Cybersecurity Policies
& Procedures Manual

What the manual must cover

A compliant cybersecurity P&P manual for an SEC-registered adviser is not a single document — it is a policy suite. Each policy is short (three to five pages is the right size), covers a defined area, and is accompanied by a one-page procedure explaining who does what, how often, and where evidence is stored. Screenshots, checklists, and templates belong in appendices, not in the policy body.

The following sections represent the required coverage for a manual that will hold up under examination.

Governance and program ownership

Names the program owner by title, defines their authority, describes the reporting structure, and documents the escalation path for urgent decisions. This section is the charter the Mock SEC Cyber Exam and the Cybersecurity Compliance Blueprint reference. Without it, the examiner has no way to determine who is accountable for the program.

Risk assessment

Describes the firm's methodology for identifying, rating, and tracking cybersecurity risks. Must reference how the risk assessment is conducted, how often, who is responsible, and where results are documented. Rule 206(4)-7's annual review obligation makes a documented risk assessment the natural starting point — it is the record that shows the rest of the program addresses the risks the firm actually faces.

Access controls

Covers how access to systems, data, and privileged functions is granted, reviewed, and revoked. Must address multi-factor authentication requirements, the process for onboarding and offboarding users, how access changes are authorized and documented, and the review cadence for privileged accounts. This section maps directly to the access rights documentation request in every examination request list.

Data protection and Reg S-P safeguards

Addresses how the firm protects nonpublic personal information at rest, in transit, and during disposal. Must incorporate the 2024 Reg S-P amendments — specifically the written incident response program, the 30-day customer notification requirement for breaches involving NPI, and the service provider oversight obligations. This section must also address encryption standards, remote device management, and data retention and destruction.

Incident response

Documents the firm's written incident response plan, including the stages of response, named roles, decision triggers, notification steps for clients and regulators, and the testing cadence. Per Reg S-P (2024), the incident response program must be written and must specifically address unauthorized access to customer information at service providers, not just at the firm itself.

Vendor risk management

Describes the vendor inventory process, how vendors are tiered by risk, what security artifacts are collected during onboarding and annually, what contract clauses are required for vendors with NPI or network access, and how vendor access is monitored. Under the amended Reg S-P (17 CFR 248.30(a)(5)), the firm must maintain written oversight procedures — due diligence and monitoring — for service providers with access to customer information, including provisions designed to ensure the vendor notifies the firm as soon as practicable, but no later than 72 hours, after becoming aware of a breach. A contract clause is the clearest evidence of that oversight, not a mandate.

Employee technology use and training

Covers acceptable and prohibited use of firm systems, personal devices, cloud services, and AI tools. Defines the training program structure — who is required to complete training, how often, what topics are covered, and how completion is documented. The technology use policy is a separate document that all employees must acknowledge in writing; the signature page is an examination artifact.

Patch management and vulnerability remediation

Defines patch timelines (48 hours for critical vulnerabilities is the standard MTradecraft uses; monthly for non-critical), describes the process for tracking and documenting patch status, and addresses how the firm handles systems that cannot be patched. Many firms rely on their MSP for patching but cannot produce the documentation — the manual must describe how that evidence is obtained and retained.

Business continuity and disaster recovery

Documents the firm's continuity plan for cybersecurity incidents — not just natural disasters or operational disruptions. Must address recovery time and recovery point objectives, backup testing cadence, and how clients are notified if a cybersecurity incident affects service delivery.

Books and records

Describes the firm's document retention structure, naming conventions, and evidence archive. This section is what makes the rest of the manual operational — it defines where everything lives and how long it is kept. Without it, evidence generated by other program activities cannot be produced on demand during an examination.

AI governance (2026)

Addresses how AI tools are approved for use, what categories of AI use are permitted and prohibited, how AI-generated content is reviewed and retained under Rule 204-2, how AI vendors are handled under the service provider oversight requirements of Reg S-P, and where the firm's AI governance documentation lives. New section required for any firm that has deployed AI tools in client-facing or compliance-sensitive workflows.

The working template

The MTradecraft Cybersecurity Policies and Procedures Template is a complete, working document structured for an SEC-registered investment adviser. It covers all sections described above, includes procedure language for each policy area, and incorporates the 2024 Reg S-P amendments throughout.

BrainTrust Premium subscribers also receive the Reg S-P Revised version, which restructures the data protection and incident response sections to the new requirements and includes updated service provider contract language.