The SEC continued its recent onslaught of proposed cybersecurity rules in mid-March with three new proposals covering a litany of entities, including investment advisers, broker-dealers, investment companies, clearing agencies, national securities associations and exchanges, and transfer agents. Among the three proposals is the SEC's proposed revisions to Regulation S-P (Proposed Rule), the primary regulation covering, among other things, obligations for investment advisers, investment companies and broker-dealers (collectively, Covered Entities) to safeguard and dispose of sensitive customer information.

Given that Regulation S-P is the most often-used tool by the SEC's Division of Enforcement to date for enforcement actions based on customer data protection and cybersecurity incidents, the Proposed Rule could have significant ramifications for the agency's compliance and enforcement efforts. The Proposed Rule would arguably strengthen consumer data protections and (for better or worse) create a "Federal minimum standard" for breach notifications by Covered Entities. However, the proposed amendments may also create potentially overlapping incident response obligations, (once again) require Covered Entities to reconsider contractual relationships with third-party service providers and impose additional document retention requirements.

In this post, we provide a summary of the proposed revisions to Regulation S-P and offer some key takeaways concerning the proposed amendments.

Summary of the Proposed Amendments

The Proposed Rule is the agency's first proposed amendment to Regulation S-P since the mid-2000s. Given the significant changes in the types and use of technology over the last two decades, the Proposed Rule encompasses several proposed amendments. We highlight four of the main amendments: 1) the expanded scope of information covered by Section 30(a) of Regulation S-P (Safeguards Rule); 2) the adoption of a "reasonably designed" incident response program as part of Covered Entities' policies and procedures under the "Safeguards Rule" (Section 30(a) of Regulation S-P); 3) required notification to individuals whose sensitive personal information was or is reasonably likely to have been accessed or used without authorization; and 4) the creation and maintenance of certain written records documenting adherence to the Safeguards Rule and "Disposal Rule" (Section 30(b) of Regulation S-P).¹

Expanded Scope of Safeguards Rule

Under the current version of the Safeguards Rule, Covered Entities have to adopt written policies and procedures "that address administrative, technical, and physical safeguards for the protection of customer records and information."² The current definition of "customer" includes "a consumer who has a customer relationship with a [Covered Entity]."³

However, under the Proposed Rule, the SEC would significantly expand the type of information covered by the Safeguards Rule. The Proposed Rule would apply to all "customer information"⁴ in the possession of a Covered Entity that it "maintains or otherwise possesses for a business purpose."⁵ Importantly, this requirement applies "regardless of whether such information pertains to individuals with whom the [Covered Entity] has a customer relationship …."⁶ This expansion would bring the Safeguards Rule in line with the Disposal Rule, which currently requires proper disposal of certain records without regard to whether the individuals are customers.

Incident Response Program

The Proposed Rule notes that "[s]ecurity incidents can occur in different ways, such as through takeovers of online accounts by bad actors, improper disposal of customer information in areas that may be accessed by unauthorized persons, or the loss or theft of data that includes customer information."⁷ Under the Proposed Rule, Covered Entities would be required to adopt an incident response program to address unauthorized use of or access to "sensitive customer information."⁸ (See below for more on "sensitive customer information.")

Under the Proposed Rule, the incident response program would need to be "reasonably designed to detect, responds to, and recover from both unauthorized access to and unauthorized use of customer information."⁹ Although the program must contain "general elements," the Proposed Rule does not impose specific actions that a Covered Entity must take when undertaking incident response activities.¹⁰ However, the Proposed Rule would require a Covered Entity's written policies and procedures to:

• assess the nature and scope of the incident that involved the unauthorized access to or use of customer information
• identify the types of customer information that may have been subject to such unauthorized access or use
• take "appropriate steps" to contain and control the incident and to prevent further unauthorized access to or use of customer information
• notify each affected individual of the unauthorized access in a manner that complies with the notification requirement set forth elsewhere in the Proposed Rule¹¹

The Proposed Rule also acknowledges the prevalence and importance of third-party service providers, who routinely have access to a Covered Party's customer information systems, and thus may expose them to risk of a security incident.¹² As a result, the Covered Entity's incident response policy must address the risk of harm resulting from security events not only at their business, but also at third-party service providers.¹³

Notice to Individuals Affected by an Unauthorized Access to or Use of Sensitive Customer Information

Although Covered Entities are subject to certain customer notification requirements under other federal or state laws, the Safeguards Rule does not currently include a requirement for Covered Entities to notify affected individuals in the event of a breach.¹⁴ The Proposed Rule would require Covered Entities to provide notice to individuals whose "sensitive customer information" was, or is reasonably likely to have been, accessed or used without authorization.¹⁵ The SEC proposes to define "sensitive customer information" as a subset of customer information that "alone or in conjunction with any other information … could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information."¹⁶

The notice must be: 1) clear and conspicuous; 2) directed at each affected individual; 3) distributed by a written means designated to ensure the reasonable expectation that actual notice will be received; and 4) provided as soon as practicable, but no later than 30 days after the Covered Entity learns of the unauthorized access to or use of the sensitive customer information.¹⁷ Importantly, the notice requirement is triggered only by such access or use of the sensitive customer information, as opposed to "information security incidents," which do not per se impose such a requirement.¹⁸

The Proposed Rule requires notice "as soon as practicable but not later than 30 days" after the entity becomes aware of the "that the unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred …."¹⁹ As discussed further below, the only exception to the timing requirement would be a written notification to the Covered Entity from the Attorney General of the United States that the notice need not be issued for the maximum of 30 additional days due to a purported "substantial risk to national security."²⁰

Enhanced Document Preparation, Retention and Recordkeeping Obligations

The Proposed Rule would require Covered Entities, for the first time, to prepare and maintain written records documenting compliance with both the Safeguards Rule and the Disposal Rule.²¹ Specifically, the Proposed Rule "would require the covered institution to maintain written records documenting the [Covered Entity's] compliance" with the proposed rules concerning the Safeguards Rule and the Disposal Rule.²²

The written records must document: 1) the assessment of the nature and scope of any incident involving unauthorized access to or use of customer information; 2) steps to control and mitigate any fallout from the incident; and 3) notifications to individuals who have been, or may be affected, by the incident.²³ These records must also catalogue the policies and procedures applicable to third-party service providers.²⁴

Key Takeaways

• Overlapping Cybersecurity Rule Proposals Could Create Multiple Obligations for Covered Entities: Although the SEC claims that the Proposed Rule is "not inconsistent" with other recently proposed cybersecurity rules,²⁵ there is little question that the Proposed Rule creates a Venn Diagram-like overlap of various cybersecurity obligations. For example, for investment advisers, the proposed incident response obligations under the Proposed Rule would seemingly overlap with the broader cybersecurity incident and recovery policies required under the proposed cybersecurity rules issued in 2022 (2022 Cybersecurity Proposal). Although she supported the Proposed Rule (with certain reservations), SEC Commissioner Hester Peirce did not hide her disapproval concerning the various overlapping cybersecurity proposals.²⁶

This overlap appears to be the primary reason the SEC reopened the comment period on the 2022 Cybersecurity Proposal: "The reopened comment period will allow interested persons additional time to analyze the issues and prepare comments in light of other regulatory developments, including whether there would be any effects of other Commission proposals related to cybersecurity risk management and disclosure that the Commission should consider."²⁷

• Potentially Contrary Incident Reporting Notifications: As the SEC acknowledged, all 50 states have enacted laws requiring firms to notify affected individuals of data breaches.²⁸ Given that Covered Entities are currently subject to these state law notification requirements, the proposed "Federal minimum standard" creates, at a minimum, competing reporting requirements – and possibly conflicting ones. The SEC posits that this uniform standard will improve matters, as it imposes broader definitions of "sensitive customer information" and a tighter notification window than several state notification counterparts.²⁹

However, the potential for conflict remains, and the SEC could only offer that the effect of any inconsistency "may" be mitigated because some states (but not all) offer safe harbors from state-level compliance for entities subject to compliance with federal laws.³⁰ The uncertainty about conflicting notification obligations will necessitate Covered Entities retaining competent legal experts to untangle the web of disparate notification requirements.

• Lack of Law Enforcement Exception: As the SEC notes, the vast majority of states across the country permit delayed notification for law enforcement purposes. These exceptions are to enable law enforcement personnel to conduct criminal investigations to identify bad actors without interference, a key component of the broader enforcement purpose to remove bad actors who cause these data breaches and security incidents.³¹ The Proposed Rule seemingly cuts against broader law enforcement efforts to tackle the root of the problem (the bad actors causing these issues).

The SEC's proposed workaround seems to be an onerous one: a written request from the Attorney General of the United States, and solely for national security issues. Additionally, even if that exception is granted, it spans only for a maximum of 30 additional days.³² The lack of a law enforcement exception – the first item identified by Commissioner Peirce on her list of concerns about the Proposed Rule – shapes up to be one the most hotly debated topics about the proposal during the comment process.

• More Rules, More Records, More Problems? Part and parcel to the SEC's proposed rulemaking for regulated entities has been an increased focused on mandatory documentation to demonstrate compliance with the rules. For example, as part of the SEC's proposed amendments to Rule 206(4)-7 of the Investment Advisers Act of 1940 (Compliance rule), the SEC is seeking to close a perceived gap and require investment advisers to document their annual reviews of the adequacy of their compliance programs.³³ As part of its proposed amendment, the SEC noted that this "would allow our staff to determine whether an adviser has complied with the review requirement of the [C]ompliance rule."³⁴ In a similar vein, the Proposed Rule would require Covered Entities to make and maintain written records documenting compliance with the requirements of the Safeguards Rule.³⁵ Again, the SEC was clear that the purpose of this requirement was to "evidence compliance with these requirements."³⁶ Such recordkeeping requirements cannot be overlooked as, if ultimately adopted, they will become a key fixture in SEC examinations going forward.
• Third-Party Service Providers Remain a Focus for Cybersecurity Rulemaking: The SEC is clear that incidents at third-party institutions involving customer information could implicate aspects of the Proposed Rule.³⁷ As we previously covered with the SEC's 2022 Cybersecurity Proposal, the SEC's focus on potential breaches at third-party service providers creates risks for regulated entities subject to these rules (in this case, Covered Entities). If implemented, this would likely necessitate not only revised policies and procedures concerning third-party service providers, but also renegotiated contractual terms with these parties.

The SECond Opinions Blog will continue to analyze the proposed Safeguards Rule and provide further observations. 

Notes

¹ See SEC Fact Sheet Proposed Enhancements to Regulation S-P. We note that there are other aspects of the proposal that are not covered in this post. For example, Regulation S-P presently requires Covered Entities, among other things, to provide a privacy notice "annually … for as long as the customer relationship continues." The SEC's proposed conformity of the annual privacy notice required under Regulation S-P to the delivery notice exception added by the 2015 Fixing America's Surface Transportation Act. Additionally, the proposed amendments would extend the application of the Safeguards Rule to transfer agents.

² 17 C.F.R. § 248.30(a).

³ 17 C.F.R. § 248.3.

⁴ Under the Proposed Rule, "customer information" for Covered Entities would be defined as "any record containing nonpublic personal information as defined in § 248.3(t) about a customer of a financial institution, whether in paper, electronic or other form, that is handled or maintained by the covered institution or on its behalf data." Proposed Rule at 242.

⁵ Proposed Rule at 236.

⁶ Id. (emphasis added).

⁷ Id. at 16. For examples of the injurious use of customer information, such as the sale of the information on the "dark web" or to facilitate the takeover of a brokerage account, see pages 17-18 of the Proposed Rule.

⁸ Id. at 3.

⁹ Id. at 19.

¹⁰ Id. at 20. The SEC's basis to permit "tailoring" of an incident response program is the stated recognition that "given the number and varying characteristics (e.g., size, business, and complexity) of [Covered Parties], each institution needs to be able to tailor its incident response program based on its individual facts and circumstances." Id.

¹¹ Id. at 21.

¹² Id. at 33. The Proposed Rule would define "service provider" to mean "any person or entity that is a third party and receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a [Covered Entity]."

¹³ Id. at 34.

¹⁴ Id. at 2.

¹⁵ Proposed Rule at 40.

¹⁶ Id. at 243. This language is drawn directly from Section 501(b) of the Gramm-Leach-Bliley Act, Pub. L. 106-102, 113 Stat. 1338 (enacted Nov. 12, 1999). See 15 U.S.C. § 6801(b)(3).

¹⁷ Id. at 40.

¹⁸ Id. at 41. However, in order for a Covered Entity to have a sufficient basis to determine a notice is not required, an investigation must have been conducted that revealed information indicating that customer information has not, nor will be, used in a manner that would result in substantial harm or inconvenience. Id. at 42.

¹⁹ Id. at 40.

²⁰ Id. at 61.

²¹ Proposed Rule at 93.

²² Id.

²³ Id. at 94-95.

²⁴ Id. at 95.

²⁵ Id. at 16.

²⁶ See Commissioner Hester M. Peirce, Statement of Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Mar. 15, 2023.

²⁷ See Press Release No. 2023-54, SEC Reopens Comment Period for Proposed Cybersecurity Risk Management Rules and Amendments for Registered Investment Advisers and Funds, Mar. 15, 2023.

²⁸ Proposed Rule at 4.

²⁹ Id. at 5.

³⁰ Id. at 6 n. 21.

³¹ See, e.g., Ala. Code § 8-38-1 et seq.;Alaska Stat. § 45.48.010 et seq.; Colo. Rev. Stat. § 6-1-716.

³² Proposed Rule at 61.

³³ See Proposed Rule, Private Fund Advisers; Documentation of Registered Investment Adviser Compliance Rules, Feb. 9, 2022 (Proposed Compliance Rule). Although current rules requires registered investment advisers to maintain any records documenting an adviser's annual review of its compliance policies and procedures (see Advisers Act Rule 204-2(a)(17)), as the SEC noted in the Proposed Compliance Rule, "the compliance rule does not expressly require documentation." Id. at 179.

³⁴ Id. at 178.

³⁵ Proposed Rule at 93.

³⁶ Id. at 218.

³⁷ Id. at 32, 134.