No SEC rule makes an investment adviser report a cybersecurity incident to the Commission or disclose one in a public filing. That rule was proposed in 2022 and withdrawn on June 17, 2025.
What your firm still owes is real, though. Client notice under Regulation S-P. A written identity theft program under Regulation S-ID. An annual compliance review under Rule 206(4)-7. Three rules that were already on the books while everyone was watching the one that never arrived.
I am writing this because the search results for this question are in poor shape. Some describe a rule that was withdrawn. Others describe a rule that exists but governs public companies. A few describe a form that was never adopted and cannot be filed. If your compliance consultant has mentioned Form ADV-C to you recently, read the next section carefully.
What follows is which SEC rules actually reach a small advisory firm and what each one makes you produce. The operational half, the systems and controls that make any of it true, is the managed IT work underneath, and our page on IT services for financial advisors and RIAs covers that side.
The Rule Everyone Means Was Withdrawn in June 2025
On March 9, 2022 the Commission proposed a cybersecurity package aimed squarely at advisers and funds. It was substantial. New rule 206(4)-9 would have required written cybersecurity policies and procedures. New rule 204-6 would have required advisers to report significant cybersecurity incidents to the Commission on a new confidential form, Form ADV-C. Form ADV Part 2A would have grown a cybersecurity disclosure section. Cyber-specific books and records would have followed.
None of it happened.
The Commission published a Notice of Withdrawal of Proposed Regulatory Actions withdrawing fourteen proposals, the March 2022 cybersecurity proposal among them, effective June 17, 2025. Fourteen at once. The language is not ambiguous. “The Commission does not intend to issue final rules with respect to these proposals. If the Commission decides to pursue future regulatory action in any of these areas, it will issue a new proposed rule.”
Two consequences are worth stating plainly, because they are the ones that get firms into trouble.
Form ADV-C does not exist. It was never adopted. There is no filing to make, no reporting clock to miss, and no penalty for lacking a process for it. If a vendor is selling you a service built around ADV-C reporting, they are selling you a subscription to a proposal. Ask for the citation.
There is no cybersecurity item in Form ADV Part 2A. The item that would have gone there went out with the rest of the package. Your brochure obligations are what they always were, a general duty to disclose material facts rather than a cyber-specific schedule. Nothing replaced it.
What did not change is that withdrawing a proposal removes a rule, not a risk. The Commission still examines cybersecurity. It does that through the rules below rather than through a dedicated one.
One caution on timing before you act on any of this. The 2022 proposal is withdrawn rather than dead in principle, and the Commission said outright that new regulatory action here would arrive as a fresh proposed rule. If that happens it comes with its own comment period and its own compliance dates, and it will not be retroactive. Build for the rules that exist now.
The Four-Day Clock Belongs to Public Companies
The second source of confusion is more forgivable. That rule is real. It is genuinely about cybersecurity disclosure, it is enforced, and it carries the kind of hard filing clock that makes people assume it must apply to every firm the Commission oversees.
On July 26, 2023 the Commission adopted cybersecurity disclosure rules for public companies. Item 1.05 of Form 8-K requires a registrant to disclose any cybersecurity incident it determines to be material, and that filing is “generally due four business days after a registrant determines that a cybersecurity incident is material.” Regulation S-K Item 106 requires a description of the registrant’s risk management processes, plus board oversight and management’s role, in the annual report on Form 10-K.
Read the subject of those sentences. Registrant. A company with securities registered under the Exchange Act, filing 8-Ks and 10-Ks. An SEC-registered investment adviser is registered under the Advisers Act, a different registration for a different purpose, and it files Form ADV rather than Form 10-K.
So the four-business-day clock is not yours. Neither is Item 106. If your firm is a privately held advisory practice in Rockland, Westchester, or Bergen, you will never file an Item 1.05 8-K, and an article telling you otherwise was written about somebody else. Different rule, different reader.
What Is Left, and Who You Have to Tell
Strip out the withdrawn proposal and the public-company rule and three obligations remain. None are new. The oldest has been on the books since 2003. Four, counting state law.
| Rule | What it makes you produce | Who hears about it, and when |
|---|---|---|
| Regulation S-P, 17 CFR 248.30 | A written incident response program, plus oversight policies for every vendor touching customer information | Affected individuals, not later than 30 days. Your vendors owe you notice inside 72 hours. |
| Regulation S-ID, 17 CFR 248.201 | A written Identity Theft Prevention Program, approved and administered, with staff trained on it | Nobody, on a schedule. This one gets examined, not filed. |
| Rule 206(4)-7, 17 CFR 275.206(4)-7 | Written compliance policies, a designated chief compliance officer, and a documented annual review | Nobody, on a schedule. The review itself is the artifact. |
| State breach notification law | Notice to residents whose personal information was exposed, plus notice to state regulators | Varies by state, and it runs independently of anything the SEC requires. |
Look at the third column. Only one of these produces a notification, and it goes to your clients rather than to a regulator. Everything else in that table is a document that sits in a drawer until somebody asks for it.
Which is the real shape of SEC cybersecurity compliance at your size. Not reporting. Evidence. A firm that can hand an examiner its covered account determination, the signed approval page of its identity theft program, a training roster with dates on it, its vendor oversight questionnaires, and last year’s annual review conclusion has answered the cybersecurity question before anybody thought to ask it.
The Regulation S-P side has its own timeline, and it moved recently enough that plenty of firms have not caught up. Smaller entities, meaning registered advisers under $1.5 billion in assets under management, had until June 3, 2026. That date has passed. State-registered advisers fall under the FTC Safeguards Rule instead, which we walked through separately in our Safeguards Rule checklist for small RIAs.
The Identity Theft Program You Probably Do Not Have
Regulation S-ID is the one I raise on first calls and get a blank look for. It has been in force since 2013 and it is the least discussed rule in this area, which is strange, because its scope paragraph is unusually direct about who it covers. Read it once.
17 CFR 248.201(a) applies the rule to, among others, “an investment adviser that is registered or required to be registered under the Investment Advisers Act of 1940.” No revenue threshold. No headcount test. And the definition of an account states that it “includes a brokerage account, a mutual fund account, and an investment advisory account.”
So the threshold question is not whether the rule reaches advisers. It is whether you hold covered accounts, which the rule makes you determine periodically through a risk assessment weighing how accounts get opened, how they get accessed, and your own history with identity theft. Between the advisory account itself, the client portal login, the email address that receives statements, and the phone number a caller can authenticate against, a small practice usually presents four separate identity theft surfaces, and that is before anyone opens a new account. Most advisory firms that let a client move money hold covered accounts. Run the assessment and write down the answer either way, because “we looked and concluded no” is a defensible position and “we never looked” is not.
If you do hold them, the program carries four required elements and four administrative duties. The elements are to identify relevant red flags, detect them, respond appropriately, and update the program periodically. Administration is where small firms stumble.
- The initial written program needs approval from the board or an appropriate board committee.
- No board? The rule already thought of that. It defines the term to include, for a firm without one, “a designated employee at the level of senior management.” A two-partner practice names a partner and moves on.
- Staff have to be trained on it. Not emailed it.
- And you must exercise appropriate and effective oversight of service provider arrangements, which is the same obligation Regulation S-P imposes from a different direction. Your vendor list is doing double duty.
That last one deserves a moment. Two separate SEC rules now require you to oversee the vendors who touch client data, and neither cares that your provider is small, local, or someone you have used for eleven years. Oversight means documented oversight.
206(4)-7 Is the Hook for All of It
Here is why the withdrawal changed less than the headlines suggested.
Rule 206(4)-7 makes it unlawful to provide investment advice unless you adopt written policies and procedures reasonably designed to prevent violation of the Advisers Act, review their adequacy and effectiveness at least annually, and designate a chief compliance officer to administer them.
Read that first clause again. Policies reasonably designed to prevent violation of the Act and the rules under it. Regulation S-P is a rule under the Act. So is Regulation S-ID. A cybersecurity failure producing a Regulation S-P violation is therefore also a 206(4)-7 problem, because your compliance program was supposed to be designed to prevent it.
That is the hook. The Commission never needed a dedicated cybersecurity rule to examine your cybersecurity, and the annual review is where it surfaces. If your last annual review does not mention access controls, vendor oversight, or incident response anywhere in it, the gap is not a missed cyber rule. The gap is in the review. Go read yours.
A small firm can run all of this honestly without hiring anybody. What it cannot do is run it without writing anything down. Where nobody internally owns the technical half, that is the gap a virtual CISO arrangement is built to close, and a documented risk assessment is usually the cheapest first artifact to produce.
VJNetworks has worked in the Tri-State area for over 20 years, with a 97% client retention rate, and the pattern in advisory firms is consistent. The policies are usually fine. Nearly every time. Evidence that the policies are true is what nobody has. When something breaks, someone from my team responds within 15 minutes during business hours, and the record of that response is part of what makes an annual review defensible.
Questions That Come With a Wrong Answer Attached
Someone told us we need to file Form ADV-C. Do we?
Does the four-business-day reporting clock apply to our firm?
We have no board of directors. Who approves the identity theft program?
Nothing has ever happened to us. Is there anything to disclose?
How much of this can our IT provider own?
Our compliance consultant handles this. Do we need anything else?
We will walk your firm against Regulation S-P, Regulation S-ID, and your last annual review, then show you which rows you can already prove and which ones are blank. No cost, no obligation, and the list is yours either way.