SEC Continues to Shine Light on Cyber and Data Security: Proposes Amendments to Regulation S-P

On March 15, 2023, the U.S. Securities and Exchange Commission (“SEC”) issued proposed amendments (the “Proposal”) to Regulation S-P, which governs the treatment of nonpublic personal information about consumers by broker-dealers, registered investment advisers, registered investment companies, and transfer agents.

The Proposal would broaden the existing “safeguards” and “disposal” rules under Regulation S-P, and would require the entities to adopt “incident response programs.”

The Proposal was announced simultaneously with two additional cybersecurity-related proposals that affect regulated entities other than registered investment advisers: (i) proposed amendments to Regulation SCI, which applies to entities the SEC has deemed important to the infrastructure of the U.S. securities markets; and (ii) a new Proposed Rule 10, which would impose certain notification requirements on a wide array of market participants in the event of significant cybersecurity incidents.  We discuss these proposals further in a separate Alert Memorandum.

Please click here to continue reading on the Cleary Enforcement Watch blog.