What Are the SEC Cybersecurity Disclosure and Risk Management Requirements?
By Mick Grayson, Abacus · Published October 29, 2026 · Updated October 29, 2026
Short answer: The SEC has two cybersecurity regimes in force. Public companies must disclose material cybersecurity incidents on Form 8-K Item 1.05, generally within four business days of determining materiality, and describe their risk management and board oversight annually under Regulation S-K Item 106. Separately, Regulation S-P requires broker-dealers, registered investment advisers, funds, and transfer agents to maintain a written incident response program and notify affected individuals within 30 days.
Firms routinely apply the wrong rule to themselves, and the reason is structural. Most registered investment advisers are not public companies, so the 2023 disclosure rules that drew the most attention do not apply to them. The rule that does apply to most advisers is Regulation S-P. A third rule, proposed for advisers in 2022, was withdrawn in 2025 without ever taking effect.
What is the SEC cybersecurity rule?
There is no single SEC cybersecurity rule. Three separate rulemakings are commonly grouped under that name, and only two of them are currently enforced. The public company disclosure rules were adopted in July 2023. The Reg S-P amendments were adopted in May 2024, with a June 2026 compliance deadline for all covered entities. The proposed cybersecurity risk management rule (CRMA) for investment advisers and funds was withdrawn in June 2025.
Which one applies depends on the entity. A public operating company files under the 2023 disclosure rules. A registered investment adviser, broker-dealer, registered investment company, funding portal, or transfer agent falls under the Reg S-P amendments. A publicly traded asset manager can fall under both.
Sorting this out first matters, because compliance programs built against the withdrawn proposal contain requirements that are no longer coming, while Reg S-P carries deadlines that have already passed.
What do the SEC’s public company cybersecurity disclosure rules require?
The SEC’s public company rules, adopted July 26, 2023, require two things: prompt disclosure of material cybersecurity incidents and annual disclosure of cybersecurity risk management and governance. Both apply to registrants that file periodic reports, not to private advisers or private funds.
Under Form 8-K Item 1.05, a registrant must describe the material aspects of an incident’s nature, scope, and timing, along with its material impact or reasonably likely material impact. The filing is generally due four business days after the registrant determines that the incident is material. This is an important distinction, as a filing is not due four business days after discovery of an incident. The Attorney General may delay disclosure where it poses a substantial risk to national security or public safety.
Under Regulation S-K Item 106, a registrant must describe annually in its Form 10-K its processes for assessing, identifying, and managing material cybersecurity risks, the material effects of those risks, board oversight of cybersecurity risk, and management’s role and relevant expertise.
Compliance for the annual disclosures began with fiscal years ending on or after December 15, 2023. Compliance for Form 8-K incident disclosure began December 18, 2023, with smaller reporting companies receiving an additional 180 days.
What does Regulation S-P require of advisers and broker-dealers?
The SEC’s Reg S-P amendments, adopted in May 2024, require covered institutions to maintain a written incident response program, notify affected individuals of a breach involving sensitive customer information as soon as practicable and no later than 30 days, obtain assurances that service providers will notify the firm within 72 hours of a breach, and keep records of compliance.
Covered institutions are broker-dealers, funding portals, registered investment companies, SEC-registered investment advisers, and certain transfer agents. Compliance began December 3, 2025 for larger entities and June 3, 2026 for smaller entities.
An entity is “larger” if it is a registered investment adviser with more than $1.5 billion in assets under management, an investment company with more than $1 billion in assets, or, for most broker-dealers, a firm with capital exceeding $500,000. Every other covered institution is a smaller entity, and both deadlines have now passed.
One point is worth stating plainly, because it is often misread. The written information security program belongs to the firm, not to its IT provider. A WISP has to be specific to the firm’s own business, systems, and risk profile; a generic template supplied by a managed service provider would not satisfy an examiner. An MSP can provide WISP development services and support the program’s implementation, and Abacus does, but owning the program is not a function a firm can hand over.
The 72-hour service provider clause is the one that reaches an IT provider directly. A firm must have written policies requiring its service providers to notify it of a breach within 72 hours of becoming aware, which means the contract with an IT provider, cloud vendor, or fund administrator has to say so.
What happened to the proposed SEC cybersecurity risk management rule for advisers?
The SEC formally withdrew the proposed cybersecurity risk management rule for investment advisers, registered investment companies, and business development companies on June 17, 2025. In its withdrawal notice, the Commission stated that it “does not intend to issue final rules with respect to these proposals.”
The withdrawn proposal, originally published in July 2022, would have required advisers and funds to adopt written cybersecurity policies, report significant incidents to the Commission on a new Form ADV-C, and disclose cybersecurity risks and incidents to clients. None of those obligations took effect.
The withdrawal does not lower the bar as much as it may appear. Reg S-P now covers incident response and customer notification; the Advisers Act compliance rule at 206(4)-7 still requires policies reasonably designed to prevent violations, and SEC examinations have consistently reviewed cybersecurity programs. A firm that built a program against the cybersecurity risk management rule proposal has not wasted the work, as there is clear overlap with today’s standards.
The SEC indicated that if it revisits this area, it will issue a new proposal rather than finalize the withdrawn one.
How do SEC cybersecurity requirements affect your IT provider?
SEC cybersecurity requirements translate into specific operational obligations that a firm’s IT provider usually delivers, even though the financial firm itself remains the entity accountable to the Commission. The detection, logging, notification timing, and evidence retention that the rules assume are all technology functions that sit with the provider.
| SEC requirement | Source | What an IT provider should deliver |
|---|---|---|
| Written incident response program, designed to the specific needs of the firm | Regulation S-P (2024) | Custom WISP development, documented plan, defined escalation path, annual tabletop testing |
| Detect unauthorized access to customer information | Regulation S-P (2024) | 24×7 monitoring, centralized logging, alerting on privileged activity |
| Notify affected individuals within 30 days | Regulation S-P (2024) | Mature processes and procedures to ensure timely identification and notification capabilities |
| Service provider notification within 72 hours | Regulation S-P (2024) | Contractual commitment in the service agreement, with a named escalation contact |
| Recordkeeping of compliance | Regulation S-P (2024) | Retained logs, incident records, policy versions, and test results |
| Materiality determination without unreasonable delay | Form 8-K Item 1.05 (2023) | Incident severity classification and impact analysis delivered fast enough to support the decision |
| Annual risk management and governance disclosure | Regulation S-K Item 106 (2023) | Documented risk assessment, control inventory, and board-level reporting |
The 30-day notification clock is the requirement that most often exposes a weak technology environment. Determining which customers’ sensitive information was accessed requires logs that exist, are retained, and can be searched. Technology decisions must be made in advance, long before an incident happens, in order to ensure a firm is able to meet these requirements.
How is SEC cybersecurity compliance different from SOC 2?
SEC cybersecurity requirements are regulatory obligations enforced by the Commission, and a firm must meet them whether or not any vendor is examined. SOC 2 is a voluntary attestation performed by a licensed CPA firm against the AICPA Trust Services Criteria. Neither substitutes for the other, though the underlying controls overlap substantially.
A firm cannot satisfy Reg S-P by holding a vendor’s SOC 2 report. Reg S-P requires the firm itself to maintain a written incident response program, notify individuals, and keep records. A vendor’s SOC 2 Type II report is evidence supporting the firm’s vendor oversight, which is one component of a much larger obligation.
The reverse is also true. A firm with a documented Reg S-P program has not been independently examined. SOC 2 adds the outside opinion; the regulation adds the legal obligation.
Most firms end up using both: the regulation defines what must exist, and vendor SOC 2 reports supply the evidence that third parties handling firm data operate controls.
What do firms get wrong about SEC cybersecurity requirements?
The most common error is building a compliance program against the wrong rule. Firms that prepared for the withdrawn adviser proposal sometimes carry forward requirements that never took effect, such as Form ADV-C reporting, while missing the Reg S-P service provider clause that is now enforceable.
Four other mistakes appear regularly at registered investment advisers and broker-dealers:
Misreading the 8-K clock. The four-business-day period runs from the materiality determination, not from discovery. A firm cannot delay the determination unreasonably, but the two dates are distinct and are documented separately.
Leaving service provider contracts unamended. Reg S-P requires written policies reasonably designed to require service providers to notify the firm within 72 hours. Existing vendor agreements rarely say that without amendment.
Assuming a Reg S-P deadline is still ahead. The larger-entity compliance date was December 3, 2025 and the smaller-entity date was June 3, 2026. Both have passed.
Treating incident response as a document. An untested plan fails during the event. Tabletop testing is what makes a 30-day notification window achievable.
The financial exposure justifies the work. IBM’s Cost of a Data Breach Report 2026 put the average financial services breach cost at $6.29 million, up 13% year over year, and Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches involved a third party, a 60% increase over the prior year.
About Abacus
Abacus is a managed IT and cybersecurity provider serving financial services firms and healthcare organizations globally since 2004, with 24×7 monitoring and help desk coverage. With in-house incident response specialists, a cyber R&D team, and a deep bench of GRC experts, Abacus supports more than 1,200 clients and 100,000 users globally, holding SOC 2 Type II attestation and CREST accreditation, with infrastructure and processes designed to support HIPAA and HITRUST compliance requirements.
Frequently asked questions
Regulation S-P as amended applies to SEC-registered investment advisers, broker-dealers, funding portals, registered investment companies, and certain transfer agents. A state-registered adviser is not covered by the amended SEC rule, but state privacy and safeguards laws generally impose parallel obligations, and many states model their requirements on the federal standard. State-registered advisers should confirm their obligations with counsel in each state where they are registered.
Regulation S-P ties notification to sensitive customer information, which broadly covers information that could create a substantial risk of harm or inconvenience if accessed without authorization, such as account numbers paired with identifiers, government identification numbers, and credentials. The practical implication is that a firm must be able to determine which records were affected within the 30-day window, which depends on logging and data inventory.
A private fund adviser registered with the SEC is a covered institution under the amended Regulation S-P and must meet its incident response, notification, service provider, and recordkeeping requirements. The 2023 public company disclosure rules apply to registrants filing periodic reports, which most private funds are not. The withdrawn 2022 proposal would have added fund-specific obligations, but it was withdrawn in June 2025.
No. The SEC does not mandate NIST, ISO 27001, or any named framework. Regulation S-P requires policies and procedures reasonably designed to meet stated outcomes, which leaves framework selection to the firm. Most firms adopt the NIST Cybersecurity Framework or CIS Controls because examiners are familiar with them and because mapping controls to a recognized framework makes examination responses faster.
Next step
Schedule time with our team to discuss your current cybersecurity maturity and existing compliance readiness against regulatory standards and to learn more about how working with Abacus can support your firm.
