Before an SEC cybersecurity exam, examiners send a letter with a numbered list of documents, and you can find much of this list online today. The SEC’s announcement of its January 22, 2026 outreach event for small firms promised that staff would walk through what to expect from an exam team and “review a sample document request list, and demonstrate a mock examination session.”
They did. The Division’s September 2023 risk alert had already published the version a routine exam uses. The SEC has published sample cybersecurity request lists before, as appendices to its April 2014 and September 2015 examination initiative alerts, and the January 2026 sample is the newest. What is not published is the letter examiners use in a current exam. Those get passed between compliance officers, which is how we came to have two of them, one from 2021 and one from 2026.
Everything on the list comes back to three rules:
- Regulation S-P, which wants written safeguards and an incident response program
- Regulation S-ID, which wants an identity theft program
- Rule 206(4)-7, which wants compliance policies and a yearly look at whether they work
The SEC is not prescriptive about how you do any of that. It wants to see that you did something, and the request list is how it checks. There is no standalone cybersecurity rule for advisers; the one proposed in 2022 was withdrawn in 2025, and our Regulation S-P page covers the topics you should address.
What follows is the list, item by item, with what a seven-person firm hands over for each one. For the wider picture, start with our page on cybersecurity for RIAs.
What does the SEC send before a cybersecurity exam?
A letter, with a document request list attached. The SEC’s September 2023 risk alert says the staff “usually sends an adviser a letter notifying the firm of the upcoming examination, which contains an initial request list.”
The 2021 cybersecurity-focused request letter we have seen gave the firm 15 days, asked for everything in whatever format the firm normally keeps it in, with each file labeled to match the item number on the list, and said that any item that did not apply needed an explanation rather than a blank. It also said follow-up requests might come, and they do.
The interviews come after the examiners have read what you sent, per the January 2026 SEC mock exam slides, and the list of who gets interviewed is the CCO, the CIO or CTO, and “Outsourced Information Technology Staff.”
Exams come in three forms:
- A general exam, where a policy and a little evidence usually covers cybersecurity
- A targeted exam on another topic
- A technology exam, where the letter asks for all the evidence up front
The 2023 alert’s attachment shows what a general letter carries: “Safeguards for the protection of customer records and information. Electronic access controls. Business continuity plan. Cybersecurity incidents or breaches (e.g., incident description, impact, and remediation).”
Most of the exams we’ve seen over the past few years have actually been focused on topics other than cybersecurity, like marketing and best execution. That may be changing, though. Foley Hoag reported in August 2026 that a Reg S-P request letter was circulating in what looks like a sweep. How the Division decides who gets the deeper exam is not clear to us.
Our Regulation S-P page covers what those examiners are asking for. The Division’s fiscal 2027 priorities name what a cybersecurity exam looks at: “governance practices, data loss prevention, access controls, account management, and the response and recovery protocols for cyber-related incidents, including ransomware attacks,” plus the risk from third-party service providers and from automated phishing and deepfake voice and video used for social engineering. The groups below follow that list.
What is on the SEC’s cybersecurity exam document request list?
The items below come from four places. Two are published: the sample request shown at the SEC’s January 2026 small-firm event and the attachment to the Division’s September 2023 risk alert. Two are not: a 2021 cybersecurity-focused request letter we have seen, and, where the slides skip a document, a 2026 request letter we have seen. Under each item, we’ve described what a firm is expected to hand over.
Governance and program documents
- The “Registrant Compliance Manual” and policies addressing “Administrative, Technical, and Physical Safeguards for the Protection of Customer Information.” We usually cover these with our four written policies with revision dates, since the 2021 letter asked when each was updated.
- “Organization Charts” showing who owns cybersecurity, and the information security officer’s name or, if none, where that duty sits. Usually the CCO or a managing partner.
- Cybersecurity minutes and briefing material given to the board, or senior management if there is none. Our answer: executive briefings and the annual risk assessment.
- A record of non-compliance with the cybersecurity policies and of client privacy or security complaints. A dated log, even one with no entries. The same group covers the privacy notice delivered to clients during the period and evidence it was delivered: the notice itself and the mailing or portal record.
Risk assessment and testing
- “Risk Assessments Related to technology/cybersecurity risk, controls, threats, vulnerabilities,” and any review or testing reports. A dated risk assessment signed by an executive. The letter is asking for proof that the review happened, not for a policy that promises one. Two things firms that attended the January 2026 event reported hearing from staff: the NIST Cybersecurity Framework is an acceptable basis for the assessment (but not the only framework that’s appropriate), and examiners want to know where client data lives before they ask about anything else, so a data map belongs with it.
- Penetration test and vulnerability scan policies, with the date of the latest of each. The dated scan report; the FAQ covers penetration tests.
- Patch management policies and a schedule, log, or report of patches applied. We ask the IT firm for a copy of the patch report rather than asking whether they do patch management, and the examiner will do the same.
Incidents and continuity
- The “Incident Response Plan” and policies for detecting, responding to, and recovering from unauthorized access, “including Customer Notification Procedures.” The plan, with Reg S-P notification steps in it, and the 2023 attachment’s “Business continuity plan.”
- The plan’s testing policy and latest test report. Examiners want to see that the plan was exercised, and the after-action summary from a tabletop is that report.
- The incident list, with dates, type, client harm, and remediation, plus documentation that the “Incident Response Program Steps Were Followed for Each Incident.” A write-up per incident, and if there were none, an empty spreadsheet kept in a known location is a fine answer.
- The listing of “persons responsible for incident response activities” and “Reports or supporting documentation that confirms monitoring.” The roster, the IT firm’s tool list, and monthly alerting reports.
Vendors
- The “Information Technology Managed Service Provider Contract” and, per the 2026 letter, the signed agreement with every vendor with access to customer records. The signed agreements must be in one folder.
- Vendor management policies and the vendor list with service, NPI access, and contract status. Most of the inventories we see are missing a few columns examiners expect, including whether the vendor supports MFA, when the contract was signed, what data the vendor holds, and how sensitive it is. Add the Reg S-P 72-hour breach-notice commitment as a column, and put any AI tool that touches client data on the list like any other vendor.
- The latest due diligence questionnaire or status report from vendors that hold client data. The SOC 2 review write-up, or a completed questionnaire if there is none.
Training
- Training policies and, per session, dates, topics, method, and participants, with “documentation of attendance.” A fuller session at onboarding, short monthly training videos, and an annual re-attestation against the policies; the training vendor’s report is usually the easiest record to hand over.
Access and MFA
- The last ten hires, departures, and reassignments, with approvals and dates access was granted or ended. Onboarding and termination checklists recording when access ended in each system.
- Access review reports. Whatever format is easiest, a spreadsheet or a PDF, as long as it carries a sign-off from compliance or an executive.
- The systems with and without MFA, the lockout policy, and failed-login logs with a sample. A report of failed login attempts across your systems, and a note on who gets alerted when they spike.
- The policy for firm and personal devices, with encryption and remote wipe. At a two-person firm, a screenshot of each computer’s encryption setting is enough.
Data loss prevention and email
- DLP policies, the DLP tools list, and the latest exfiltration report, plus SPF, DKIM, and DMARC. The IT firm’s dated report, and the DMARC record itself, which is still on the to-do list at more firms than you would expect.
Some items are not cybersecurity and belong to the compliance consultant or counsel, including:
- Ownership chart
- Employee and terminated-employee lists
- AUM by custodian
- Outside counsel
- Reg S-ID program
The 2021 letter also lets later items be answered by pointing to the policy section that covers them.
What can’t small firms produce?
In late 2022 we checked one client’s files against a request list circulating among compliance officers and wrote back: “There are a few documents that we wouldn’t be able to provide if audited today, but have been on our project plan for a while: vendor inventory with MFA info, network diagram, hardware inventory, software inventory.”
A few months later we did the same exercise for a second client, and the gap list ran longer. Nobody could say whether the firm kept an incident log, and it had never run a tabletop exercise. The user entitlements review had been sitting on the operations list for months with nothing to show that it happened. We had to confirm with the IT firm that it could produce a failed-login report across all systems, and a log of patches applied, and that someone would be alerted when failed logins spiked. HR had to confirm it could produce an accurate list of terminated employees. DMARC was still on the list.
Then there is the policy nobody could find. One client went through an SEC exam at the end of 2024 using an information security plan it had edited, with its compliance consultant, from a 2022 version. A year later we asked about the earlier plan, the one built about five years before, and the operations analyst wrote back that it “seemingly predates me.” The version the firm had been using was missing a lot of the detail the SEC is going to want to see.
The same four gaps turn up at almost every small firm we assess, and they map straight onto the SEC’s request list:
- The policy exists but nobody reviews it: a one-person RIA told us he looks at his about every three years, with no set schedule.
- Vendor reviews start and stall: one firm’s review for the year covered two vendors, and one of the two never answered.
- The incident response plan has never been tested: one firm’s tabletop got pushed past tax season and then past a change of IT provider.
- And the IT provider’s work is not written down anywhere the firm can hand over, which one operations lead named as her firm’s biggest exam risk.
The SEC’s own version of that list, from the January 2026 mock-exam slides, has three entries: policies that “do not appear to be reasonably designed,” policies that “do not appear to be enforced,” and policies that “do not appear to exist.” None of that is unusual, and none of it is fatal. When we ask about these items when we’re doing our initial gap assessment, the most common answer at a small firm is “no” or “I don’t know,” and that is a fine answer, because it tells you exactly what goes on the list of things to fix before a letter arrives.
How do you run your own SEC mock exam?
Start from a real request list rather than a checklist: the SEC’s January 2026 sample, the 2023 attachment, and whatever letter your compliance counsel has in a drawer. Give yourself the same 15 days the 2021 letter gave, and collect the actual documents, not a note saying they exist.
Mark every item you cannot produce, and rank those by what examiners ask about first, including the policy, the incident log, the vendor inventory, the access reviews.
Then, interview the CCO and the IT firm the way the slides say examiners do, after reading what was collected. Write it up as a gap list with an owner and a date on each item.
When we run this for a client it takes four short surveys, a scan of each computer, and about two weeks, and the surprises come at the collecting step because that is when you learn which controls are running and which exist only in the policy.
What does the annual review have to cover?
Rule 206(4)-7 requires an adviser to review, “no less frequently than annually, the adequacy of the policies and procedures … and the effectiveness of their implementation,” and Rule 204-2(a)(17)(ii) requires records documenting that review.
Request letters ask for it. The attachment to the 2023 risk alert lists “annual and/or interim reviews of policies and procedures, including any reports prepared,” and a 2021 cybersecurity-focused request letter we have seen asks for the most recent cybersecurity risk assessment and any reports from reviewing or testing the cybersecurity policies.
The Division of Examinations’ September 14, 2026 risk alert, which quotes both rules, says what examiners found. Advisers skipped years, “conducting reviews for 2021 and 2023 but omitting 2022.” Some offered compliance training or “annual attestations” in place of a review. One adviser’s “identity theft policies and procedures mandate annual review testing, but this topic was omitted from such annual review testing.”
For a firm with an outside IT provider, the one to read twice is policies that “delegated the execution of services and/or operations to others, but did not identify how the adviser should oversee these delegated responsibilities.” Written review reports also “stated such actions had already occurred” while “the issues identified during the prior annual reviews persisted.”
A gap assessment and a risk assessment are two different things. The first checks a list of controls a firm should have in place, and there is no requirement on the frequency for this. The second is an annual process, and it asks “if bad thing X happens, how prepared are you for it.” Usually we cover this with the firm’s executives, and at a small firm we keep it to about an hour. The record is a dated document that includes:
- The risks discussed
- Which controls are met and which are in progress
- The accepted risks with their reasons
- The risks considered and excluded
We tell clients it is the one document the external assessors are sure to read. It doesn’t have to be exactly 12 months apart, as long as you’re doing it annually. Two things should pull the review forward: an incident, and a new vendor or system that touches client data.
What training records do examiners ask for?
A general exam letter asks for little here. In the SEC’s 2023 risk alert attachment the line is “Written guidance and training provided to employees regarding compliance program and documentation of attendance.” A 2021 cybersecurity-focused request letter we have seen went further, asking for each session’s dates, topics, delivery method, participant groups, and the materials. The fiscal 2026 exam priorities added that a Reg S-ID program should “include firm training on identity theft prevention,” and the November 2025 M Holdings order counted the absence of annual security awareness training among the violations.
We tell clients to run a more detailed session at employee onboarding, and then monthly short training videos, and an annual re-attestation against policies. It depends where they’re doing this, but a vendor report is often the best and easiest record. When a client adopts a new policy, we also run a one-hour recorded training session based on that policy.
Who answers the examiner, the CCO or the IT firm?
The January 2026 SEC mock exam deck lists the interviews as “Chief Compliance Officer (CCO), Chief Information Officer (CIO), Chief Technology Officer (CTO), Outsourced Information Technology Staff.” A 2021 cybersecurity-focused request letter we have seen asks who holds the information security role or, failing that, who has responsibility for overseeing cybersecurity. At a small firm that is the CCO, and the question we hear from owners is the one a prospect put to us last year: if the SEC walks in and hones in on our technology, who stands next to our CCO?
The questions are not always technical. One examiner asked a client’s CCO whether the firm looked at its firewalls daily, and the honest answer was no, they manage by exception. Another CCO, mid-exam in 2023, was taking the cyber policy questions to the IT provider between request lists.
System records should be the responsibility of the IT firm. The IT company has primary responsibility for this, but there also needs to be someone inside the company that keeps them honest, as these lists quickly get out of date. The goal is a CCO who hands the examiner a package and says, here is everything, tell us what problems you see.
Does a written list of your gaps hurt you in an exam? Only if you don’t fix them. One prospect, worried that a long findings report would sit on file for the SEC to read, worked it through himself: “So the documentation of the fixing is the answer.” That is exactly right. We have been audited by dozens of agencies and customers over the years, and they don’t mind when there are problems. They mind when the problems are egregious, or when you aren’t aware of them and aren’t working on them, and that is usually the difference between a fine and a slap on the wrist. A control you have looked at and decided against belongs in the same file, with the reason you accepted this: we discussed data loss prevention, we understand the risk, it doesn’t make sense for a firm our size, and we accept it.
Five things to ask your IT firm for before an SEC exam
In our experience, when we start actually collecting the kind of evidence that the SEC will be requesting, we usually find things that are not working how we think they are. The places where a firm is not ready with evidence are almost always on the IT side.
Send this to whoever runs your systems and ask them to reply with which of these they can produce today:
A log of patches applied across all systems
A report of failed login attempts, and who gets alerted when they spike
The hardware and software inventory
A network diagram
The list of terminated employees, with the date each person’s access ended
Anything that comes back as a no or an “I don’t know,” send our way.
Frequently asked questions
Does a general SEC exam ask about cybersecurity?
Yes, in four lines. The SEC’s September 2023 risk alert attachment lists “Safeguards for the protection of customer records and information,” “Electronic access controls,” “Business continuity plan,” and “Cybersecurity incidents or breaches (e.g., incident description, impact, and remediation).” The general exams our clients went through in 2025 and 2026 asked for little more than the policy and the list of incidents.
Is the SEC cybersecurity exam document request list public?
The SEC’s sample is. In January 2026 the Division put a sample request list on two slides at its small-firm event, and the attachment to the 2023 risk alert lists what a routine exam asks for. The SEC also published sample cybersecurity request lists as appendices to its 2014 and 2015 examination initiative alerts, and the 2021 letter we have seen is recognizably their descendant. What has not been published is the letter examiners use in a current exam. The two we work from came to us through clients, and most compliance lawyers and consultants who work with RIAs have one or two in a drawer as well.
Do we need to test our incident response plan?
Examiners ask for the testing policy and the most recent test report, and the 2021 letter we have seen asked for both. The way we do it with clients is a tabletop exercise once a year: pick a scenario, say everyone is locked out of Microsoft 365 on a Monday morning, and talk through what the firm would do. It takes about an hour, and the written summary of what came up is the report.
Do we need a penetration test?
There are a range of approaches and costs for “penetration tests,” and it’s worth understanding the differences and mapping them to a company’s risks. Most companies use cloud-hosted SaaS tools, so testing the firewall or local network matters less than hardening identity protections. A 2021 request letter we have seen asked for the policy and the most recent test date.
How long do we have to produce the documents?
About two weeks. The 2021 letter we have seen gave 15 days and asked for responses labeled by item number, and the same cover letter says staff “may also request additional or follow-up information, and will discuss timeframes.” The SEC’s 2023 risk alert says requests arrive by secure email and responses are “typically provided electronically.”
Will examiners ask for our SEC mock exam audit report?
They can. The 2023 risk alert’s attachment lists “Compliance consultant reports resulting from a review of compliance policies and procedures, operations, or books and records,” and an SEC mock exam report is that kind of document. If you hand one over, hand over the project plan that came out of it too, because the report by itself shows what was wrong and says nothing about what was done.
What happens after the exam?
An exit interview, then a letter. The Division’s description of the process says staff hold an exit interview or call to walk through what they found and to agree on any open requests, and that a deficiency letter follows, which the firm answers in writing. A clean exam gets a no-deficiency letter. Serious findings can be referred to the Division of Enforcement, and a deficiency letter still goes out in that case. Among our clients, the time from first request to exit interview has run from a few months to most of a year.
What if the examiner asks something only our IT firm can answer?
Say so, and get the answer. The SEC mock exam slides list interviews with the CCO, CIO, CTO, and outsourced IT staff, at a mutually agreed time after the examiners have read what you sent, so there is usually room to have the IT firm on the call. When there isn’t, write the question down, get the answer from the people who run the system, and send it back.
In Closing: Our Final Notes on the SEC Cybersecurity Exam Document Request List
The list that we shared above is mostly publicly available, so there is no reason to wait for a letter to find out how your firm would do.
Pull the January 2026 sample, give yourself two weeks, and try to produce each item as an actual file, not a note that says the file exists.
Most small firms get through the policies and the training records and stall at implementation on the IT side – the patch log, the failed-login report, the inventory, the terminated-employee list with access dates.
It’s better you figure out that you’re stalled instead of an SEC examiner coming in and issuing you some findings.
If the list comes back clean, you are in better shape than most firms we meet. If it comes back with blanks and “I don’t know,” that is what we do all day, working alongside the IT firm you already have.
Book a time and we can help!
