Full analysis selected. Choose Quick brief to read the key points first.
WFN QUICK BRIEF · UNDER 1 MIN
The short version
MODE 2 OF 2
What the primary record establishes
The amended Regulation S-P requires covered firms to maintain written incident-response procedures. Where customer notice is required, it must be given as soon as practicable and generally within 30 days of awareness that unauthorized access or use occurred or was reasonably likely. SEC Regulation S-P amendments ↗SEC final rule 34-100155 ↗
What the distinction changes
A CRM vendor may alert a broker on Monday and deliver a detailed report on Friday. Record what the firm knew on each date. The start of the clock turns on the information available, which may arrive before the investigation is complete.
What to check before drawing a conclusion
The rule addresses individuals whose sensitive information was or was reasonably likely to have been affected and includes limited exceptions. The notice describes the incident, data involved and protective steps. Track the vendor alert, recipient assessment and actual notices separately.
Quick Brief is a reading aid. The full article and source trail stay on this page.
WFN STORY COMPASS
Choose your reading angle
Switch between the reported record, market context and open questions. Status labels distinguish claims from findings.
All context layers are visible. Choose a lens to jump to that part of the story.
Original WFN vector illustrationWFN · 6 November 2026
Editorial noteSource-based explanation with original WFN analysis. Historical records retain their dates; numerical examples are illustrative. The original vector illustration is conceptual and is not documentary evidence.
WFN REALITY LEDGER
What is on the record?
Primary-source explainer
Primary-source explainer
Primary record / reference periodSEC Regulation S-P amendments
The linked source supports the documented record; WFN interpretation and illustrative examples are separate.
01 · VERIFIED RECORD
What the primary record establishes
The amended Regulation S-P requires covered firms to maintain written incident-response procedures. Where customer notice is required, it must be given as soon as practicable and generally within 30 days of awareness that unauthorized access or use occurred or was reasonably likely. SEC Regulation S-P amendments ↗SEC final rule 34-100155 ↗
02 · WFN EDITORIAL ANALYSIS
What the distinction changes
A CRM vendor may alert a broker on Monday and deliver a detailed report on Friday. Record what the firm knew on each date. The start of the clock turns on the information available, which may arrive before the investigation is complete.
03 · REVIEW POINTS
What to check before drawing a conclusion
The rule addresses individuals whose sensitive information was or was reasonably likely to have been affected and includes limited exceptions. The notice describes the incident, data involved and protective steps. Track the vendor alert, recipient assessment and actual notices separately.
