United StatesSEC Regulation S-P: service provider oversight and 72-hour breach notice to the covered institution
SEC Regulation S-P service provider oversight and notice, 17 CFR 248.30(a)(5)
In force.
A vulnerability and incident reporting rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a covered institution: a broker or dealer, an investment company, or an investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Declare is_securities_firm where that holds. Larger entities had to comply 18 months after the amendments were published in the Federal Register on , and smaller entities 24 months after.
- Make your incident response program include written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of your service providers, including to ensure that affected individuals are notified.
- Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
- Initiate your incident response program upon receipt of a service provider's notification.
- You may enter into a written agreement with a service provider to notify affected individuals on your behalf, but the obligation to ensure that affected individuals are notified rests with you.
These lines are LexLint's reading of the law's text, as of .
What this law does
A covered institution's response program must include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers.
Those policies and procedures must be reasonably designed to ensure service providers provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of such notification, the covered institution must initiate its incident response program.
A covered institution may enter into a written agreement with its service provider to notify affected individuals on the covered institution's behalf. A service provider is any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution. Compliance was required 18 months after Federal Register publication for larger entities and 24 months after publication for smaller entities.
When LexLint raises it
When your app profile says your app is a securities firm.