02Reg S-P plan builder
Draft your Reg S-P incident response plan.
Answer a few questions. Get a draft plan you can edit, with the 30-day customer notice clock built in.
Not legal advice. Runs in your browser. Nothing you type is sent to us.
Draft planWord-ready
Your plan appears here. Download it as a Word-compatible file to edit, copy the text or print it.
Rules behind this, with sources
| Rule | What it says | Status | Source |
|---|---|---|---|
| Reg S-P safeguards and incident response program | Written policies and procedures with administrative, technical and physical safeguards, including a program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information, with customer notification procedures. | Regulation text read 2026-10-16 | 17 CFR 248.30(a)(1)-(3) source |
| Customer notice timing | Notify each affected individual as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The Attorney General can authorize delays for national security or public safety. | Regulation text read 2026-10-16 | 17 CFR 248.30(a)(4)(iii) source |
| Service provider oversight | Policies must require oversight of service providers, including due diligence and monitoring, and reasonably ensure providers notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system they maintain. You remain responsible for notifying affected individuals. | Regulation text read 2026-10-16 | 17 CFR 248.30(a)(5) source |
| Reg S-P compliance dates | Larger entities (for advisers, $1.5 billion or more in assets under management) had to comply 18 months after Federal Register publication on June 3, 2024, which is December 3, 2025. Smaller entities had 24 months, which is June 3, 2026. Both dates have passed. | Regulation text read 2026-10-16 | SEC Release 34-100155, section II.F and the adopting release table of larger entities source |
| Reg S-P records for advisers | Registered advisers must keep the written Reg S-P policies, incident documentation, notification determinations and service-provider agreements as books and records. | Regulation text read 2026-10-16 | 17 CFR 275.204-2(a)(25) source |
Source documents: 17 CFR 248.30 on eCFR and SEC Release 34-100155.
Keep this plan current and tested
We are building one workspace for your deadlines, plans and exam evidence. Join the list and we will email you when it opens.