Incident Response and Exam Evidence for Financial Firms

The program the rule requires

The 2024 Regulation S-P amendments (Release 34-100155) require covered institutions’ safeguards policies to include a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. It must include procedures to:

• assess the nature and scope of an incident and identify the customer information and systems involved;
• contain and control the incident to prevent further unauthorized access or use; and
• notify affected individuals, on the 30-day clock described in Regulation S-P.

Most firms have the containment half. The assessment and notification halves are where programs are thin, and they are the halves with deadlines attached.

Assessment is a logging decision made months earlier

The assessment step asks a question the firm answers with data it either kept or did not: whose information was reached?

That is why log retention is the highest-leverage decision in incident response. Intrusions are routinely discovered long after they start. If identity and email logs retain 30 days and the incident is discovered in week six, the firm cannot demonstrate what was accessed. It then faces a choice between notifying a population far larger than necessary and asserting a narrow scope it cannot evidence. Neither is good, and both were determined by a retention setting nobody revisited.

The logs that matter most for scoping, in order:

1. Identity provider sign-in and audit logs — who authenticated, from where, what changed.
2. Email access and message trace — what was read, forwarded, or exported, and any forwarding rules created.
3. File and data access logs — what was opened or downloaded, by which account.
4. Endpoint telemetry — process execution and network connections on affected machines.
5. Remote access and VPN logs — sessions, durations, source addresses.

Verify retention by searching for an event near the far end of the window. A configured setting is not the same as a searchable history, particularly where a platform tiers older data into an archive that the investigation tool cannot query.

Containment that does not destroy the evidence

There is a real tension here. The instinct under pressure is to wipe and rebuild, which is fast, clean, and destroys the record needed to narrow the notification population.

The runbook should say, before the rebuild: capture an image or snapshot, export the relevant logs to somewhere the incident cannot reach, and record the timeline as it happens rather than reconstructing it later. Preserving evidence is not a legal nicety; it is what lets the firm notify fifty people instead of five thousand.

Name the notification decision-maker

The most common structural gap in an incident response plan is a detailed containment section followed by a notification section that says notice will be provided as required.

The program should state:

• Who determines whether unauthorized access to customer information occurred or is reasonably likely to have occurred — by role, with a named backup.
• When the clock is treated as started, and where that determination is recorded. This is the single most important entry in the incident record.
• Who approves the notice content, and which counsel is engaged.
• How notice is delivered if firm email is unavailable or untrusted.
• What the record contains afterwards: the scope determination, the approval, a copy of what was sent, and the delivery evidence.

Vendor-originated incidents

A meaningful share of incidents begin at a service provider, and they behave differently: the firm has no logs, no access, and no control over the investigation’s pace.

What has to already exist:

• The 72-hour notification clause and a monitored address for it — see vendor oversight.
• A record of what customer information that vendor holds, so the firm can begin assessment from its own register while waiting for the vendor’s findings.
• An understanding that the firm’s own 30-day clock runs from the firm’s awareness. Waiting for the vendor’s final report is not a reason the clock pauses.

The standing exam evidence file

Examiners follow paper, and the difference between a firm that keeps a current file and one that assembles it after the request letter is visible in the quality of what arrives.

A standing file, refreshed quarterly rather than built on demand:

Two properties make this file persuasive. Everything is dated, and everything shows recurrence — the second-most-recent version exists too, which is what distinguishes a program from a one-off effort.

Write up the incidents that did not matter

Firms tend to document only incidents that caused harm. That is backwards for evidentiary purposes. A log showing eleven contained events over two years, each with a short review, is direct evidence that detection and response operate. An empty incident log means either nothing happened or nothing was noticed, and an examiner cannot tell which — so the safer inference is the unfavourable one.

Related sections

Regulation S-P for the notification clocks, vendor oversight for third-party incidents, access control and MFA for the logs this section depends on, and monitor and review for the aggregated checklist.

Pylon’s service view is on Regulation S-P compliance and SEC & FINRA compliance.

Primary sources

• SEC Release 34-100155 — Regulation S-P amendments, incident response program (2024)
• 17 CFR 248.30 — Safeguards and Disposal Rules
• FINRA Rule 4370 — Business Continuity Plans and Emergency Contact Information
• SEC Division of Examinations