Want to get ready for
SEC Reg S-P?
Reg S-P is not a framework you can select in Strac Comply yet. Here is what the 2024 amendments ask of your firm. And here is the part of the work you can run today.
14-day free trial. No credit card.
Read our SEC Reg S-P guideWhat is SEC Reg S-P?
SEC Regulation S-P (2024 amendments)
U.S. Securities and Exchange Commission, 17 CFR Part 248
Financial services data security
Regulation S-P (17 CFR Part 248) is the SEC rule on how financial firms protect customer information. It covers broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents.
The May 2024 amendments were the first big update since 2000. They added a written incident response program, notice to affected customers within 30 days and service-provider oversight. They also widened the Safeguards Rule and the Disposal Rule, and added new recordkeeping requirements.
Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026.
Where Strac Comply helps with SEC Reg S-P today
You can't notify the right customers within 30 days if you can't show what happened and when.
Strac Comply already keeps the records Reg S-P depends on. They are written policies with approvals, a security incident log with dates, and a vendor register for your service providers.
A Reg S-P framework, with its own controls and readiness score, is on our roadmap.
What you can do today
These run in Strac Comply now, through the frameworks we support. SEC Reg S-P itself is on our roadmap.
Draft your incident response policy with AI, then approve it. Strac Comply keeps every version with who approved it and when
Log every security incident with the date you found it, what it affected and the steps you took
Oversee service providers from your vendor register: a risk score, security reviews and documents for each one
Run daily tests on access, MFA and encryption across AWS, Google Workspace, Okta and more
Keep every policy version, incident record and vendor review dated in one place. An exam request then starts from records, not memory
Where the work overlaps
SEC Reg S-P requirements, and the evidence Strac Comply can already keep for them.
- Safeguards
Protect customer information
Written security policies + daily access and encryption tests
- Incident response
Written response program
AI-drafted incident response policy + security incident log
- Customer notice
Notice within 30 days
Dated incident records. The notices are still yours to write and send
- Service providers
Oversight of providers
Vendor register with risk scores and security reviews
- Disposal
Secure disposal
Disposal policy + media disposal records
- Records
Recordkeeping
Dated versions of every policy, incident and vendor review
Frequently asked questions
Can I run Reg S-P in Strac Comply today?
Not as its own framework yet. Reg S-P is on our roadmap.
Today you can run SOC 2 or NIST CSF 2.0. They share much of the groundwork: written policies, incident records, vendor oversight and security tests.
Strac Comply won't show a Reg S-P readiness score until Reg S-P ships.
Who has to comply with the Reg S-P amendments?
Firms the SEC calls "covered institutions": broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. If you handle customer information in any of those roles, the rules apply now.
What is the 30-day customer notice requirement?
If a covered institution learns that someone accessed or used sensitive customer information without authorization, or likely did, it must notify the affected people. It must do so as soon as practicable, and no later than 30 days.
The notice must describe the incident, the data involved and how people can protect themselves.
How is Reg S-P different from SOC 2 or NIST CSF?
Reg S-P is a binding SEC rule with exam consequences, not a voluntary report. It is narrower, focused on customer information, breach response and service providers. But the groundwork (access control, incident response, vendor risk) overlaps heavily with SOC 2 and NIST CSF.
Frameworks you can run in Strac Comply today
Start with what your buyers ask for.
Most teams start with SOC 2 or ISO 27001. Run either in Strac Comply today, and the security work carries over.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations