The SEC’s finalized cybersecurity rules for Registered Investment Advisors (RIAs), effective as of May 16, 2024, are a game-changer and reinforce the importance of RIA cybersecurity efforts. These regulation updates modernize long-standing safeguards and require RIAs to implement comprehensive cybersecurity frameworks, making RIA cybersecurity a priority for registered investment advisers.
RIAs must proactively manage digital threats and protect sensitive client information. If you’re unsure where your firm stands, this checklist will help you assess your current cybersecurity readiness and identify where outside support may be beneficial.
Why SEC Cybersecurity Readiness Matters for RIAs
Cyber incidents can disrupt operations, erode client trust, and cause lasting reputational harm to companies. For RIAs, cybersecurity readiness is about having reasonable safeguards in place to respond quickly and thoughtfully if unauthorized access to customer information occurs.
What do the Regulation S-P amendments emphasize for RIAs?
These regulations highlight the importance of:
- Written policies
- Incident response planning
- Service provider oversight
- Notification to affected individuals when sensitive customer data is compromised.
Firms are often evaluated not on whether an incident happens, but on how effectively they manage and document their response. This checklist helps you assess whether those core elements are in place today.
RIA Cybersecurity Compliance Checklist
Use this actionable checklist to ensure your firm meets current SEC cybersecurity expectations:
1. Conduct an Annual Cybersecurity Risk Assessment
Evaluate internal and external vulnerabilities across your systems. This includes analyzing current controls, identifying weaknesses, and documenting how you’ll address them.
“Cybersecurity risk assessments help firms understand where their most meaningful exposures exist and where improvements will have the greatest impact,” says Greg Miller, CPA, CISA, Vice President, Consulting Services at Assurance Dimensions.
2. Adopt a Written Information Security Policy (WISP)
Your policies should clearly outline how your firm safeguards client information and responds to incidents. These policies often include:
- Cyber threat and vulnerability management
- Access controls and user authentication
- Incident Response Plan (IRP)
- Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)
Policies should be reviewed at least annually and updated following significant changes or incidents.
3. Implement a Vendor Management Program
Maintain an approved vendor list and conduct annual due diligence on third parties who have access to client data and other nonpublic information. Document your oversight process, including meeting notes and findings.
4. Perform and Document Cybersecurity Testing
Testing helps determine whether policies and controls are functioning as intended. This may include:
- Phishing simulations
- Network vulnerability scans
- Logs of employee training and incident response drills
- A review of current policies based on testing results
Testing results should be documented and used to inform updates to policies and procedures.
5. Maintain SEC-Required Cybersecurity Records
Strong recordkeeping supports consistency and accountability. Firms should maintain documentation related to:
- Incident logs and reports
- Training records
- Risk assessments
- Meeting documentation
Organized records help firms respond more effectively when issues arise.
6. Prepare for Incident Response and Client Notification
How your firm handles a breach is just as important as preventing one. The Regulation S-P amendments highlight the importance of having an incident response program designed to detect, respond to, and recover from unauthorized access to customer information.
Firms should be prepared to assess the scope of an incident, coordinate internal and external response efforts, and notify affected individuals when sensitive customer information has been compromised, as required.
How Assurance Dimensions Supports RIA Cybersecurity
At Assurance Dimensions, we understand the evolving demands of RIA cybersecurity and compliance. Our IT advisory and consulting team provides:
- Cybersecurity risk assessments
- Policy and documentation support
- Vendor due diligence assistance
- Incident response and business continuity planning
- Partner-level guidance throughout the year
“Our clients rely on us not just for audits, but for proactive support that helps them manage risk and respond confidently when issues arise,” Greg adds.
Ready to Strengthen Your RIA Cybersecurity?
Whether you’re reviewing existing safeguards or refining your incident response approach, Assurance Dimensions can help you assess, document, and improve your cybersecurity framework in a practical, sustainable way.
Contact us today to learn more about how we can support your firm and strengthen your cybersecurity program.