Every item in the checklist maps to a specific Reg S-P requirement and specifies the exact written artifact an SEC examiner would look for.
Item 01
Written Incident Response Program
Detection, containment, eradication, recovery phases documented with named personnel assignments.
Item 02
30-Day Notification Procedures
Written decision criteria, notification template, and escalation chain for breach events.
Item 03
Vendor Oversight Program
Written policy covering all customer-data-touching vendors, security questionnaires, and contractual safeguards.
Items 04–06
Technical Controls
Data inventory, encryption documentation (at rest + in transit), and access control / MFA policies.
Items 07–08
Operational Controls
Annual training program with completion records, and data retention / secure disposal procedures.
Items 09–10
Annual Review + Recordkeeping
Documented annual program review with findings, and a central document repository for examination readiness.