Securing Compliance:
How to Survive an SEC
Cybersecurity Examination

The compliance landscape has changed

Cybersecurity compliance is no longer a technical checkbox. It is a regulatory obligation with direct consequences for examination outcomes, investor confidence, and firm continuity. The SEC cites cybersecurity deficiencies in examinations and has brought enforcement actions over safeguarding failures and misleading statements about cybersecurity.

CCOs are expected to speak fluently about cybersecurity risk without technical training. IT managers are juggling infrastructure with audit prep, often without dedicated support. Managing partners face questions from LPs, boards, and insurers that require defensible, documented answers.

This report was written to address a specific problem: public regulatory guidance is general, while examination request lists are specific. That gap can leave firms without documentation that answers the requests.

Overview of the regulatory framework

The following rules form the primary cybersecurity compliance obligations for SEC-registered investment advisers.

Rule 206(4)-7: The Compliance Program Rule

Often called the compliance rule, Rule 206(4)-7 requires each SEC-registered investment adviser to adopt and implement written policies and procedures reasonably designed to prevent violations of the Advisers Act and its rules. Firms must review, at least annually, the adequacy of those policies and the effectiveness of their implementation, and designate a Chief Compliance Officer to administer the program. The rule does not mention cybersecurity, but examiners review cybersecurity policies as part of the compliance program, and Rule 204-2(a)(17) requires the firm to keep its policies and records of each annual review.

Regulation S-P: Privacy & Safeguards Rule

Regulation S-P requires advisers to adopt written policies and procedures that address administrative, technical, and physical safeguards for customer records and information. The 2024 amendments are in effect for all covered advisers: larger advisers ($1.5 billion or more in assets under management) had to comply by December 3, 2025, and all others by June 3, 2026. They added three core duties. First, a written incident response program. Second, notice to affected individuals as soon as practicable, and within 30 days, when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization; notice is not required if a reasonable investigation determines the information has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience, and it may be delayed if the U.S. Attorney General determines in writing that notice poses a substantial risk to national security or public safety. Third, written policies requiring oversight of service providers through due diligence and monitoring, reasonably designed to ensure each provider notifies the firm as soon as possible, but no later than 72 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system the provider maintains. The related records must be kept under Rule 204-2(a)(25).

Regulation S-ID: Identity Theft Red Flags

Regulation S-ID requires RIAs that qualify as financial institutions or creditors with covered accounts to develop and implement a written Identity Theft Prevention Program. The program must identify, detect, and respond to red flags that could indicate identity theft, its initial version must be approved by the board or a board committee (or a designated senior manager if the adviser has no board), and it must be updated periodically. Examiners focus on whether the adviser has assessed which red flags are relevant to its business model and whether staff are trained to recognize them.

Proposed Rule 206(4)-9: Cybersecurity Risk Management (Withdrawn)

The SEC proposed this rule in February 2022, reopened the comment period in March 2023, and withdrew the proposal in June 2025. It never took effect. Much of its operational ground, including incident response and service provider oversight, is now covered by the amended Reg S-P.

A full examination notice

The PDF reproduces an SEC examination notice and information request list sent to a registered investment adviser in March 2023. Names and identifying information have been redacted. It is included because the gap between regulatory guidance and examination reality is best understood by reading what the SEC actually sends.

The request list covers nineteen numbered items, including organization charts, supervised person lists, cybersecurity oversight, the cybersecurity risk assessment, an inventory of client NPI, compliance and cybersecurity policies, the annual review, compliance exceptions, complaints, access rights changes, vendors, and breaches. The examination period ran from January 1, 2022 through February 28, 2023.

Key observations from the 2023 request list:

• The request for cybersecurity policies is separate from the request for general compliance policies, and asks for the dates of any updates made since January 1, 2022.
• Item 9 asks the firm to state, for each of fourteen topics, whether its policies address it, and for each gap whether the topic is not applicable, low risk, or scheduled for development.
• The vendor request covers every vendor with access to the firm's network, systems, or data, not just major vendors, and asks whether an executed contract addresses each one's cybersecurity practices.
• The access rights request asks for the last ten changes or terminations, with dates and reasons, not just the current state.
• The breach requests ask about actual and suspected incidents, client notification, lost funds, and insurance recoveries, and for copies of any breach communications sent to clients.
• The list predates the Reg S-P amendments, so it has no explicit items on the incident response program, customer notice procedures, or 72-hour service provider notice. Expect current requests to add them.

The full text of this examination notice, including the complete information request list, is available in the downloadable PDF.