SEC Adds New Incident Response Rules for Financial Sector

The SEC adopted amendments to Regulation S-P that require broker-dealers, investment companies, registered investment advisers, and transfer agents to implement incident response programs and notify individuals within 30 days when unauthorized access to customer information occurs, detailing the incident, data impacted, and protective steps. The rule takes effect 60 days after publication in the Federal Register, with 18 months for larger entities and 24 months for smaller entities to comply.