Regulation S-P is in force. Is your system?
The SEC's amendments to Regulation S-P took effect on August 2, 2024. Advisers below $1.5 billion in assets under management are the smaller entity group under the amended rule, and their compliance date was June 3, 2026. Since that date, a written incident response program, breach notice from vendors within 72 hours, and customer notice within 30 days have been the standing requirements, not a project with a deadline ahead of it.
We verify what's true, fix what's broken, and protect what you built.
Every finding sourced. Every result signed by a person. Delivered in 24 to 72 hours.
What amended Regulation S-P requires
Stated as the SEC states it, in its Small Entity Compliance Guide and in the rule text at 17 CFR 248.30. What the rule means for your firm is a decision for your own compliance lead and counsel.
A written incident response program
Amended Regulation S-P requires covered institutions, including investment advisers registered with the SEC, to develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The program includes procedures to assess the nature and scope of an incident and to contain and control it.
Oversight of service providers, with notice inside 72 hours
The response program must include written policies and procedures reasonably designed to require oversight of service providers, including through due diligence and monitoring. Those procedures must be reasonably designed to ensure service providers take appropriate measures to protect against unauthorized access to or use of customer information, and to provide notification to your firm as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
Notice to affected individuals within 30 days
When unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, notice to each affected individual is due as soon as practicable, but not later than 30 days after your firm becomes aware of it. The rule carries a narrow exception: after a reasonable investigation, if your firm determines the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, notice is not required. That determination is your compliance lead's to make.
The Division of Examinations' fiscal year 2027 priorities say examinations will focus on whether firms have developed, implemented, and maintained reasonably designed policies and procedures that address administrative, technical, and physical safeguards to protect customer information, as required by Regulation S-P, and that staff will evaluate response program policies and procedures, including customer notification procedures and oversight of service providers. The priorities are a staff statement; they create no new obligations. They do say what examination staff will be looking at.
The systems work behind the policy
Your compliance consultant writes the policy. We fix the systems the policy describes and keep the record current, so the binder and the network say the same thing.
01
We map your systems and vendors
Every system that holds customer information, and every service provider that can reach it, listed in one record. The map is the starting point your incident response program and your vendor oversight both stand on.
02
We fix what is broken
Gaps the map exposes are fixed, not flagged for your team to chase. Where a fix belongs to your IT provider or a vendor, we work with them, not around them, and the record shows who did what.
03
Your compliance lead gets a signed record
Every finding names its source. Every result is signed by a person. The record goes to the person who decides at your firm, in 24 to 72 hours, so the binder and the systems say the same thing.
Already have an IT provider? Then we are the second set of eyes your IT provider is measured by. We verify what is in place, fix what is not, and sign the record either way.
What we never do
Your CCO decides. We never give legal advice, and nothing we deliver is a legal or compliance opinion.
We never scan a system without your written permission, on a signed permission form naming the domains and repositories in scope.
We make no promise about any examination, audit, or regulatory outcome. We say what we check, what we fix, and what we deliver, and we name our sources.
Your firm's information stays with your firm. Client names, client records, and firm records are never published and never sent to anyone else.
Our promise, as our Terms carry it
"For clients who are registered investment advisers, if we learn of a breach of your information in our systems, we will notify you within 72 hours."
The same sentence stands in section 16 of our Terms, where it governs every adviser engagement.
Start with Cleanup. Stay protected with Full Protection.
Cleanup is the door built for this market: the full check, then the fixes. Full Protection keeps the watch running after it. Verify is the entry door when you want the check on its own first. Every price counts toward the next step.
Start Here
Cleanup
Everything in Verify, plus the systems work: your systems and vendors mapped, what is broken fixed, and the signed record your compliance lead can file.
- Systems and vendors mapped
- Fixes made, not flagged
- Signed record, every source named
- Back in 24 to 72 hours
Then
Full Protection
Everything in Cleanup, plus the standing watch: weekly checks, new threats measured against your systems, and a monthly report with the proof, so the record stays current between examinations.
- Weekly protection checks, fixes made
- Monthly report against your targets
- Includes your first 3 months of weekly protection, investor visibility and the Market Brief
- Back in 24 to 72 hours
The Entry Door
Verify
The check on its own: your firm and your public record verified against the primary sources, every finding named and sourced, signed by a person. Includes your first month of Investor Visibility.
- Claims checked, sources named
- Signed by a person
- Every price counts toward the next step
- Back in 24 to 72 hours
Systems Work
- Systems Review · $2,500
- Fix and Protect · from $2,500
- Keep It Running · $495 a month
Systems engagements start through the inquiry form, so the scope is set in writing before any work begins. A scan runs only with your signed permission.
Free Check
Vendor File Check
Answer ten questions about your vendor file and see the state of the file. Your answers stay in your browser.
One form. No sales call needed.
Send the inquiry form and tell us your firm and what your compliance lead needs in hand. We answer by email, and the work starts in writing.
You can also reach us by email at hello@anaconnectsyou.com.
Sources for the regulatory statements on this page: SEC, Enhancements to Regulation S-P, A Small Entity Compliance Guide; Regulation S-P rule text, 17 CFR 248.30; SEC, Regulation S-P adopting release, 89 FR 47688 (June 3, 2024), Section II.F and Table 3; SEC Division of Examinations, Fiscal Year 2027 Examination Priorities, Section VII.A. Each source was read on November 7, 2026.