FINRA and SEC IT Controls for Small Financial Firms in Maryland

Small broker-dealers and registered investment advisers have always had cybersecurity obligations, but until recently they were mostly principles: safeguard customer information, supervise your systems, have a continuity plan. The amendments to Regulation S-P changed that. Every SEC-registered adviser and broker-dealer, including the smallest, is now required to have a written incident response program, to oversee service providers, and to notify affected customers within 30 days of an incident. The compliance date for smaller firms was June 3, 2026, and SEC examinations are already covering it. This article sets out the rules that apply to a small firm in Maryland and the IT controls that satisfy them.

The rules that apply

The overlap between the SEC’s 30-day clock, Maryland’s 45-day clock, and a service provider’s 72-hour and 10-day duties means a single incident has several deadlines running at once. The incident response program is where they are reconciled; see Maryland PIPA explained for the state side.

What examiners are looking for

SEC and FINRA examiners do not grade on technology sophistication. They ask whether the written program exists, whether it matches what the firm actually does, and whether the firm can produce evidence. For a small firm the questions come down to:

• Is there a written incident response program, and has it been tested?
• Can the firm show how it would detect unauthorized access to customer information, not just respond to a report of it?
• Does the firm know which service providers hold customer information, and do the contracts require 72-hour breach notice?
• Is there a process to assess whether an incident requires customer notice, and to send it within 30 days?
• Are access controls, MFA, and encryption documented, not just assumed?
• Is the business continuity plan current, and does it reflect how the firm actually works, including remote staff?
• Are records kept: policies, incident logs, vendor reviews, training?

The IT controls that satisfy them

• Detection you can show. Endpoint detection and response on every device, 24/7 security operations monitoring, and audit logging on email and the systems that hold customer data. The incident response program is unworkable if no one would notice the incident.
• Multi-factor authentication on email, remote access, the CRM, the custodian and clearing portals, and every administrative account.
• Encryption on all devices and in transit, with the ability to wipe a lost laptop remotely.
• Email security with impersonation protection, and a verified call-back rule for any instruction that moves client money. Fraudulent wire requests from compromised client email accounts remain the most common loss event for advisers.
• Vendor inventory and contracts. A list of every provider holding customer information (custodian, CRM, portfolio software, email, IT provider) with the 72-hour notice term in each agreement.
• Backups and continuity. Immutable backups, a tested restore, and a continuity plan that names where staff work and how clients reach you when the office is unavailable.
• Disposal. Retention periods and secure destruction for paper and drives.
• Documentation and training records. The policies, the test of the incident plan, the annual review of the continuity plan, and completion records for staff training.

A note on scale

The amended rules deliberately do not exempt small firms; they gave them a later compliance date. A three-person advisory practice has the same obligation to have a tested incident response program as a national firm. The practical difference is that the small firm cannot staff it, which is why most outsource the detection, monitoring, and evidence production to a managed provider and keep the compliance decisions with the chief compliance officer and counsel.

How Corporate Technologies works with financial firms in Maryland

We support advisers and broker-dealers across Maryland and the DC area from our Frederick office, with a 24/7 help desk and security operations center shared across our 21 locations. Our Secure Advantage package provides the detection, monitoring, MFA, email protection, and training the rules assume, and we supply the evidence your CCO needs for the written program and the examiner. We implement controls; the compliance program itself and the notification decisions belong with your CCO and counsel. Cyber insurers ask for the same controls: see cyber insurance IT requirements in Maryland.

This article is general information, not legal or compliance advice.

Frequently asked questions

We are a state-registered adviser, not SEC-registered. Does Regulation S-P apply?

The SEC’s amended rule applies to SEC-registered firms. State-registered advisers fall under the FTC’s Safeguards Rule and state requirements, which call for substantially similar controls. Check with your compliance counsel for your specific registration.

What counts as “sensitive customer information” for the 30-day notice?

Information whose compromise could create a reasonably likely risk of substantial harm or inconvenience: Social Security numbers, account numbers, biometric records, credentials, and similar. Names and addresses alone generally do not trigger it.

Does our custodian’s security cover us?

No. The custodian is a service provider you must oversee. Their controls protect their systems; your obligation covers your email, your CRM, your laptops, and your staff, which is where most adviser incidents start.

How do we test an incident response program?

A tabletop exercise once a year: walk through a realistic scenario (a compromised email account with client data) and confirm who does what, in what order, against the 72-hour, 30-day, and 45-day clocks. Document it. Examiners ask for the record.