What Portland RIAs Must Produce Now That Reg S-P Is in Force

June 3, 2026 has come and gone, and if you run a small Portland-area RIA, that date probably left a few questions behind. Reg S-P is now in force for smaller covered institutions, and the SEC's Division of Examinations has made it a fiscal year 2026 priority. The uncomfortable part? Examiners are not asking whether your security feels good. They want documented administrative, technical, and physical safeguards, a 30-day customer breach notification workflow, and records showing you actually oversee your IT vendors. If your advisory office has no internal IT team, that can sound like a second job. It does not have to be. In this tutorial, we will walk through what Reg S-P requires now, who counts as a smaller entity, the written policies you must hand over, how to turn your network security policy into proof, testing, physical safeguards, the 30-day notice workflow, vendor oversight, and how a managed IT engagement can produce these records for you. By the end, you will know what to gather before your next exam cycle.

What Reg S-P Requires Now That June 3, 2026 Has Passed

Reg S-P isn't new. It was adopted in 2000 to implement the Gramm-Leach-Bliley Act, and the May 2024 amendments were its first major rewrite in more than 20 years. Those amendments took effect in August 2024. This is settled rule text, not an open proposal.

The deadlines split by size. RIAs with $1.5 billion or more in assets under management, and funds with $1 billion or more in net assets, had to be ready by December 3, 2025. Smaller covered institutions fell under June 3, 2026, which has now passed (Holland & Knight).

So for a small firm, the question is no longer whether the rule applies. It's what you can put on the table when someone asks. The SEC Division of Examinations named Reg S-P a fiscal year 2026 priority (FY 2026 Examination Priorities), and examiners are assessing whether your written policies and procedures address administrative, technical, and physical safeguards for customer information.

Firms that haven't started are already behind. Vendor contract updates, an incident response rehearsal, and the written artifacts all take lead time. None of them can be produced the week a document request arrives.

Does Reg S-P Apply to Your Firm? The Large vs Smaller Entity Line

Start with the easy question. Are you on the list? SEC-registered investment advisers are, along with broker-dealers and funding portals, registered funds, and certain transfer agents (Thompson Hine). Most small advisory shops fall into the investment adviser bucket.

(The same thresholds covered in the previous section apply here.) Holland & Knight also reports a $500,000 capital threshold for broker-dealers. Sit under $1.5 billion as an RIA and you are a smaller entity, which means the amended rule applies to you in full. Small changes your timeline, not your obligations.

Those four obligations, incident response, 30-day notice, vendor oversight, and documentation, apply in full regardless of size.

Portland-area firms tend to run lean: an adviser or two, an office manager wearing three hats, no internal IT. That is exactly the profile this rule was written to cover, which is why everything below is aimed at offices without a security team.

Administrative Safeguards: The Written Policies You Have to Hand Over

This lean office still has to produce paper. That written-policy requirement is where this section lives. Start with the information security program itself. It should name an owner, define what counts as customer information, set how often risk gets reassessed, and show who approved the last version and when.

Then write the incident response plan that answers the uncomfortable questions in advance: who declares an incident, who decides whether customer notice is required, who talks to clients, and who calls outside counsel.

The employee-facing pieces matter too. Employee-facing pieces most firms include are: acceptable use rules, an access request and termination checklist, annual security awareness training with attendance records, and background screening where applicable.

Best practice is to date every policy and name an owner, a policy with no review date and no named responsible person is hard to defend on exam.

Last, keep a one-page index mapping each policy to the safeguard category it satisfies. When a document request lands, someone can assemble the response in hours instead of reconstructing a year of good intentions.

Technical Safeguards: Turning Network Security Policy Into Proof

Where the administrative section covers the paperwork, technical safeguards are what is actually switched on. A network security policy is the written half: a plain statement of how you protect the systems holding client data, covering email, endpoints, cloud file storage, remote access and your Microsoft 365 tenant. That is the whole scope of network security in one paragraph.

The other half is the network security protocols running in your office right now. Multifactor authentication on email and cloud accounts. Full disk encryption on laptops. Email and DNS filtering. Endpoint detection and response. Automatic patching.

Access control records carry real weight: who has an account, what each person can reach, when access was removed after someone left, and something showing MFA is enforced rather than suggested. Backup and recovery needs a written answer too. Where client records live, how often they are copied, whether a restore has actually been tested, and who holds the encryption keys.

Cloud configuration counts as well. Secure Microsoft 365 defaults, including auditing enabled, external auto-forwarding blocked and legacy authentication turned off, are worth writing down before anyone asks.

Network Security Testing: Prove You Check, Not Just Claim

Policy says what you intend. Testing proves you check. That is the evidence layer, and it is made of dated artifacts: vulnerability scans, patch compliance reports, phishing simulation results, and a note on when each control was last verified.

A calendar beats a one-time cleanup. Weekly patch and backup reports, monthly access reviews, quarterly phishing tests, and an annual review of the whole program give you a steady paper trail instead of one heroic weekend. Those cadences are practice, not rule text, but a rhythm is what examiners can follow.

Keep the artifacts, not the screenshots. A dashboard image ages badly. A dated report exported to PDF and filed by quarter holds up two exam cycles later.

When testing finds something, write down the fix. A finding with an owner, a remedy, and a completion date reads as a working program. A clean scan with no notes reads as luck.

Include the boring tests, too: recovering MFA after someone loses a phone, restoring a mailbox, running a phone-based social engineering attempt, and confirming staff know who to call at 9 p.m. on a Friday. Failures you found and fixed are more persuasive than a report that shows nothing.

Physical Safeguards: The Short List Small Offices Skip

Your scans and patch reports cover the digital side. Examiners also want the physical layer, and that is usually where a small Portland office has the least to show.

• Server rooms and closets: a real lock, key or badge control, and a dated list of who can enter after hours.

• Paper: clean desk expectations, locked drawers for anything client-facing, and a documented shredding arrangement instead of a bin in the hallway.

• Devices: full disk encryption, screen lock timers, and a written answer for a laptop or phone lost, stolen, or left in a car overnight.

• Visitors: a log, plus a stated rule for where contractors, cleaners, and delivery drivers may go relative to customer information.

None of it is high-tech. All of it is producible on request. Next comes the part with a clock attached: the 30-day customer notice workflow.

The 30-Day Customer Notice Workflow, Start to Finish

Physical safeguards keep the wrong people out of the room. The next question is what happens when something gets past them, and how fast you move.

Detection is the first problem. That means email filtering alerts, endpoint detection and response alerts, and a clear path for an employee to report a strange message. Nights and weekends are where a lean office usually has a gap.

Assessment needs a short written decision tree: did the event touch customer information, and does it trigger notice? Loop in counsel early and log the timestamp of every call and decision.

Notification needs four things ready in advance: a letter template, a current customer contact list, a delivery method you can prove, and a named person to handle follow-up calls.

Rehearse it. The SEC ran a small-firm tabletop session in January 2026 specifically to show how this plays out, a strong signal that a plan sitting in a drawer is not the same as a plan that works.

Service-Provider Oversight: Records That Show You Watch Your Vendors

The 30-day clock is your problem, but so is the vendor who triggers it. That oversight has to be documented. Start with an inventory: every IT provider, cloud host, custodian, CRM, payroll system and shredding service that touches customer information. One spreadsheet, one row each.

For each vendor, keep due diligence proof: a security description from them, a signed agreement covering confidentiality and breach notification, and a pointer to which contract section holds those terms. A note like "see master services agreement, section 7" is fine. Knowing where to look beats hunting later.

Oversight has to be ongoing, not a one-time check. File annual review notes, third-party security assessments or audit reports you actually read (SOC 2 is a common format, though not the only one), and a short line on what you did with any findings. A report nobody opened proves nothing.

Offboarding needs writing too: what happens to your data when a vendor relationship ends, who confirms it was returned or destroyed, and when.

One habit covers most of this: if you use a managed IT provider, ask for their answers to a security questionnaire every year and file the response.

How a Managed IT Engagement Produces These Records For You

That vendor questionnaire habit gets easier when someone else keeps the receipts. That folder is easier to maintain when one provider feeds it. For the small Portland and SW Washington firms we support, that usually means remote monitoring and management for patch and device records, email defense for filtering and phishing simulation data, endpoint detection and response for alert and response history, and Microsoft 365 administration for access and configuration records.

Ask your IT provider for a yearly compliance packet: the current network security policy, the network security protocols in place, quarterly network security testing results, asset and access reviews, and security documentation from your other vendors. Firms without internal IT get the most leverage here. One relationship to call, one place records come from, and a provider who has walked other small offices through the same conversation.

One honest caveat. These are the records a firm should expect to be asked for. Your specific obligations are a legal question, and that conversation belongs with your counsel.

Your Next Steps Before the Next Exam Cycle

Here's the honest part: none of this works if it only lives in theory. Four moves, and you're ready for whatever the document request looks like.

Read your policies cold. Hand them to someone who doesn't work in your office. If they can't tell who owns security, what systems are covered, and how often the policy gets reviewed, that's your first fix.

Vendor inventory: confirm a security description and signed contract terms are on file for every provider that touches client data.

Time a breach. Walk one scenario end to end, all the way to customer notice. If you can't reach everyone inside 30 days, the workflow needs work, not a new document.

Build the folder. Ask your IT provider for the annual compliance packet and save it where you could hand it over in a single day. That's the difference between a stressful request and a routine one.

Do those four, and the next exam cycle gets a lot quieter.

Conclusion

Reg S-P is now in force, and that means your firm needs to show proof, not just intentions. The rules touch everything from written policies to network security testing and vendor oversight. For many Portland RIAs, the hardest part is simply pulling all those records together in one place.

That is where a managed IT partner earns its keep. One call gets you the annual compliance packet, testing results, and vendor documentation you need.

Start with those four steps, read, inventory, rehearse, and file. The next exam cycle will be a lot quieter.