Compliance
The SEC’s safeguards and disposal rules, 17 CFR 248.30, as amended in 2024
Component tests from $4,200, free retest. See all pricing →
Last reviewed
Reply in one business day
Thanks, we've received your message.
We'll be in touch shortly.
When you need it
The situations that bring teams to this engagement, and where it fits alongside the rest of your program.
The 2024 amendments
The SEC adopted Regulation S-P in 2000, and its safeguards rule has long required policies protecting customer information. The amendments adopted in May 2024, effective August 2, 2024, expanded the safeguards and disposal rules into the obligations below. None of them names a penetration test, but each one depends on controls a test can prove or disprove.
What the rule says
Where testing fits
Customer information now includes information about the customers of other financial institutions that has been provided to you, and transfer agents registered with the SEC or another appropriate regulatory agency are covered by the safeguards rule for the first time.
Compliance dates
The SEC set two compliance dates by firm size. Both have passed, so every covered institution must now comply, and the SEC’s examination staff said they would examine firms for compliance with the amended rule once each firm’s date arrived.
Larger entity: complied by December 3, 2025
Smaller entity: complied by June 3, 2026
Funding portals follow Regulation S-P as it applies to brokers. Private funds that rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act are not covered themselves, but an SEC-registered adviser to those funds is.
What we assess
Regulation S-P protects customer information, and its notice rule turns on sensitive customer information: Social Security numbers, or account numbers and user names combined with the codes that open an account. We test the systems that hold it, and the people and providers who can reach it.
The Microsoft 365 or Google Workspace tenant and the SSO provider, a common route into adviser and broker-dealer incidents.
We test for
Everything internet-facing, and how far one compromised laptop reaches toward customer records.
We test for
The staff who approve wires, change bank details, or reset client access, tested the way fraudsters target them.
We test for
The service providers the amendments make you oversee, and whether your monitoring would notice unauthorized access at all.
We test for
The requirement
No test is named. Rule 248.30 requires safeguards reasonably designed to protect customer information, and an incident response program reasonably designed to detect, respond to, and recover from unauthorized access. Whether a program was reasonably designed is judged by examiners, usually after the fact.
The SEC’s fiscal 2026 examination priorities name governance, data loss prevention, access controls, account management, and response to incidents such as ransomware as cybersecurity focus areas, and commit to examining firms for compliance with the amended Regulation S-P after their compliance dates.
That access controls, MFA, and segmentation hold against a real attempt, and that monitoring saw it. A dated report with the fixes retested is evidence the policies are more than paper, and it is the same evidence allocators ask for in operational due diligence.
For how advisers and funds are tested day to day, see penetration testing for wealth management firms and hedge funds and asset managers.
Incident response
The notice clock starts when you become aware of unauthorized access, and it allows at most 30 days. If you cannot tell which customers’ sensitive information was accessed, 248.30(a)(4)(ii) requires notice to every individual whose sensitive customer information resides in the affected system. The difference between notifying a handful of clients and every client in the system is usually the logging.
We make that concrete. After testing, your team gets a timeline of what we did, from which account, and when. Checking it against what your logs, your managed IT provider, and your alerting recorded shows whether the program can detect, assess, and scope an incident, or only document one. To run the exercise live with your defenders, a purple team assessment works through it in the room, and a ransomware readiness assessment tests recovery.
FINRA’s 2026 oversight report lists tabletop exercises among effective cybersecurity practices for member firms. A timeline from a real test makes a better tabletop than a hypothetical scenario.
The examination file
The amended rule’s records are kept for the period in your own books-and-records rule: five years for advisers under Rule 204-2, three years for broker-dealers under Rule 17a-4 and for transfer agents under Rule 17Ad-7, and six years for investment companies.
Methodology
Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.
These are the phases your compliance test runs through.
The systems your framework actually covers, and nothing you would pay to test twice.
The component penetration tests run to PTES and OWASP standards by senior testers.
Every finding tied to the requirement or control it evidences.
Evidence formatted the way your assessor, examiner, or QSA expects to read it.
A free retest so the audit shows closed findings, not open ones.
How it works
From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.
Scope customer information
We map where customer information lives: CRM, portfolio and trading systems, the email tenant, cloud storage, and the providers that hold it for you.
Test the safeguards
External, internal, identity, and phishing testing against the technical safeguards the rule requires.
Exercise the response
Your team gets a timeline of our activity to check against what the incident response program detected.
Report & retest
A report written for the examination file, then a free retest of what you fix.
Fixed prices
Published starting prices, fixed in writing before work begins. A typical adviser starts with the first three.
What it covers
Price
Every starting price is on our pricing page. Larger firms and multi-office estates are quoted from the scope, as one fixed price.
Component tests
Compliance testing is built from our standard fixed-scope engagements. Each one is scoped to your boundary and reported against the framework.
Proof
Every engagement is confidential, so the work below is anonymized to sector and engagement type.
Free
Retest on every penetration test
185+
Years combined experience
14
Senior in-house specialists
24h
Onboarding after signing
Fintech · Payments
Post-Incident Web App Assessment
Excessive data exposure: API responses leaked transaction metadata, including precise geolocation, enabling real-world tracking of users.
Outcome. Surfaced the exposure and hardening gaps, prioritized by how readily an attacker could chain them, and delivered fixes plus a retest to confirm closure.
8
Findings
3
Medium
Post-incident
Engagement
Insurance
Email + Voice Social Engineering
A targeted credential-phishing email impersonating the company SSO password-reset flow led 19 employees to submit their credentials.
Outcome. Gave the security team a realistic multi-channel picture of susceptibility and a roadmap for help-desk identity-verification procedures and targeted training for high-exposure roles.
200
Email targets
19
Credential entries
2-channel
Attack simulated
Resources
Fintech & Financial Services Penetration Testing
Penetration testing for fintech and financial services: the regulations that require it, scoping APIs, apps and cloud, and testing payment flows safely.
NYDFS Cybersecurity Regulation (23 NYCRR 500): Complete Guide
The NYDFS cybersecurity regulation (23 NYCRR 500) section by section: who it covers, Class A rules, the 500.5 testing mandate, and the April 15 certification.
Cybersecurity Due Diligence: What a Pentest Proves Before Close
Cybersecurity due diligence for M&A and investors: what a penetration test proves before close, how to scope it on a deal clock, and a due diligence checklist.
Want to see a report first?
Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.
Not by name. Rule 248.30 requires written administrative, technical, and physical safeguards reasonably designed to protect customer information and, since the 2024 amendments, an incident response program reasonably designed to detect, respond to, and recover from unauthorized access. Whether those are reasonably designed is what examiners assess. A penetration test with the fixes retested is the most direct evidence that the technical safeguards work and that you would detect an intrusion.
Covered institutions: broker-dealers, including funding portals, investment companies, investment advisers registered with the SEC, and transfer agents registered with the SEC or another appropriate regulatory agency. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026. A registered adviser counts as a larger entity with $1.5 billion or more in assets under management.
Procedures to assess the nature and scope of an incident and identify the customer information systems and types of customer information involved, to contain and control it, and to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice goes out as soon as practicable and no later than 30 days after you become aware, unless a reasonable investigation finds the information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience. The program must also include written policies for overseeing service providers.
Your policies must require oversight through due diligence and monitoring, and must be reasonably designed to ensure providers protect customer information and notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach resulting in unauthorized access to a customer information system they maintain. A provider can send customer notices on your behalf under a written agreement, but the obligation stays with you. Fund administrators, custodians, CRM and portfolio platforms, and managed IT providers are the usual list.
It can be, if the engagement gives it access to customer information. We plan for that in writing before testing starts: the rules of engagement set how proof of access to customer records is captured and kept to a minimum, evidence is handled through our platform rather than email, testing artifacts are destroyed on the schedule set in the engagement terms, and we tell you at once if testing reaches sensitive customer information. Put the same questions to any tester you consider, because your oversight policies apply to them too.
Because it decides who you notify. If you cannot identify which individuals’ sensitive customer information was accessed, 248.30(a)(4)(ii) requires notice to everyone whose sensitive customer information resides in the affected system. Logs that show what an intruder touched let you narrow the notice to the people actually affected. A penetration test checks that the logs capture that activity before you need them to.
To the adviser, if it is registered with the SEC. Private funds that rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act are excluded from the definition of an investment company, so the funds themselves are not covered institutions, but their registered adviser is. Our page on penetration testing for private equity firms covers how a firm and its portfolio companies are scoped.
Often. A firm or affiliate operating under a New York DFS license also follows 23 NYCRR 500, which requires annual penetration testing from inside and outside the network boundary; see NYDFS 23 NYCRR 500 penetration testing. FINRA points member firms to Rule 30 of Regulation S-P in its cybersecurity guidance, and its 2026 oversight report lists tabletop exercises among effective practices. One test can be scoped and reported for all of them.
A typical first engagement for an adviser combines an external penetration test from $4,200, a Microsoft 365 or Google Workspace review from $4,200, and a phishing simulation from $3,600, each fixed in writing before work begins. Firms with an office network add an internal test from $6,000, and firms holding customer data in AWS, Azure, or GCP add a cloud test from $6,800. Penetration tests include a free retest. Every starting price is on our pricing page.
Talk to our team about what your Reg S-P compliance requires.
Prefer the full scoping questionnaire?Tell us what you need tested. We reply within one business day.
Thanks, we've received your message.
We'll be in touch shortly.
