SEC's 2025 Cyber Compliance Checklist: What Financial Firms Must Know Before December 3
The SEC's Division of Examinations has released its 2025 priorities, and cybersecurity compliance has never been more critical. With Regulation S-P amendments taking effect December 3, 2025, and heightened scrutiny on AI-enabled threats, financial institutions face a compliance landscape that demands immediate action.
Executive Summary
The Securities and Exchange Commission's Division of Examinations announced its 2025 examination priorities on October 21, 2024, maintaining cybersecurity as a "perennial examination priority" while introducing significant new compliance requirements. As detailed in our comprehensive 2025 compliance guide, the regulatory landscape has become increasingly complex across multiple jurisdictions. The priorities reveal three critical focus areas that every registered investment adviser, broker-dealer, and covered financial institution must address:
- Regulation S-P compliance with staggered deadlines (December 3, 2025 for larger entities, June 3, 2026 for smaller)
- AI-enabled threat detection and identity theft prevention programs
- Emerging technology oversight including automated investment tools and trading algorithms
For the cybersecurity community, this represents the most comprehensive regulatory shift in data protection requirements since Regulation S-P's original adoption in 2000. Public companies must also remain aware of their Form 8-K cybersecurity disclosure obligations that run parallel to these new requirements.
Understanding the New Regulation S-P Requirements
Who's Affected and When
The amended Regulation S-P applies to "covered institutions," including:
- Investment advisers registered with the SEC (larger entities: $1.5B+ AUM)
- Broker-dealers (those with over $500,000 in total capital)
- Investment companies
- Funding portals
- Transfer agents
Critical compliance dates:
- December 3, 2025: Larger entities must be fully compliant
- June 3, 2026: Smaller entities must be fully compliant
Five Mandatory Components
1. Written Incident Response Program
Covered institutions must develop, implement, and maintain written policies and procedures reasonably designed to:
- Detect unauthorized access to or use of customer information
- Respond to security incidents with documented assessment procedures
- Recover from incidents while maintaining business continuity
- Contain the scope and impact of security events
The incident response program must specifically outline procedures for assessing the nature and scope of security incidents, determining which customer information was compromised, and taking steps to contain and mitigate harm.
2. Customer Notification Requirements
Perhaps the most significant operational change: covered institutions must notify affected individuals within 30 days of determining that unauthorized access to "sensitive customer information" occurred or is reasonably likely to have occurred.
Sensitive customer information includes:
- Social Security numbers
- Driver's license numbers
- Passport numbers
- Account numbers combined with security codes or passwords
- Biometric records
Notification must include:
- Description of the incident
- Types of information involved
- Actions taken to protect the information
- Contact information for the institution
- Reminder to remain vigilant for identity theft
Limited exceptions:
- Attorney General determination of national security risk (30-day delay, extendable)
- Law enforcement requests for delay
3. Service Provider Oversight
The amendments impose stringent vendor management requirements. Covered institutions must establish written policies ensuring service providers:
- Implement appropriate safeguards for customer information
- Notify the covered institution within 72 hours of becoming aware of any security incident
- Maintain documented information security controls
This 72-hour notification requirement represents a critical operational change. Organizations must immediately:
- Review all existing service provider contracts
- Amend agreements to include 72-hour breach notification clauses
- Establish vendor risk assessment programs
- Implement ongoing monitoring protocols
For contracts not up for renewal, institutions should document requirements through email confirmation or side letters to ensure compliance.
4. Enhanced Recordkeeping
Organizations must maintain written records documenting:
- Incident response program policies and procedures
- Security incident investigations and determinations
- Customer notifications sent
- Service provider oversight documentation
- Compliance with safeguards and disposal rules
All records must be kept for five years, with the first two years in an easily accessible location.
5. Expanded Safeguards and Disposal Rules
The amendments broaden the definition of "customer information" from narrowly defined account data to include:
"Any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form."
This significantly expands the scope of data subject to protection requirements.
AI-Enabled Malware and Identity Theft Prevention
The Emerging Threat Landscape
The SEC's 2025 priorities specifically call out artificial intelligence as both an operational tool and a threat vector. Recent threat intelligence reveals alarming trends:
AI-Generated Polymorphic Malware: Advanced malware strains now generate unique versions of themselves every 15 seconds during attacks, with polymorphic tactics present in an estimated 76.4% of all phishing campaigns in 2025.
Deepfake-Enabled Fraud: Financial services firms are experiencing surges in deepfake attempts to bypass KYC (Know Your Customer) checks, enabling anonymous money laundering through falsified credentials. CEO fraud has become increasingly difficult to detect as attackers use deepfake audio or video to impersonate senior leaders in real-time meetings.
Autonomous AI Cyberattacks: Research conducted by Carnegie Mellon University and Anthropic in 2025 demonstrated that large language models can autonomously plan and carry out sophisticated cyberattacks without human intervention, replicating attacks like the 2017 Equifax breach by exploiting vulnerabilities, installing malware, and stealing data.
Breached Company
