Managed IT and compliance for The Woodlands offices.

Regulation S-P at 17 CFR 248.30, not the FTC Safeguards Rule. The 2024 amendments require a written incident-response program and a process to notify affected clients generally within 30 days of determining their information was, or likely was, accessed. If your firm is small enough to register with the Texas State Securities Board instead, the FTC rule applies rather than Reg S-P.

A custodian secures the custodian. It does not write your incident-response program, does not govern the laptops in your office, and does not cover the email account where client instructions arrive. Vendor oversight is itself one of the requirements, which means a breach at a service provider that touches client data remains your documented responsibility.

No, though the distance is real and it shapes how the work is set up. The Woodlands is the furthest of the cities covered here, so the approach leans on remote management for anything that does not need hands on hardware and on scoping on-site work to be finished in one visit rather than spread across several.

It runs from when you determine that a client’s nonpublic personal information was, or was likely, accessed without authorization, not from when the incident happened and not from when cleanup finishes. That is why the assessment and containment steps have to be written down and ready in advance; the determination is what starts the count.