us control how client information leaves approved work apps, including blocking downloads to the local computer.

We resell and manage the browser. The right choice depends on your custodian portals, devices, existing security tools and the controls your firm needs. A browser does not replace computer monitoring, a written response plan or your compliance program.

Compare Island Enterprise Browser, SURF Security and Prisma Access Browser for buying terms, data controls and the situations each product fits.

State-registered advisers

Not SEC-registered yet?

State-registered advisers generally fall under the FTC Safeguards Rule and their state regulator's rules instead of Regulation S-P. If your firm is heading toward SEC registration, build the Regulation S-P program before the switch.

We can help document your current controls and the gaps to address. Confirm your firm's registration, activities and applicable requirements with qualified counsel.

Source: FTC Safeguards Rule business guidance. This is a general summary for educational purposes, not legal advice.

The exposure

What underwriters and attackers actually look at

A stolen email account, a redirected wire or a client statement saved to a personal computer can expose client information. We help you strengthen account access, monitor computers and sign-ins, and document how payment changes are verified through a separate, trusted channel.

Applicable framework: SEC Regulation S-P for SEC-registered advisers; FTC Safeguards and state rules for state-registered advisers, as applicable.