Start a Reg S-P gap and evidence review
Understand the scope, distinguish obligations and document what remains open.
Content and source check: October 1, 2026 · Operational suggestions
Confirm applicability
Record the legal entities and registration status in scope and who reviewed that determination. Leave uncertain scope unresolved until qualified review; the tool does not infer it.
Separate the topics
Baseline safeguards and privacy duties are shown alongside 2024 amendment topics. Customer incident notification is separate from initial or annual privacy notices.
Record evidence and gaps
Answer each question with a rationale and an evidence reference. Mark unknowns honestly. The questions are an initial planning aid, not an exhaustive legal checklist or compliance score.
Review the conclusions
Have a qualified reviewer evaluate applicability, interpretations and remaining gaps against the actual rule. Source checking is not professional regulatory approval. Download the project or explicitly import it into a firm workspace for action and evidence management.
Source & applicability
SEC-SP-2024 — Regulation S-P amendments, release 34-100155 and correction 34-100155A
Source for safeguards, incident response, service-provider oversight, notification, disposal, records and the annual privacy notice exception. Baseline privacy duties are distinct from incident notification. Applies according to the rule's institution and information scope; this initial worksheet does not determine applicability, calculate incident deadlines or provide an exhaustive legal assessment. Qualified regulatory content review remains pending.
SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.