Get the Reg S-P Builder

For SEC-registered investment advisers and broker-dealers

Your Regulation S-P program in one place: organized, dated and signed

Answer simple questions about your firm. Get written safeguards policies, an incident response program, a 30-day customer notice template and 72-hour letters for your vendors, under the SEC's amended Regulation S-P. Ready to sign.

Get it for $399 See what's included
  • Works offline: client details never leave your computer
  • Print to PDF or edit in Word
  • No subscription: you buy each year's edition
Reg S-P Builder showing open actions and the eight documents it generates
The deadline has passed. Smaller entities had to comply with the amended Regulation S-P by June 3, 2026 (larger ones by December 3, 2025). Advisers with less than $1.5 billion in assets under management are smaller entities. The SEC listed compliance with the amendments as a focus of its fiscal 2026 examinations.

Templates are a start

A sample policy still has to be rewritten for your custodian, your CRM, your vendors and the gaps you actually have, and it does not tell you when a notice is due.

The builder writes it for you

Your answers become policies that name your CCO and your systems, with your providers in the service provider register.

And tells you what to do next

Every vendor without a 72-hour commitment gets a ready-to-send request letter, and the deadline calculator gives you the 30-day notice date during an incident.

Eight documents, one set of answers

Each document cites the part of 17 CFR 248.30 it answers, so an examiner can follow it.

Safeguards and disposal policiesAdministrative, technical and physical safeguards, money-movement verification, disposal, recordkeeping and the annual privacy notice decision (248.30(a) and (b)).
Incident response programAssess, contain, notify: a step-by-step program with roles, decision authority and the 30-day clock (248.30(a)(3)).
Incident recordThe documentation examiners ask for: what happened, what was involved, and the basis for the notification decision.
Customer notice templateEvery element the rule requires in a notice, from the incident description to fraud alerts and the FTC's identity theft guidance (248.30(a)(4)).
Service provider registerWho holds sensitive client information, their risk tier, the 72-hour clause, SOC 2 reports and the next review date (248.30(a)(5)).
72-hour request lettersOne letter for each provider that has not yet committed to notify you within 72 hours of a breach.
Training log and acknowledgmentsWho was trained, when and on what, with a signature page for each person.
Annual review checklistA 13-point Regulation S-P review for your annual compliance review.

Included: the Compliance Binder. An encrypted evidence binder: a tab for each requirement shows what is on file and what is missing, staff training with certificates is filed automatically, and one click exports everything for an examiner. Each person gets their own login. Your access code comes with your download.

See a real sample (PDF)
Sample page of the generated policies showing the safeguards table with gaps highlighted
Sample page, for a fictional firm. Gaps are highlighted in red.

How it works

  1. Download and openUnzip and double-click. It opens in your browser.
  2. Answer 8 short stepsYour firm, your response team, where client information lives, 16 safeguards, providers, people and customer notice details.
  3. Print, sign, keepSave as PDF or Word. Your CCO signs, your staff sign their acknowledgments, and you keep the records as the rule requires.

Reg S-P Builder

$399 2027 edition

  • All eight documents plus the action plan
  • 30-day and 72-hour deadline calculator
  • Unlimited updates of your own documents during 2027
  • Works on Windows and Mac
Buy now · $399

Not sure? See a real sample for a fictional firm (PDF)

Secure checkout by Stripe: card, Apple Pay and more. Your download opens right after payment and your receipt arrives by e-mail. Digital product, all sales final; see the terms.

Consultants and outsourced CCOs can license it under their own brand: see white-label licenses.

Read the rules first

All compliance guides

Questions

Does the amended Regulation S-P apply to my firm?

It applies to SEC-registered investment advisers, broker-dealers, investment companies, funding portals and transfer agents. State-registered advisers are not covered by Regulation S-P, although state rules may ask for similar policies.

Where is my data stored?

Only on your computer. The builder runs in your browser with no internet connection, and your answers stay in a file you save. The Compliance Binder works the same way: your documents are encrypted and kept on that computer, not in an online account. Nothing is sent to us or anyone else.