Cybersecurity Awareness Month wraps up this week. The phishing simulations have run, the reminder emails have gone out, and the posters will come down soon.
One of the most practical pieces of advice circulating this October was also the simplest: close the month by writing down what changed, so next October starts from a baseline instead of from scratch. For most organizations, that's a good habit. For financial services firms, it's a regulatory expectation.
The SEC's 2024 amendments to Regulation S-P have now reached every covered firm. Larger entities had to comply by December 3, 2025, and smaller entities, including advisers with less than $1.5 billion in assets under management, had to comply by June 3, 2026.
The amendments require covered institutions to:
The SEC's Division of Examinations has named Reg S-P compliance a priority for fiscal year 2026. For firms that just crossed the June deadline, the first exam conversations are coming.
Here's where many firms get caught. A polished written incident response program doesn't help much if a key vendor contract is missing the 72-hour notification requirement. On paper, the policy is in place. In practice, the firm is out of compliance.
The same goes for outsourcing. Firms that rely on outside IT support remain responsible for their own response procedures. Delegating the work doesn't delegate the accountability.
And regulators don't grade intentions. They look for evidence: policy updates, vendor reviews, training records, tabletop exercises, and incident documentation. If it isn't written down, it's hard to prove it happened.
Security awareness training is valuable, and it belongs in every program. But it's one control among many. Reg S-P, like most modern frameworks, asks firms to show they can detect incidents, respond to them, recover from them, manage third-party risk, and document the whole process continuously.
A once-a-year push can't do that. A month of awareness is a starting point. Compliance is what you do the other eleven months.
Firms that handle exams well tend to run compliance as an operating rhythm rather than a scramble. A few elements make the difference.
Map your obligations to one framework. Most financial firms answer to more than one set of rules, such as Reg S-P, the GLBA Safeguards Rule, and NYDFS Part 500 where applicable. Mapping them to a single control framework, such as NIST CSF 2.0, avoids duplicate work and gaps between requirements.
Assign owners, not just policies. Every control needs a named person responsible for it, with backup coverage. "IT handles that" isn't an owner.
Test the incident response plan on a schedule. Quarterly tabletop exercises reveal gaps in escalation paths, notification timelines, and vendor coordination while the stakes are low.
Review vendors continuously. Contracts, security attestations, and notification terms should be checked on a set cadence, not only during onboarding.
Keep the evidence as you go. Documentation built during the year is far easier to produce than documentation reconstructed the week before an exam.
The details differ by sector, but the pattern doesn't. Healthcare organizations face it with HIPAA. Defense manufacturers face it with CMMC. State and local agencies face it with CJIS and state-level requirements. In every case, regulators and auditors are moving from "do you have a policy?" to "show us it works."
Tec-Refresh's managed risk and compliance services turn requirements into an ongoing program. We help maintain policies and procedures, monitor controls, facilitate incident response tabletop exercises, run vendor risk reviews, and keep audit-ready evidence organized throughout the year, so your team isn't rebuilding the program before every exam.
If you're not sure which framework should anchor your program, a Custom Framework Assessment maps your obligations and current controls into a clear starting point.
Awareness Month is a useful reminder. But regulators, customers, and attackers don't operate on a one-month calendar.
Write down what changed this October. Then build the program that makes sure next October starts further ahead.