# Security for financial advisors and insurance brokers > Registered investment advisers must keep written safeguards and an incident response program under Regulation S-P, while state-registered advisers and many agencies fall under the FTC Safeguards Rule or state insurance data security laws. CyberAccord helps these firms write the program, protect client accounts and email, test defenses, and oversee vendors. Source: https://www.cyberaccord.com/industries/financial-services ยท Last reviewed: 2026-10-22 Regulation S-P, the FTC Safeguards Rule and state insurance data security laws all expect a written security program, an incident response plan and oversight of your vendors. We help firms build those and keep them working. ## Key facts - **SEC advisers:** Regulation S-P, amended 2024 - **Other advisers:** FTC Safeguards Rule, 16 CFR Part 314 - **Insurance:** State laws based on the NAIC model - **Common thread:** Written program, response plan, vendor oversight ## The obligations and risks you face ### Regulation S-P now requires an incident response program The 2024 amendments require covered institutions, including SEC-registered advisers, to keep written policies that detect, respond to and recover from unauthorized access to customer information. Affected customers must be notified as soon as practicable and no later than 30 days after the firm becomes aware of an incident, unless a reasonable investigation shows the information is not reasonably likely to be used to cause substantial harm or inconvenience. The compliance dates for both larger and smaller firms have now passed. Source: [17 CFR 248.30 (Regulation S-P)](https://www.ecfr.gov/current/title-17/chapter-II/part-248/subpart-A/subject-group-ECFR83262a0bce5ffaa/section-248.30) ### Your vendors must report to you quickly Regulation S-P also requires oversight of service providers, including written procedures to ensure a provider notifies you no later than 72 hours after it becomes aware of a breach affecting a customer information system it maintains. Custodians, CRMs, planning software and IT providers all belong in that review. Source: [17 CFR 248.30(a)(5), Service providers](https://www.ecfr.gov/current/title-17/chapter-II/part-248/subpart-A/subject-group-ECFR83262a0bce5ffaa/section-248.30) ### Advisers outside the SEC fall under the FTC The FTC Safeguards Rule names investment advisory companies as financial institutions. State-registered advisers it covers need a Qualified Individual, a written risk assessment, multi-factor authentication, encryption of customer information, and notice to the FTC of qualifying breaches. Source: [16 CFR Part 314 (FTC Safeguards Rule)](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314) ### Insurance licensees answer to state data security laws The NAIC Insurance Data Security Model Law requires licensees to run an information security program based on a risk assessment, oversee third-party service providers, and notify the commissioner no later than 72 hours after determining that a qualifying cybersecurity event occurred. States that adopted it often changed details, so the version in your state governs. Source: [NAIC Insurance Data Security Model Law (#668)](https://content.naic.org/sites/default/files/model-law-668.pdf) ## What we recommend - [Managed Security](https://www.cyberaccord.com/services/managed-security) - [vCISO](https://www.cyberaccord.com/services/advisory/vciso) - [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing) ## Applicable frameworks - [NYDFS 500](https://www.cyberaccord.com/compliance/nydfs-500) - [SOC 2](https://www.cyberaccord.com/compliance/soc-2) - [NIST](https://www.cyberaccord.com/compliance/nist) ## Frequently asked questions ### We are a small RIA. Does Regulation S-P really apply to us? Yes, if you are registered with the SEC. The amended rule applies to registered investment advisers of every size; smaller firms simply had a later compliance date. You need written safeguards, an incident response program, customer notification procedures and service provider oversight. ### We are a state-registered adviser. Which rule applies? Regulation S-P covers SEC registrants. State-registered advisers are generally covered by the FTC Safeguards Rule instead, plus any rules your state securities regulator sets. The two rules ask for similar things: a written program, risk assessment, access controls and incident response. ### Does NYDFS Part 500 apply to insurance brokers? It applies to agencies and brokers licensed by the New York Department of Financial Services, unless an exemption fits. Part 500 is more prescriptive than most state laws, so firms with a New York license should check their status before each annual compliance filing. ### What does an examiner or carrier usually ask to see? Written policies, a recent risk assessment, evidence of multi-factor authentication and staff training, an incident response plan that has been exercised, and records of vendor due diligence. We help you assemble those so they are ready before the request arrives. ### How do we protect clients from wire and account takeover fraud? Combine technical controls with procedure: multi-factor authentication on email and custodian portals, managed email protection, and a rule that any change to payment instructions is confirmed by phone using a number already on file. ## Contact CyberAccord - Book a free consultation: https://www.cyberaccord.com/contact - Phone: +1 (832) 429-5665 - Email: info@cyberaccord.com