What does SEC Regulation S-P ask a broker-dealer or investment adviser to do about customer information?

Who does it cover?

Regulation S-P is the SEC's rule on customer information. Section 248.30 applies to what it calls a covered institution: a broker or dealer, an investment company, and an investment adviser or transfer agent registered with the SEC or another appropriate regulatory agency.

Covered institution means any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency ("ARA") as defined in section 3(a)(34)(B) of the Securities Exchange Act of 1934.

What does it say about written policies?

The rule says every covered institution is to develop, implement and maintain written policies and procedures covering administrative, technical and physical safeguards for customer information.

Every covered institution must develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.

What does it say about responding to an incident?

The rule says those policies are to include a program reasonably designed to detect, respond to and recover from unauthorized access to or use of customer information. The program includes customer notification procedures.

Written policies and procedures in paragraph (a)(1) of this section must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

When are customers told?

The rule's notice is about sensitive customer information, which it defines as any component of customer information whose compromise could create a reasonably likely risk of substantial harm or inconvenience to the individual.

It says to provide the notice as soon as practicable and not later than 30 days after becoming aware that unauthorized access or use has occurred or is reasonably likely to have occurred. The text sets out when the notice may be delayed or is not needed.

Sensitive customer information means any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.

A covered institution must provide the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred

What does it say about service providers?

The rule says the institution's policies are to cover oversight of service providers. A service provider is to notify the institution as soon as possible and no later than 72 hours after becoming aware of a breach in security of a system it maintains.

The rule adds that the obligation to see that affected individuals are notified stays with the covered institution.

Provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.

the obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of this section rests with the covered institution.

What can an external reading show for this rule?

This rule asks for care across the whole firm. An external reading cannot see your policies, your training, your devices, your access lists or who can sign in to what.

What it can show, read externally the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

That is evidence toward the duty, never proof of it. Where the text names no control, we add none for it.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.