FTC Safeguards Rule and SEC Regulation S-P: IT Help for Chicago Financial Firms

What each rule asks of your IT, and where CIO Landing helps.

Since 2012, CIO Landing has supported financial firms across Chicagoland. Two federal rules shape how most of them protect client data: the FTC Safeguards Rule and the SEC's Regulation S-P. This page explains, in plain language, what each one asks for on the IT side and what we do to help. It is not legal advice.

Key takeaways

SEC Regulation S-P applies to registered investment advisers, broker-dealers, investment companies and transfer agents. The FTC Safeguards Rule applies to financial institutions the FTC oversees, such as mortgage lenders and brokers, finance companies and tax preparers.
Both rules expect a written incident response plan and set a 30-day window for notifying affected people or the FTC.
We help with the IT side: technical controls, a firm-specific WISP and written incident response plan, client security questionnaires and custodian due diligence, and support for the annual risk assessment.
Your counsel or compliance officer decides which rules apply to you.

Which rule applies to your firm?

Registered investment advisers (RIAs), broker-dealers, investment companies and transfer agents: SEC Regulation S-P. See our page for RIAs and wealth managers.
Mortgage lenders and brokers, finance and lending companies, tax preparation and CPA firms: the FTC Safeguards Rule. Accounting firms can also read our page on IT support for CPA firms.
Insurance firms: state insurance regulators mainly enforce the Gramm-Leach-Bliley Act for insurers, so ask your counsel which requirements apply.
Banks and credit unions follow rules from their own regulators and are not the focus of this page.

Some firms should confirm with counsel which rule, or rules, apply. See our financial services IT page for the full picture.

What SEC Regulation S-P asks for

A written incident response program built to detect, respond to and recover from unauthorized access to customer information, including how to assess the scope of an incident and contain it.
Notice to affected individuals as soon as practicable, and no later than 30 days after you become aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, with limited exceptions.
Oversight of service providers through due diligence and monitoring.
Written records showing that you comply with the safeguards and disposal requirements.

Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026, so both dates have passed. Details: SEC fact sheet on the Regulation S-P amendments.

What the FTC Safeguards Rule asks for

One qualified individual who runs the security program.
A written risk assessment of your customer information.
Access controls, encryption and multi-factor authentication.
Continuous monitoring, or annual penetration testing plus vulnerability scans every six months.
Security awareness training, service provider oversight and a written incident response plan.
An annual written report to your board or senior officer.
Notification to the FTC as soon as possible, and no later than 30 days after discovery, of an incident involving unencrypted information of 500 or more consumers.

Firms that hold information on fewer than 5,000 consumers are exempt from some of these requirements. Details: FTC Safeguards Rule guide and the FTC notification requirement.

Where CIO Landing helps

Technical controls: we configure and manage multi-factor authentication, encryption, logging and monitoring, patching, access control and endpoint protection.
Written plans: we supply a firm-specific Written Information Security Plan (WISP) and a written incident response plan. Your firm designates the person responsible for the program.
Client and custodian requests: we help you answer security questionnaires and custodian due-diligence requests accurately and pull the evidence from your environment. Our guide to passing cybersecurity audits shows what reviewers look for.
Annual risk assessment and security audit: we support the process on the IT side and help you act on what it finds.
Everyday protection: AI-based antivirus with managed detection and response, device encryption, email protection and security awareness training, plus backups kept off-site for 90 days in U.S. data centers with a 24-hour restore target. Monitoring runs 24/7, and the help desk is staffed Monday to Friday, 7am to 7pm CT.

What we do not do

We do not give legal advice, and we do not decide which rules apply to you. This page does not describe penetration testing, board reporting or contract review as part of our service.

How we work with financial firms

Your Client Success Manager is your account manager, your Technology Alignment Manager (TAM) keeps the roadmap aligned with your growth, and a Fractional CIO (vCIO) is available when you need strategic guidance. Our published range is $150 to $225 per user per month; see Pricing and Service Levels. Onboarding takes about one month, and projects are quoted separately. If you already have your own IT staff, see co-managed IT, or read how it works.

Our office is in Northfield, IL, and we meet clients downtown Chicago by appointment. We serve firms within about a two-hour drive of Northfield, from Chicago and the North Shore to the western and south suburbs, Northwest Indiana and Southeast Wisconsin.

Frequently asked questions

Does the FTC Safeguards Rule apply to my firm?

It applies to financial institutions the FTC oversees, such as mortgage lenders and brokers, finance companies and tax preparers. Registered investment advisers and broker-dealers follow SEC Regulation S-P instead. Your counsel or compliance officer decides which rules apply to you.

Does SEC Regulation S-P apply to RIAs?

Yes. The amended rule covers registered investment advisers, broker-dealers, investment companies and transfer agents. Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026.

How fast do I have to notify clients after a breach?

Under Regulation S-P, as soon as practicable and no later than 30 days after you become aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, with limited exceptions.

When do I have to tell the FTC about an incident?

Under the Safeguards Rule, as soon as possible and no later than 30 days after discovery of an incident involving unencrypted information of at least 500 consumers.

Can CIO Landing write our WISP and incident response plan?

Yes. We supply a firm-specific Written Information Security Plan and a written incident response plan. Your firm designates the person responsible for the program.

What technical controls do you manage?

Multi-factor authentication, encryption, logging and monitoring, patching, access control and endpoint protection.

Can you help with custodian due-diligence requests and client security questionnaires?

Yes. We help you answer the IT questions accurately and gather evidence from your environment.

Do you support the annual risk assessment?

Yes, on the IT side. We support the process and help you act on the findings.

Do you give legal advice?

No. Your counsel or compliance officer decides which rules apply to you.

What does it cost?

Our published range is $150 to $225 per user per month. The Pricing page shows what is included and what is billed separately. Projects are quoted separately.

Ready to Stop Worrying About IT?

Book a discovery call today.

Business leaders trust us to simplify their technology decisions. Find out how we can streamline yours in just 30 minutes.