Free tool · SEC Regulation S-P

RIA SEC Regulation S-P Checklist Calculator

Mark the 10 cybersecurity and vendor oversight controls, see your self-rated readiness and open items, then download or email your results.

Start the CalculatorBook a 30-Minute Risk Assessment
Your answers stay in this browser.

Nothing is sent anywhere unless you ask us to email your results, and then only your totals and the titles of open controls are sent. Owners, dates and notes are never sent.

REG S-P (2025/2026) • SEC RULE 204-2
72-Hour SLAMandatory Vendor Breach Notice
30-Day RuleSEC Reg S-P Client Notification
100% WORMImmutable Comms Archive (204-2/17a-4)
4 Minutes24/7 Identity Token Containment

How to use this checklist

  1. 1. Mark a status for each control. Pick In place, Partial, Gap or N/A for each of the 10 controls.
  2. 2. Assign the work. For anything Partial or a Gap, name an owner and a target date.
  3. 3. Note the evidence. Say where the proof lives (policy, screenshot, report, contract), so you can produce it on request. Owners, dates and notes stay in this browser.
  4. 4. Review your results. The results panel counts your answers, works out a self-rated readiness % and lists the open items.
  5. 5. Get a second opinion. Bring the results to a 30-minute risk assessment if you want an outside review.
In place: Implemented today and you can show evidence.Partial: Started, or covers only some users, systems or sites.Gap: Not in place yet.N/A: Does not apply to your firm. Left out of the readiness %.
01. Written Incident Response Program & 30-Day Customer Notification Workflow

Establish a documented Incident Response Plan meeting amended SEC Reg S-P mandates, including assessment procedures and 30-day affected-client notification templates.

02. Mandatory 72-Hour Service Provider Breach Notice Addendum

Enforce written contracts requiring all IT, custodian, CRM, and portfolio cloud vendors to notify your CCO within 72 hours of any unauthorized customer data access.

03. Phishing-Resistant FIDO2 Hardware MFA on Custodian & Portfolio Portals

Block Adversary-in-the-Middle (AiTM) token theft across Schwab Advisor Center, Fidelity Wealthscape, Orion, Black Diamond, eMoney, Redtail, and Microsoft 365.

04. Immutable Communications Archiving (RIAs: Rule 204-2 / Broker-Dealers: Rule 17a-4)

RIAs must keep required written communications under Advisers Act Rule 204-2 (five years, the first two in an appropriate office); Rule 17a-4 WORM or audit-trail storage applies to broker-dealers. Emry recommends immutable archives of advisor email, Microsoft Teams, Slack, Zoom, and approved SMS/mobile channels.

05. 4-Minute 24/7 MDR Identity & Endpoint Isolation

Continuously monitor advisor laptops and cloud sessions for impossible-travel logins, unauthorized inbox forwarding rules, and anomalous bulk client-list downloads.

06. Executive Mobile Device Management (MDM) & Remote Container Wipe

Enforce Intune/Jamf MDM with biometric lock, hardware encryption, and selective corporate container wipe on every advisor iPhone, iPad, and MacBook.

07. Wire & Disbursement Fraud Verification Protocol

Combine DMARC p=reject anti-spoofing, Proofpoint/Avanan BEC behavioral AI, and out-of-band identity verification before any client ACAT or wire instruction.

08. Proper Disposal & Sanitization of Customer Information

Maintain NIST SP 800-88 cryptographic erasure certificates for decommissioned advisor laptops, SSDs, and local scanner storage under Reg S-P Disposal Rules.

09. Sub-24-Hour CISA KEV Edge & Remote Access Patching (Emry Recommended)

Eliminate exposed office VPNs and patch critical workstation/browser/gateway vulnerabilities within 24 hours of disclosure with automated compliance timestamps. CISA's KEV deadlines bind federal civilian agencies only; for advisers they are a recommended best practice.

10. Quarterly CCO Examination Binder & Annual Tabletop Documentation

Generate turnkey SEC Division of Examinations evidence packages showing 365-day log retention, vendor due diligence, and quarterly tabletop sign-off. FINRA Rule 4370 business continuity plans apply only to FINRA member firms (e.g., dually registered broker-dealers).

Your results and open items

RIA SEC Regulation S-P Checklist · Generated . Readiness is your own self-assessment, not a compliance determination.

0In place
0Partial
0Gap
0N/A
0Not yet marked
Readiness (self-rated)
–
Gaps and partials with no owner
0

Readiness = controls marked In place ÷ controls you have marked, excluding N/A. Partial counts as not yet in place.

Open items to close (Gaps first, then Partials)

ControlStatusOwnerTarget

Want a second set of eyes before your next exam?

Emry Networks helps RIAs and wealth managers put these controls in place and keep the evidence an examiner will ask for. Call (603) 202-3200.

EMRY NETWORKS • DEFENSIBLE IT, 24/7 MDR & LIVE COMPLIANCE ENGINEERING
Jacksonville, FL & Manchester, NH Operations Hubs • Serving Regulated SMBs Across All 50 States • (603) 202-3200 • www.emrynetworks.com/contact-us
Book a 30-Minute Risk Assessment

This checklist is an educational self-check, not legal advice, a certification, or a formal assessment. Confirm requirements against the current regulation, your contracts, and your assessor or counsel.

Rules and documents cited in this checklist

Official sources for the rules, standards and documents named in the controls above. Check them for updates before relying on any requirement.

Related Emry Networks resources
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get audit ready now

Schedule your compliance readiness assessment with our team today.

Book a 30-Minute Risk AssessmentCall (603) 202-3200