SEC Adopts Information Security And Notification Amendments To Regulation S-P

On May 16, 2024, the Securities and Exchange Commission ("SEC") announced that it had adopted amendments ("Amendments")¹ to Regulation S-P ("Reg S-P")². The SEC explained that the Amendments represent an effort to "modernize and enhance" rules designed to protect consumers' nonpublic information and privacy. The rules create new requirements for "covered institutions," which include brokers or dealers ("broker-dealers") and registered investment advisers ("RIAs").³

The Amendments will require, among other things, broker-dealers and RIAs (1) to develop, implement and maintain written policies and procedures for an incident response plan, (2) to develop written policies and procedures reasonably designed to require service provider oversight and (3) to provide notice to customers within 30 days in the event that "sensitive customer information" is compromised. The Amendments also broaden the scope of information covered by Reg S-P, implement additional recordkeeping