SEC Regulation S-P amendments: incident response and customer notification (2024)
Covered financial firms must keep a written incident response program to detect, respond to, and recover from unauthorized access to customer information, notify affected customers within 30 days, and oversee service providers, which must notify the firm of a breach within 72 hours.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Organizational recovery process C-R4 | Required by the text | a written incident response program to detect, respond to, and recover from unauthorized access | high | 1 case |
| Reporting integrity C-V2 | Required by the text | customer notification within 30 days and service-provider notification to the firm within 72 hours | high | 1 case |
| Authority binding C-A2 | Implied | oversight of service providers that handle customer information on the firm's behalf | low | 3 cases |