Guide
Incident Response Plan for Financial Firms: Requirements and Checklist
Regulators now expect financial firms to have a written plan for cyber incidents and to report some incidents within days or even hours. Here is what the rules require, what a good plan includes and how to test it.
Key takeaways
- SEC-registered advisers and broker-dealers need a written incident response program under amended Regulation S-P and must notify affected individuals within 30 days of becoming aware of unauthorized access to sensitive customer information.
- Regulator deadlines are short: 36 hours for banks, 72 hours for federally insured credit unions and NYDFS-licensed firms, and 30 days for firms under the FTC Safeguards Rule.
- A good plan names who decides, and who calls whom and in what order, including your IT provider, your cyber insurer, outside counsel and regulators.
- Test the plan at least once a year with a tabletop exercise, and update it after every real incident.
The rules
Which incident response rules apply to your firm
Advisers and broker-dealers: Regulation S-P
The amended Regulation S-P requires broker-dealers, investment companies, SEC-registered investment advisers and transfer agents to keep a written incident response program to detect, respond to and recover from unauthorized access to or use of customer information. Affected individuals must be notified as soon as practicable, and no later than 30 days after the firm becomes aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Larger firms had to comply by December 3, 2025 and smaller firms by June 3, 2026. See our Regulation S-P compliance checklist.
Accounting, tax and other firms under the FTC Safeguards Rule
Tax preparers, investment advisers that are not required to register with the SEC, mortgage brokers and other financial institutions under the FTC Safeguards Rule must notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information of 500 or more consumers is acquired without authorization. That requirement took effect on May 13, 2024. A written incident response plan is required once a firm holds information on 5,000 or more consumers, and smaller firms are wise to write one anyway. See our WISP guide for accounting and tax firms.
Banks: the 36-hour notification rule
Banks must notify their primary federal regulator as soon as possible, and no later than 36 hours after determining that a computer-security incident has risen to the level of a notification incident, such as a ransomware attack or outage that materially disrupts operations. Bank service providers must notify their bank customers as soon as possible when an incident disrupts covered services for four hours or more.
Credit unions: NCUA 72-hour reporting
Federally insured credit unions must report reportable cyber incidents to the NCUA within 72 hours of reasonably believing one has occurred, a rule in effect since September 1, 2023.
NYDFS-licensed firms and insurance agencies
Firms licensed by the New York State Department of Financial Services must notify DFS within 72 hours of determining that a cybersecurity incident has occurred, and report any extortion payment within 24 hours, with a written explanation within 30 days. Firms that do not qualify for a limited exemption must also keep a written incident response plan and test it at least once a year. Many states have adopted the NAIC Insurance Data Security Model Law, which also calls for prompt notice to the state insurance commissioner, within 72 hours in the model law. See our NYDFS Part 500 compliance checklist.
State breach notification laws
Every state has its own breach notification law, and the rules that apply depend on where affected people live, not where your office is. New Jersey requires a report to the State Police before customers are notified, Pennsylvania requires notice to the Attorney General when more than 500 residents must be notified, and New York requires notice to affected residents within 30 days. Your plan should cover every state where your clients live.
What to include
What an incident response plan for a financial firm should include
A plan does not need to be long, but it must be specific to your firm. Cover at least:
- Roles and authority: an incident lead, a backup, and who can approve decisions such as shutting down systems, bringing in outside help or notifying clients.
- Contact list: your IT provider, your cyber insurer’s breach hotline, outside counsel, custodians and key vendors, with phone numbers kept somewhere other than your email in case email is down.
- Detection and triage: how alerts and staff reports reach the incident lead, and how you decide how serious an incident is.
- Containment steps for the incidents financial firms see most: a compromised email account, ransomware, a lost laptop or phone, a wire fraud attempt and a breach at a vendor.
- Evidence handling: keep logs, emails and affected devices so investigators can tell what was accessed.
- Notification decisions: a table of every regulator, client and partner deadline that could apply to your firm, and who decides whether each one has been triggered.
- Recovery: restoring from clean backups, resetting passwords and access, and confirming systems are safe before staff return to normal work.
- Records and lessons learned: a written record of each incident and each decision, and the changes made afterward.
First hours
The first hours of a cyber incident
Step 1
Contain the damage
Disconnect affected devices from the network, disable compromised accounts and stop any pending wire transfers. Do not wipe or rebuild anything yet.
Step 2
Call for help
Call your IT provider and your cyber insurer’s breach hotline before hiring outside firms, since many policies require the carrier’s approved vendors.
Step 3
Preserve evidence
Keep logs, emails and affected devices as they are, so investigators can determine what was accessed and whether customer information was involved.
Step 4
Start the clock
Write down when the incident was discovered and when it was determined to be reportable, since regulator deadlines run from those moments.
Testing
How to test your incident response plan
A plan nobody has practiced rarely works under pressure. Run a tabletop exercise at least once a year: walk your incident team through a realistic scenario, such as ransomware on a Monday morning or a client reporting a fraudulent wire request, and check that everyone knows their role, the contact list is current and the notification decisions are clear.
Update the plan after every exercise and every real incident, and whenever you change IT providers, key vendors or cyber insurers. See our backup and disaster recovery services for the recovery side, and our cyber insurance requirements checklist for what carriers ask about your plan.
How FinFortify helps
How FinFortify helps with incident response
Incident response playbooks written for your firm are part of our managed cybersecurity services. We write the technical steps for the incidents financial firms see most, keep the contact list and notification table current and run tabletop exercises with your team. When an incident happens, our team helps contain it, preserve evidence and work with your insurer, counsel and compliance team.
For the rest of your program, see our IT compliance services and our wire fraud prevention guide. To talk about your plan, request a quote.
FAQ
Incident response plans: frequently asked questions
Do financial firms need a written incident response plan?
Most do. SEC-registered advisers and broker-dealers need a written incident response program under amended Regulation S-P, firms licensed by NYDFS need one under Part 500 unless they qualify for a limited exemption, and firms under the FTC Safeguards Rule need one once they hold information on 5,000 or more consumers. Cyber insurers ask about it too.
How quickly must a financial firm report a cyber incident?
It depends on the regulator: 36 hours for banks to notify their federal regulator, 72 hours for federally insured credit unions and NYDFS-licensed firms, and 30 days for FTC Safeguards Rule notices and Regulation S-P customer notices. State breach laws add their own deadlines.
What is the difference between an incident response plan and a business continuity plan?
An incident response plan covers detecting, containing and recovering from a security incident and making the required notifications. A business continuity plan covers keeping the firm running through any disruption, such as an outage or a building closure. Most firms need both, and each should point to the other.
How often should we test our incident response plan?
At least once a year, usually with a tabletop exercise, and after any major change to your systems, vendors or staff. NYDFS Part 500 requires covered firms that are not exempt to test their plans at least annually.
Get your incident response plan ready
Tell us about your firm and we will help you write, test and keep your incident response plan current.
