United StatesSEC Regulation S-P: safeguards policies and incident response programs
SEC Regulation S-P safeguards policies and incident response programs, 17 CFR 248.30(a)(1) to (a)(3)
In force.
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on , and smaller entities 24 months after.
- Develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information, reasonably designed to ensure its security and confidentiality, protect against anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
- Include in those policies and procedures a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.
- Make the response program include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the systems and types of customer information affected, and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.
- Make the response program include procedures to notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless you determine after a reasonable investigation that the information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.
These lines are LexLint's reading of the law's text, as of .
What this law does
Every covered institution must develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.
The written policies and procedures must be reasonably designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to its security or integrity, and protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
The written policies and procedures must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures. The response program must include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.
A covered institution is any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. The amendments to Regulation S-P are effective . The amendments were published in the Federal Register on . Compliance was required 18 months after Federal Register publication for larger entities and 24 months after publication for smaller entities.
When LexLint raises it
When your app profile says your app is a securities firm.