Written incident response program
Covered institutions must keep written policies and procedures to detect, respond to and recover from unauthorized access to or use of customer information.
SEC Regulation S-P · service provider oversight
Regulation S-P vendor oversight, documented.
The SEC's 2024 amendments to Regulation S-P put service provider oversight and breach notification at the center of how broker-dealers, investment advisers and funds protect customer information. Larger entities had to comply by December 3, 2025; smaller entities by June 3, 2026.
What the rule expects
The vendor-related requirements in plain language
Service provider oversight
The program must include oversight of service providers, including due diligence and monitoring, designed to ensure providers protect customer information.
72-hour notice from service providers
Service providers are expected to notify the firm as soon as possible, and no later than 72 hours after becoming aware of a breach affecting customer information.
30-day customer notice
Where sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, affected individuals generally must be notified within 30 days.
Records
Firms must keep written records documenting compliance with the safeguards and disposal requirements.
Sources: SEC press release 2024-58, the adopting release (34-100155) and the SEC small-firm outreach notice. Confirm how the rule applies to your firm with counsel or your compliance professional.
How ThirdNexa helps
Five steps from spreadsheet to examiner-ready record
- 1
Identify the vendors in scope
Flag which vendors access, store or process customer information so the inventory shows exactly who is covered.
- 2
Check each contract
Record whether the 72-hour notice, safeguards, and security documentation clauses are present, missing or in negotiation — with the page and passage cited.
- 3
Collect due diligence
Send questionnaires, gather SOC reports and policies, and keep dated review notes and findings for each vendor.
- 4
Log incidents with timers
Record when the vendor and the firm became aware, track the 72-hour and 30-day windows, and document the notification decision your firm makes.
- 5
Produce the evidence
Export a vendor oversight record for examiners, with every review, finding, decision and change in a server-written activity history.
ThirdNexa does the reading, chasing and paperwork. Your firm decides which vendors are in scope, whether a clause is adequate, and whether customer notice is required — the software never makes those calls.
Inside the product
See the workflows your team will use.
Three of the newest workflows, shown with illustrative sample screens. Every record shown is fictional, and every status is something your firm records — ThirdNexa never labels a vendor compliant or approved.
Vendor incident response
Record breaches, outages, and cyberattacks with severity, root cause, and attachments. Reference timers track the 72-hour vendor and 30-day customer notice windows while a guided checklist documents each step your firm takes.
Illustrative sample screen with fictional data.
Reg S-P readiness
See which vendors handle customer information, whether the breach-notice clause is recorded, and which written assurances are expiring — then export exam evidence per vendor or for the whole firm.
Illustrative sample screen with fictional data.
Fourth-party tracking
Record the subcontractors behind each vendor, the data they access, and how they were identified. The firm-level view flags when the same fourth party appears under multiple vendors, so concentration is visible.
Illustrative sample screen with fictional data.
Related
See every SEC and FINRA framework we cover, or how pricing works.
Educational information only, not legal advice. ThirdNexa does not determine whether your firm meets Regulation S-P. Last reviewed October 16, 2026.