What to Know About the Sleeping Giant That Is the SEC’s Amended Reg S‑P

In a recent Cybersecurity Law Report article, Goodwin’s Kaitlin Betancourt analyzes the amendments the U.S. Securities and Exchange Commission (SEC) adopted in May 2024 to modernize Regulation S‑P, the agency’s framework for protecting consumer personal information at designated financial institutions. The SEC amendments substantially expand requirements for safeguarding customer information, including mandates to establish written incident response programs, notify customers of data breaches, implement additional service provider oversight, and meet new recordkeeping requirements. The amendments’ changes pertaining to notice and incident response program requirements will prove particularly challenging for covered institutions, including investment advisers. This article focuses on those challenges and offers practical compliance guidance. While large covered institutions already may have updated policies and procedures, this article highlights areas in which more preparation may be needed.

Read the full article on Cybersecurity Law Report.