SEC · Final rule · Example
Regulation S-P: incident response and customer notification
The SEC amended Regulation S-P in May 2024. Advisers need written incident response procedures and must notify affected clients within 30 days of learning their sensitive information was accessed without authorization.
Smaller firms had to comply by June 3, 2026.
Quill's read: If your incident response plan and client notice template haven't been updated for the new rule, start there.