Practice question, Cybersecurity and customer information
Describe your administrative, technical and physical safeguards for customer information, your incident response program, your customer notification procedure and how you oversee service providers that hold customer data.
Taft practice question: not an official regulator question. SEC Division of Examinations, United States (federal). For SEC-registered investment advisers, Broker-dealers. Evidence category: Information security records.
Not legal advice. A practice prompt for rehearsing how your team explains its controls and evidence. No scoring, no model answer, no implication that a regulator will ask these words.
Authored by Taft. Last checked 2026-11-09. All questions.
Why it is relevant
The 2027 priorities say examinations will focus on reasonably designed safeguards for customer information under Regulation S-P, and that staff will evaluate response program policies and procedures, customer notification procedures and oversight of service providers.
Evidence to locate
Suggested, not mandatory. A regulator's actual request list governs.
Safeguards for the protection of customer records and information, electronic access controls, and the record of any cybersecurity incidents with their remediation.
Sources: [3] Attachment, Information Processing, Reporting, and Protection
Follow-up prompts
When was the incident response plan last exercised, and what changed afterwards?
Applicability
- Applies to
- SEC-registered advisers and broker-dealers. Whether Regulation S-P applies to your firm is confirmed in the rule, not here.
- Does not apply to
- Not stated.
Cite
Cite the official source first. Then: Taft Compliance Group, Exam-prep toolkit (draft), question q-customer-information-safeguards, https://taftcompliance.com/resources/exam-prep-toolkit/questions/q-customer-information-safeguards, last checked 2026-11-09.
Sources
U.S. Securities and Exchange Commission, Division of Examinations, Fiscal Year 2027 Examination Priorities (staff statement). regulator guidance. Section VII.A.3, Regulation S-ID and Regulation S-P, page 12.
https://www.sec.gov/files/2027-exam-priorities.pdf
Checked 2026-11-09.
Supporting passage
Examinations will focus on whether firms have developed, implemented, and maintained reasonably designed policies and procedures that address administrative, technical, and physical safeguards to protect customer information, as required by Regulation S-P. In accordance with the amended rule, staff will evaluate response program policies and procedures for unauthorized access to or use of customer information, including customer notification procedures and oversight of service providers. Examiners will also review how firms are addressing operational risk, including technology risks, as part of their efforts to safeguard customer information.
U.S. Securities and Exchange Commission, Division of Examinations, Fiscal Year 2027 Examination Priorities (staff statement). regulator guidance. Section VII.A.1, Cybersecurity, page 12.
https://www.sec.gov/files/2027-exam-priorities.pdf
Checked 2026-11-09.
Supporting passage
The Division will continue to prioritize examinations focused on information security and operational resiliency, with particular emphasis on cybersecurity. Cybersecurity practices remain a key examination priority to help ensure the safeguarding of customer information. Examinations will review firms' policies and procedures regarding governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks. In addition, the Division will assess risks associated with registrants' increased use of third-party service providers and shared technologies, including the effectiveness of risk management in these areas.
U.S. Securities and Exchange Commission, Division of Examinations, Risk Alert: Investment Advisers: Assessing Risks, Scoping Examinations, and Requesting Documents (staff statement). regulator guidance. Attachment, Typical Initial Information Examiners Request of Investment Advisers: Compliance Program and Oversight Process; Valuation; Information Processing, Reporting, and Protection.
https://www.sec.gov/files/risk-alert-ia-risk-and-requesting-documents-090623.pdf
Checked 2026-11-09; published 2023-09-06.
Supporting passage
Compliance policies and procedures in effect during the examination period. Tests performed (i.e., compliance reviews, quality control analyses, surveillance, and/or forensic or transactional tests performed by the firm). Annual and/or interim reviews of policies and procedures, including any reports prepared. Record of compliance exceptions. Inventory of compliance risks and conflicts of interest that forms the basis for policies and procedures and notations regarding changes made to the inventory. Valuation process. Fair-valued and illiquid securities held by clients. Advisory fee calculations. Pricing overrides. Safeguards for the protection of customer records and information. Business continuity plan. Cybersecurity incidents or breaches (e.g., incident description, impact, and remediation).
Changes to this question
No released changes.