Under the SEC's May 2024 Regulation S-P amendments, covered institutions must ensure their service providers notify them as soon as possible, and no later than 72 hours, after becoming aware of a breach in security. Covered firms must also run an incident response program and notify affected customers within 30 days.
This is general information, not legal advice.
Who is covered
The SEC's rule text defines a covered institution as any broker or dealer, any investment company, and certain other registered entities, including registered investment advisers and transfer agents. If your customers are wealth platforms, brokerages or advisers, this rule shapes your contracts.
What changed
The SEC adopted the amendments on 16 May 2024. Key elements from the release:
- A written incident response program to detect, respond to and recover from unauthorized access to customer information.
- Customer notification as soon as practicable, and not later than 30 days after becoming aware, when sensitive customer information was or is reasonably likely to have been accessed or used without authorization.
- Service provider oversight, with notice to the covered institution as soon as possible and no later than 72 hours after the provider becomes aware of a breach.
The SEC set the 72 hours after commenters objected to a proposed 48 hours, and noted it is informed by the 72 hour deadline in the Cyber Incident Reporting for Critical Infrastructure Act of 2022.
Compliance timing
The SEC gave larger entities 18 months and smaller entities 24 months after Federal Register publication. Size thresholds are set in the release, for example investment companies with net assets of $1 billion or more in a group. Check which tier your customer is in and what date applies.
What a vendor should do
- Put the 72 hour outer limit into your incident process as a ceiling, not a target.
- Define "becoming aware" internally so teams apply it consistently.
- Hold a current contact per customer and test the path.
- Keep evidence that lets you say quickly what data was touched.
- Be ready for diligence questions about your incident response and testing.
Where Safeguard fits
Safeguard's SBOM and dependency scanning, policies and gates, and compliance and evidence automation can help you show how vulnerabilities are found and handled. A free scan is at gold.safeguard.sh/scan.
Quick check
Is 72 hours the target or the limit?
The limit. The rule says as soon as possible, but no later than 72 hours after becoming aware.
Does this apply to banks?
No. It applies to SEC covered institutions. Banks follow their own agencies' rules.
Sources
Last reviewed: 19 October 2026.
