The first hours of an incident at a small firm usually go like this. Someone notices something wrong, the firm calls its insurer's hotline, a breach attorney joins the call, and a forensics firm the firm has never worked with is engaged through the attorney. From then on, much of what happens is shaped by people outside the firm, and one of the things they shape is what gets written down.
For an adviser registered with the SEC, what gets written down is no longer a matter of preference. The operating decision is to settle, before an incident, what the firm will record, who will record it, and how that record will coexist with the advice counsel will give. I went looking for evidence on how that advice works in practice, and found a study built from the people who give it.
Source
What the rule now requires
The SEC adopted amendments to Regulation S-P on May 16, 2024. They cover, among others, investment advisers registered with the Commission (final rule, page 1). A covered firm must keep a written incident response program to detect, respond to, and recover from unauthorized access to customer information. It must notify affected individuals as soon as practicable, and no later than 30 days after becoming aware of an incident (page 7). Notification is presumed unless, after a reasonable investigation, the firm determines the information has not been and is not reasonably likely to be used in a way that causes substantial harm or inconvenience (pages 24 and 25). Service providers must be required to notify the firm within 72 hours of becoming aware of a breach (page 12).
The records requirement is the part that matters here. The firm must keep written documentation of any detected unauthorized access, of the response and recovery, and of any investigation and determination about whether to notify (page 124). A registered adviser keeps these records for five years, the first two in an easily accessible place (pages 122 and 123). Advisers with $1.5 billion or more under management count as larger entities (page 130). Law firms report the compliance dates as December 3, 2025 for larger advisers and June 3, 2026 for smaller ones, so both are now in force.
Scope matters for a venture firm. Private funds relying on section 3(c)(1) or 3(c)(7) are not themselves covered (page 123), and many venture advisers rely on an exemption from registration. Such an adviser falls outside Regulation S-P, though it may face similar privacy rules from the Federal Trade Commission, according to a Holland & Knight summary. Counsel should confirm which applies to the firm.
Source
What the study measured
Daniel Woods (University of Edinburgh), Rainer Böhme (University of Innsbruck), Josephine Wolff (Tufts University), and Daniel Schwarcz (University of Minnesota) published "Lessons Lost: Incident Response in the Age of Cyber Insurance and Breach Attorneys" in the Proceedings of the 32nd USENIX Security Symposium (pages 2259 to 2273, 2023), a peer-reviewed venue. The full paper is open access.
The authors interviewed 69 people: 20 incident responders, 16 people from insurance, 28 lawyers, and 5 others, including regulators (page 2261, Table 1). Their sample covered employees of 70 percent of the law firms and 65 percent of the response firms with more than two insurer relationships. They mapped insurers' approved-provider lists: in October 2020, 24 insurers listed 480 partner response firms, 151 of them unique (page 2261). They tested their account in a public workshop and by written summaries sent to lawyers (pages 2261 and 2262).
Source
What it found
Insurance routes the response. A policyholder that detects an incident calls the insurer's hotline, typically run by a law firm, which recommends response firms from a pre-approved panel (page 2262). A firm that wants its own responder generally has to add it to the policy when buying (page 2262). Panel firms commit to prices in advance, often below market; a discount of 30 percent was typical in the sample (page 2262).
A few law firms sit at the center. Four law firms held 38 percent of the relationships with insurers while making up 6 percent of the law firms, and the largest had a relationship with 80 percent of the insurers the authors identified (page 2263). Insurers mostly monitor response quality through lawyers and rely on verbal reports (pages 2262 and 2263).
Lawyers direct the investigation to protect confidentiality. All the breach attorneys interviewed took part in contracting with the forensics firm, typically stating that the work was for the purpose of legal advice. Where the forensics firm already provided monitoring, that contract was usually ended and a new statement of work drafted (page 2264). Responders learned to avoid commenting in writing on a client's security, such as missing multifactor authentication (page 2264).
Written reports are becoming rare. Attorneys generally discouraged sending preliminary findings by email. One said that before a court ruling in the Capital One breach case, about 75 percent of his matters had written reports, and now more than 75 percent do not. A responder put formal report requests at under 5 percent of cases (page 2265). Most lawyers preferred to deliver recommendations orally or in slides, and one of the largest U.S. cyber insurers saw a forensics report in fewer than 5 percent of claims (page 2265).
The benefits are real too. The authors conclude that insurers coordinating the response is most useful for under-resourced firms without a plan, and that cyber insurance appears to have improved response planning (page 2267). Lawyers also advise on notification requirements (page 2267). The authors' concern is learning: the practices they found make it harder for firms to learn from their own incidents, and for anyone else to (pages 2267 and 2269).
Synthesis
What the study does not tell a firm
It describes practice, not outcomes. The authors present effects on security outcomes only as participants' perspectives, and say they could not isolate causal effects (page 2268). The study does not show that lawyer-led responses end worse.
It is American and broad. It describes the U.S. insurance ecosystem generally (page 2268), not investment advisers, and it predates the Regulation S-P amendments.
It is not legal advice, and neither is this. Whether a given document is protected is a question for the firm's counsel.
Synthesis
What that means for a registered adviser
The default advice and the rule now pull in different directions. Counsel's instinct, as the study describes it, is to put little in writing. Regulation S-P requires written documentation of the incident, the response, and the notification decision. Both can be satisfied, but not by improvising during an incident. The firm and its counsel should agree in advance on what the required records contain and who writes them.
Describe this figure
A vertical timeline of one incident at an SEC-registered adviser, from before it happens to the end of the record's retention; spacing is by event, not to scale. Before an incident, two things the firm settles: the firm and its counsel agree in advance what the required records contain and who writes them, rather than improvising during an incident; and vendor contracts carry the 72-hour breach clause, so service providers must notify the firm within 72 hours of becoming aware of a breach. Detection: someone notices something wrong, the firm calls its insurer's hotline, and a breach attorney joins the call. Investigation: lawyers direct the investigation to protect confidentiality, and the study finds formal written reports are becoming rare. Notice: the notification decision, with affected individuals notified no later than 30 days after becoming aware. The record, the one highlighted element: the written record Regulation S-P requires, of what was detected, when, what was done, and the determination about notice. Retention: the record is kept for five years, the first two in an easily accessible place.
Keep two records, and know which is which. One is the compliance record the rule requires: what was detected, when, what was done, and the determination about notice with its reasons. The other is the investigation and its lessons, which counsel may want to keep under privilege. Keeping the compliance record factual and separate is a question to settle with counsel, not a rule I can supply.
Decide the responder before the incident. The hotline's panel is a reasonable default for a small firm without its own responder, and the study found it improves planning for exactly those firms. If the firm wants a responder that already knows its systems, that choice generally has to be made when the policy is bought.
Keep the lessons somewhere. If the forensics firm will not write recommendations down, someone at the firm must: which control failed, what will change, by when. That list is the firm's own operating record, and without it the firm pays for an incident and learns little.
Carry the 72 hours into contracts. Service providers must be required to notify the firm of a breach within 72 hours. The firm's administrator, IT provider, and portal vendors each need that clause, and someone needs to own the mailbox it arrives in.
Proposal
How I would prepare
Hold one working session with counsel and the insurer's terms in hand. Agree on four things: who is called first and in what order; which records the firm keeps itself to meet Regulation S-P, and in what form; how findings and recommendations will reach the firm if no report is written; and whether the firm wants its own responder named on the policy. Write the answers into the incident response program, which I treat in the first decisions in an incident response.
Then rehearse it. A tabletop exercise that runs from the first alert to the 30-day notice decision will show whether the records can actually be produced, and by whom.
Proposal
What I would test next
I would run the tabletop with counsel on the call. The test is simple: at the end, can the firm produce the written record the rule requires, and a list of what it will change, without either one exposing more than counsel is comfortable with? If not, the plan is not finished.
Open question
Will examiners change the practice?
The study found regulators largely resigned to not seeing reports (page 2265). Regulation S-P gives examiners a specific written record to ask for. I do not know whether that will push lawyers toward fuller documentation for advisers, or simply toward thinner compliance records. The first exam cycles after June 2026 should show which.