SAMPLE: Sample Ridge Advisors LLC is a made-up firm. The names, systems and answers below are invented to show what a delivered program looks like.

This is a starting written program generated from the answers you gave. It is not legal advice, not an audit or assessment of your systems, and it does not by itself satisfy your state's rule, the FTC Safeguards Rule or any other law. The rules require you to carry out the safeguards described here, not only to have them on paper. Read every section, correct anything that does not match how your firm works, complete the gap list, and have your Chief Compliance Officer and the approver named below adopt it by signing. Have your compliance counsel review it, especially the client privacy policy. If you are unsure how a rule applies to your firm, ask a qualified attorney.

1. Purpose, scope and the rules behind this program

Sample Ridge Advisors LLC (fictional sample firm) is an investment adviser registered with Virginia and also registered in North Carolina, with 3 staff (including contractors), 1 office location, about 180 client households and $25 million to $100 million in assets under management. Some staff work remotely.

These written physical security and cybersecurity policies and procedures are designed to protect the confidentiality, integrity and availability of the firm's physical and electronic records and information. They are tailored to the firm's business model, size, services and number of locations (21VAC5-80-260 A). They are written to:

• protect against reasonably anticipated threats or hazards to the security or integrity of client records and information;
• make sure the firm safeguards confidential client records and information; and
• protect any records and information whose release could harm or inconvenience a client.

The policies are organized by the five functions of 21VAC5-80-260: Identify, Protect, Detect, Respond and Recover. Each section names the person responsible.

The rules this program is written under

• State rule: Virginia Administrative Code 21VAC5-80-260 (Information security and privacy).
• The FTC Safeguards Rule, 16 CFR Part 314, which covers "investment advisors that are not required to register with the Securities and Exchange Commission" (16 CFR 314.1(b)). Section 9 maps each part of 16 CFR 314.4 to the section of this program that covers it.
• Regulation S-P is the SEC's privacy rule for SEC-registered firms. This program is written for state-registered advisers under their state rule and the FTC Safeguards Rule, not for Regulation S-P.

Size and the 5,000-consumer line (16 CFR 314.6)

Sample Ridge Advisors LLC (fictional sample firm) maintains customer information concerning fewer than 5,000 consumers (estimated 450). Under 16 CFR 314.6, four parts of the FTC Rule do not apply at this size: the written form of the risk assessment (314.4(b)(1)), penetration testing and six-monthly vulnerability assessments (314.4(d)(2)), the written incident response plan (314.4(h)) and the Qualified Individual's annual written report (314.4(i)). 21VAC5-80-260 has no size exception, and its Respond and Recover functions still call for response and recovery procedures, so this program keeps short versions of all four, marked as good practice.

Recount once a year at the annual review. A firm that passes 5,000 consumers must start the four parts listed in 16 CFR 314.6.

2. Roles: Chief Compliance Officer and Qualified Individual

Jordan Lee (Chief Compliance Officer) is the Chief Compliance Officer and administers these policies and procedures. Jordan Lee is also the Qualified Individual under 16 CFR 314.4(a): the person responsible for overseeing, implementing and enforcing the information security program.

Alex Rivera (Managing Member) approves the program, each annual review and each change, and receives the Qualified Individual's annual report.

The Qualified Individual:

• keeps this program current and runs the quarterly checks in the Detect section;
• approves in writing any exception to multi-factor authentication or encryption, with the equivalent control used instead;
• approves new systems and vendors before they receive client information;
• makes sure every person is trained and signs Attachment B;
• leads the response to any security event and the notice decisions in the incident response plan; and
• reports in writing at least once a year to Alex Rivera (16 CFR 314.4(i)).

a local IT company supports the Qualified Individual. The firm keeps responsibility for the program; the IT provider does not become the Qualified Individual unless the firm names it in writing (16 CFR 314.4(a)).

3. Identify (21VAC5-80-260 A.2.a)

Goal: understand the firm's information security risk to its systems, assets, data and capabilities.

• The adviser data map (Attachment C) lists every place client information lives: Schwab, Redtail, eMoney, Microsoft 365, SharePoint and DocuSign and the rest. The Qualified Individual updates it whenever a system, vendor, office or device changes (16 CFR 314.4(c)(2)).
• The vendor oversight list (Attachment A) lists every company that receives, keeps or can reach client information (16 CFR 314.2(r)).
• The written risk assessment (Section 10) rates the firm's risks and decides how each is handled (16 CFR 314.4(b)). It is redone at least yearly and after any security event or big change.
• Client information means any record, on paper or electronic, with nonpublic personal information about a client: names with account numbers, Social Security numbers, dates of birth, balances, statements, tax returns, ID copies, financial plans and meeting notes.

4. Protect (21VAC5-80-260 A.2.b)

Goal: put in place the safeguards that keep client information and the firm's services safe.

Access (16 CFR 314.4(c)(1))

• Every person has their own log-in to every system. No shared custodian, CRM or email accounts. Today: In place.
• Each person can see only the client information their job needs. The Qualified Individual reviews user lists every quarter and removes anything not needed.
• When someone leaves: the same day, disable their log-ins to every system in Attachment C, revoke custodian portal access, collect keys and devices, and change shared codes. Within 7 days, check for email forwarding rules and devices still signed in.
• Requests to move client money (wires, journals, address or bank changes) that arrive by email or text are confirmed by phone with the client at a number already on file, never a number in the request.

Multi-factor authentication (16 CFR 314.4(c)(5))

MFA is required for any person accessing any system that holds or connects to client information: Schwab portal, Microsoft 365, Redtail, eMoney, SharePoint and DocuSign. The only exception is a reasonably equivalent or more secure control approved in writing by the Qualified Individual. Today: Partly in place (see gap list).

Encryption (16 CFR 314.4(c)(3))

• All client information is encrypted at rest and in transit over outside networks. Laptops and desktops use full-disk encryption (BitLocker or FileVault). Today: Not in place (see gap list).
• Client documents are not sent as plain email attachments. Staff use SharePoint, DocuSign, or encrypted email.
• Phones used for firm email have a passcode, encryption on and remote wipe enabled.
• If encryption is not feasible for a system, the Qualified Individual approves an effective compensating control in writing.

Applications and vendors (16 CFR 314.4(c)(4), 314.4(f))

Sample Ridge Advisors LLC (fictional sample firm) does not build its own software. Before adopting any application that holds or sends client information, the Qualified Individual reviews the vendor's security information and records it in Attachment A. The firm picks vendors that can protect client information, requires it by contract, and reviews them by risk: High-risk vendors every year, others every two years. Today vendor reviews are: Partly in place (see gap list).

People and training (16 CFR 314.4(e))

• Every person with access to client information gets security awareness training before access and at least once a year. Today: Not in place (see gap list). Training covers phishing and fake custodian or client emails, wire fraud and money movement requests, never sharing log-ins, locking screens and files, handling ID copies and tax documents, and reporting anything odd to the Qualified Individual at once.
• Security work is done or overseen by Jordan Lee with a local IT company, who must have the skills and time to do it (16 CFR 314.4(e)(2) to (4)).
• Training is recorded on Attachment B. Breaking these policies can lead to discipline up to and including termination.

Physical security

• Client files at the office are kept in locked cabinets or a locked room, and desks are cleared at the end of the day.
• Visitors are not left alone where client files or logged-in screens are visible. Screens lock after 10 minutes.
• Remote staff work only on firm-managed or encrypted devices, keep client papers out of sight and locked away at home, and use a password-protected home network, never public Wi-Fi without a VPN.
• Paper with client information is cross-cut shredded or given to a shredding company that provides certificates. Computers, phones, copiers and drives are wiped or destroyed before disposal.

Disposal and retention (16 CFR 314.4(c)(6))

Client information is securely disposed of no later than two years after it was last used for that client, unless it is needed for a business purpose, your books and records rules or another law require keeping it, or targeted disposal is not reasonably feasible. The Qualified Individual reviews the retention schedule once a year.

Change management (16 CFR 314.4(c)(7))

New systems, vendors, offices and computers are approved by the Qualified Individual before they receive client information. Each change is dated. Old access is removed when a system is retired.

Sample skips Sections 5 to 8 here: Detect, Respond, Recover and the annual review, all written around the firm's own systems.

9. Crosswalk to the FTC Safeguards Rule, 16 CFR 314.4(a) to (j)

Each element of the FTC Safeguards Rule and where this program covers it. The status column applies the 314.6 size exception; the five functions of 21VAC5-80-260 apply at every size.

12. FTC notice of security events (16 CFR 314.4(j))

This applies whatever the firm's size. The 314.6 exception does not cover it.

• A notification event is the acquisition of unencrypted customer information without the authorization of the person it is about (16 CFR 314.2(m)). Encrypted information counts as unencrypted if the key was also taken. Unauthorized access is presumed to be acquisition unless the firm has reliable evidence it did not, or could not reasonably have, happened.
• Day 0 is the first day anyone at the firm (other than the person who caused it) knows of the event (314.4(j)(2)).
• Within 7 days: decide whether it is a notification event and count the consumers affected or potentially affected.
• If it involves the information of at least 500 consumers: notify the FTC as soon as possible, and no later than 30 days after discovery (314.4(j)(1)), using the FTC's online form at ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act/safeguards-rule-form.
• Example: an event discovered on November 9, 2026 must be reported to the FTC by December 9, 2026.
• The FTC may make reports public. If a law enforcement official has given a written determination that public notice would impede a criminal investigation or damage national security, say so on the form.

Other notices to consider at the same time

• State breach notice laws in every state where affected clients live, starting with Virginia. Deadlines differ by state; check the current statute at the time.
• Your state securities regulator, if your state's rules ask for notice. Confirm your state's version of this rule.
• Custodians whose accounts were involved, and your cyber insurance carrier before hiring outside help.
• The FBI at ic3.gov for cyber crime, especially wire fraud, as soon as possible.

13. Client privacy policy (draft)

Have your compliance counsel review this draft before you use it. Federal privacy rules may also set content, form and opt-out requirements for this notice; your counsel can confirm which apply to your firm.

21VAC5-80-260 B: the firm delivers a privacy policy to each client at engagement and every year after, and promptly delivers an amended policy if anything in it becomes inaccurate.

Privacy policy of Sample Ridge Advisors LLC (fictional sample firm)

Sample Ridge Advisors LLC (fictional sample firm) respects your privacy. This policy explains what nonpublic personal information we collect about you, how we share it and how we protect it.

• What we collect: information you give us on agreements, account forms and questionnaires (such as your name, address, Social Security number, date of birth, income, assets and goals); information about your accounts and transactions from your custodian; and information from others you authorize, such as your accountant.
• How we share it: we share information as needed to service your accounts and provide our advice, with your custodian (Schwab) and service providers who must keep it confidential, and as required or permitted by law or regulators.
• We do not share your nonpublic personal information with nonaffiliated third parties except as described above or as permitted by law. We do not sell it.
• How we protect it: we keep written physical security and cybersecurity policies and procedures, limit access to people who need it, and require our service providers to protect it.
• Former clients: we treat information about former clients the same way.
• Questions: contact Jordan Lee, Chief Compliance Officer, 100 Sample Rd, Richmond, VA.

Sample skips the risk assessment, incident response plan, delivery log, annual review record, Qualified Individual report, adoption page, vendor list, training sign-off and data map.

Attachment D: Gap list and schedule

These items come from your answers. Each one has an owner and a target date. Nothing here is done until the owner writes the date it was finished. Dates count from the effective date, November 9, 2026.

Rules this program cites

Regulation S-P is the SEC's privacy rule for SEC-registered firms. This program is written for state-registered advisers under their state rule and the FTC Safeguards Rule, not for Regulation S-P.

Starting program from Stratum Tech Group. Review and adopt it before use. Not legal advice, not an audit, and not by itself compliance. This product is not a substitute for the advice of an attorney.