SEC Proposes Changes To Reg S-P To Impose New Cybersecurity-Related Requirements On Covered Institutions

On March 15, 2023, the Securities and Exchange Commission (SEC) announced proposed changes to Regulation S-P ("Reg S-P") that would impose new cybersecurity incident response requirements on broker-dealers, investment companies, registered investment advisers, and transfer agents (collectively, "covered institutions"). If adopted as proposed, the amendment to Reg S-P would also impose additional burdens on covered institutions when it comes to handling consumer data and information and contracting with service providers.

All five SEC commissioners supported the proposal to update Reg S-P, which was adopted in 2000 to protect the privacy of consumer financial information. Reg S-P contains, among other provisions, the "safeguards rule"—which requires brokers, dealers, investment companies, and registered investment advisers to adopt written policies and procedures to safeguard customer records and information—and the "disposal rule"—which requires proper disposal of