United StatesRegulation S-P: incident response program and customer breach notice
In force since .
A breach notification rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Breach notice, Governance
As of .
What it requires
- This binds a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency (17 CFR 248.30(d)(3)).
- Maintain, within your written safeguarding policies and procedures, a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, with procedures to assess the nature and scope of an incident, to contain and control it, and to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization (17 CFR 248.30(a)(3)).
- Give a clear and conspicuous notice, by a means designed to ensure each affected individual can reasonably be expected to receive actual notice in writing, to each individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that it has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience (17 CFR 248.30(a)(4)(i)).
- Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
- Describe in the notice, in general terms, the incident and the type of sensitive customer information involved, and include the other contents paragraph (a)(4)(iv) lists, among them contact information, an explanation of fraud alerts and of how to obtain a free credit report, and the availability of Federal Trade Commission guidance on identity theft (17 CFR 248.30(a)(4)(iv)).
- Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
- Ensure that affected individuals are notified even where a service provider acts for you; the obligation rests with you (17 CFR 248.30(a)(5)(iii)).
These lines are LexLint's reading of the law's text, as of .
What this law does
A covered institution is any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. A covered institution must maintain a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.
Unless it determines after a reasonable investigation that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, a covered institution must give a clear and conspicuous notice to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, by a means designed to ensure that each can reasonably be expected to receive actual notice in writing.
A covered institution must provide the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The notice must describe in general terms the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization, and must include the other items the paragraph lists.
The obligation to ensure that affected individuals are notified rests with the covered institution even where it uses a service provider. The covered institution's policies and procedures must be reasonably designed to ensure that a service provider notifies the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.
Sensitive customer information means any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. The amendments took effect on . The Commission provided an 18-month compliance period after the date of publication in the Federal Register for larger entities.
When LexLint raises it
When your app profile says your app is a securities firm.