Decoding the SEC Cybersecurity Document Request: What Examiners Hunt For First

When EXAMS opens an exam, its initial information request typically gives advisers about two weeks to produce documented evidence of their compliance program, cybersecurity governance included. The SEC’s new Exam Handbook says the staff usually provides two weeks and will grant reasonable extensions or rolling productions where appropriate. Firms with organized, time-stamped records meet that window without much friction. Firms relying on institutional memory or an untouched policy binder tend to struggle.

If your firm hasn’t yet built out a Reg S-P-compliant program, start with our step-by-step guide to the SEC’s cybersecurity rules. This piece picks up from there — what examiners actually test once the paperwork exists.

• EXAMS Audits Execution, Not Intent: Generic, untailored policies are a common source of deficiency findings. The SEC’s own Reg S-ID Risk Alert, for example, flagged programs built from unfinished templates.
• Amended Regulation S-P Demands Proof: The SEC’s 2024 amendments require a written incident response program, oversight of service providers (including due diligence and monitoring), and written records documenting compliance. Near-miss tracking isn’t a stated requirement, but it’s a practical way to show your program detects and responds. Compliance dates were December 3, 2025 for larger advisers and June 3, 2026 for smaller advisers.
• Outsourced Execution Is Not Outsourced Responsibility: Relying on a Managed Service Provider (MSP) doesn’t shift your oversight obligation. It requires documented, ongoing oversight.

Rule 206(4)-7

Examiners look beyond a Written Information Security Program (WISP) manual to evaluate the active compliance lifecycle. Rule 206(4)-7 requires every SEC-registered adviser to review the adequacy of its policies and procedures, and the effectiveness of their implementation, at least annually. A policy dated two years ago with no documented reviews is likely to draw scrutiny.

• The Gap: Treating the annual review as an unrecorded reading exercise.
• The Fix: Maintain a dated review memo, board minutes, or a compliance log with substantiation detailing specific policy updates made during the examination period.

Delegating IT administration to an MSP doesn’t relieve an adviser of its own responsibility under Regulation S-P. The 2024 amendments require written policies and procedures for oversight of service providers, including due diligence and monitoring. The compliance dates were December 3, 2025 for larger advisers (generally those with $1.5 billion or more in assets under management) and June 3, 2026 for smaller advisers. Both are now in effect.

• The Gap: Lacking a detailed inventory of external entities with system or customer data access.
• The Fix: Maintain a centralized vendor directory detailing initial due diligence, access privileges, contractual protections, executed Service Level Agreements (SLAs), and annual due-diligence continued evaluation.