Reg S-P 2024 amendments

The Commission's own explanation of what it did to Regulation S-P and why, published at 89 FR 47688 on 3 June 2024 and effective 2 August 2024. It adds a written incident response programme reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information; written policies for oversight of service providers through due diligence and monitoring, while leaving the covered institution responsible for notification even where it is delegated; notice to affected individuals as soon as practicable, but not later than 30 days, after becoming aware that unauthorised access to or use of customer information has occurred or is reasonably likely to have occurred, unless, after a reasonable investigation, the institution determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience; a broadened definition of customer information that reaches information about another institution's customers held by the adviser; and written records documenting compliance.

• 01An adopting release is the most useful document in this library for anyone implementing a rule. It says what the Commission was trying to fix and answers the comments, which is where the edge cases are worked out.
• 02The 30-day notification clock runs from becoming aware of the unauthorised access, not from finishing the investigation.
• 03Service provider oversight is inside the rule, so vendor diligence stopped being good practice and became an obligation.
• 04The harm determination is an off-ramp from notifying, and it has to be made and documented rather than assumed.

• An incident response plan that exists but has never been exercised.
• No record of the harm determination for an incident that was not notified.
• Vendor agreements that predate the amendments and say nothing about access to customer information.