Getting ready for
SEC Reg S-P?
Reg S-P is not a framework you can select in Strac Comply yet. Here is what the 2024 amendments ask of broker-dealers, investment advisers, funds and transfer agents, and the parts you can already run today.
14-day free trial. No credit card.
Read our SEC Reg S-P guideFramework
SEC Regulation S-P (2024 amendments)
U.S. Securities and Exchange Commission, 17 CFR Part 248
Financial services data security
What it is
Regulation S-P (17 CFR Part 248) is the SEC rule on how financial firms protect customer information. The May 2024 amendments, the first big update since 2000, added a written incident response program, notice to affected customers within 30 days, service-provider oversight, a wider Safeguards Rule and Disposal Rule, and new recordkeeping. It covers broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026.
Where Strac Comply helps with SEC Reg S-P today
You can't notify the right customers within 30 days if you can't show what happened and when. Strac Comply already keeps the pieces Reg S-P leans on: written policies with approvals, a security incident log with dates, and a vendor register for your service providers. A Reg S-P framework, with its own controls and readiness score, is on our roadmap.
What you can do today
These run in Strac Comply now, through the frameworks we support. SEC Reg S-P itself is on our roadmap.
Draft your incident response policy with AI, then approve it. Every version is kept with who approved it and when
Log every security incident with the date you found it, what was affected and the steps you took
Oversee service providers from your vendor register: a risk score, security reviews and documents for each one
Run daily tests on access, MFA and encryption across AWS, Google Workspace, Okta and more
Keep every policy version, incident record and vendor review dated in one place, so an exam request starts from records, not memory
Where the work overlaps
SEC Reg S-P requirements, and the evidence Strac Comply can already keep for them.
Safeguards
Protect customer information
Written security policies + daily access and encryption tests
Incident response
Written response program
AI-drafted incident response policy + security incident log
Customer notice
Notice within 30 days
Dated incident records. The notices are still yours to write and send
Service providers
Oversight of providers
Vendor register with risk scores and security reviews
Disposal
Secure disposal
Disposal policy + media disposal records
Records
Recordkeeping
Dated versions of every policy, incident and vendor review
Frequently asked
Can I run Reg S-P in Strac Comply today?
Not as its own framework yet. Reg S-P is on our roadmap. Today you can run SOC 2 or NIST CSF 2.0, which share much of the groundwork: written policies, incident records, vendor oversight and security tests. Strac Comply won't show a Reg S-P readiness score until Reg S-P ships.
Who has to comply with the Reg S-P amendments?
Broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents: the SEC's "covered institutions." Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. If you handle customer information in any of those roles, the rules apply now.
What is the 30-day customer notice requirement?
When a covered institution learns that sensitive customer information was accessed or used without authorization, or likely was, it must notify affected people as soon as practicable and no later than 30 days. The notice must describe the incident, the data involved, and how people can protect themselves.
How is Reg S-P different from SOC 2 or NIST CSF?
Reg S-P is a binding SEC rule with exam consequences, not a voluntary report. It is narrower, focused on customer information, breach response and service providers. But the groundwork (access control, incident response, vendor risk) overlaps heavily with SOC 2 and NIST CSF.
Frameworks you can run in Strac Comply today
On the roadmap
Start with what your buyers ask for
Most teams start with SOC 2 or ISO 27001. Run either in Strac Comply today, and the security work carries over.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations