hours to provide continued oversight of service providers; 3 hours to
evaluate and adjust safeguards; 10 hours to respond appropriately to
potential incidents of data security breach, including investigating
the breach and, as necessary, notifying affected individuals; and 2
hours to notify the Commission or a designated examining authority as
soon as possible on proposed Form SP-30, in the event there is a
significant risk that an individual identified with the information
might suffer substantial harm or inconvenience or an unauthorized
person has intentionally obtained access to or used sensitive personal
information.\115\ We believe that most institutions investigate data
security breaches as a matter of good business practice to protect
their business operations and the sensitive information they have about
employees and clients. Nevertheless, we have estimated additional
burden hours because the proposed rule specifies certain elements of
the investigation and the notice to affected individuals. We also
believe that an institution would have gathered all the information
that would have to be disclosed in Form SP-30 in the course of these
investigations of data security breaches. Thus, staff estimates for the
Form SP-30 collection of information burden reflect only the time it
would take to draft the information on the form. Staff estimates that
smaller institutions would spend an additional $10,764 per institution
per year in connection with these burdens.\116\
---------------------------------------------------------------------------

    \115\ We estimate that each covered institution that has
developed and adopted and is maintaining safeguarding policies and
procedures will experience some form of breach of data security each
year. See, e.g., Deloitte & Touche LLP and Ponemon Institute LLC,
Enterprise@Risk: 2007 Privacy & Data Protection Survey (Dec. 2007),
http://www.deloitte.com/dtt/cda/doc/content/us_risk_s%26P_
2007%20Privacy10Dec2007final.pdf (last visited Dec. 19, 2007) (85%
of surveyed privacy and security professionals experienced a
reportable breach within the past 12 months). These data security
breaches may range from minor breaches (such as an individual who
accidentally sees data that he or she does not have authority to
view) to more serious breaches. Accordingly, we have estimated that
each of these institutions would experience a data security breach
that would require notice to the Commission (or a designated
examining authority) each year. We understand that the nature of
security breaches will vary widely within and among institutions,
and that this estimate may be much higher than the actual reporting
that would be required under the proposed rule.
    \116\ This estimate is based on the following calculation: 26
hours per smaller institution per year x $414 per hour = $10,764.
---------------------------------------------------------------------------

    The staff also estimates that the amount of time larger
institutions would

devote to ongoing compliance with the proposed amendments would range
from 32 hours to 100 hours with a midpoint of 66 hours per year. This
estimate reflects the following burden hour estimates: 12 hours to
regularly test or monitor the safeguards' key controls, systems, and
procedures; 9 hours to augment staff training; 9 hours to provide
continued oversight of service providers; 10 hours to evaluate and
adjust safeguards; 20 hours to respond appropriately to potential
incidents of data security breach, including investigating the breach
and, as necessary, notifying affected individuals; and 6 hours to
notify the Commission or a designated examining authority as soon as
possible on proposed Form SP-30, in the event there is a significant
risk that an individual identified with the information might suffer
substantial harm or inconvenience or an unauthorized person has
intentionally obtained access to or used sensitive personal
information.\117\ Staff believes that larger institutions are likely to
have more complex business operations and data systems and may
experience more sophisticated security attacks than smaller
institutions. As a result, staff anticipates that larger institutions
are more likely to conduct more complicated investigations that require
more detailed explanations on proposed Form SP-30. Staff estimates
therefore that larger institutions would take more time to perform
investigations and to complete the questions on proposed Form SP-
30.\118\ The staff estimates that larger institutions would spend
approximately an additional $51,084 per institution per year.\119\
---------------------------------------------------------------------------

    \117\ See supra note 115.
    \118\ We recognize that the time it takes to perform an
investigation of a data security breach and to complete Form SP-30
may vary significantly depending on the nature, size and complexity
of an institution's business operations as well as the nature and
size of the security breach. Accordingly, the actual time it may
take a particular institution to investigate the breach and complete
Form SP-30 may vary significantly from staff estimates.
    \119\ This estimate is based on the following calculation: 66
hours x $774 = $51,084.
---------------------------------------------------------------------------

    Given the estimates set forth above, we estimate that the weighted
average initial burden for each respondent would be approximately 136
hours \120\ and $100,036.\121\ We also estimate that the weighted
average ongoing burden for each respondent would be approximately 47
hours \122\ and $32,072.\123\
---------------------------------------------------------------------------

    \120\ This estimate is based on the following calculation:
((5,862 smaller institutions x 41 hours) + (6,570 larger
institutions x 220 hours) / 12,432 total institutions = 135.60
hours.
    \121\ This estimate is based on the following calculation:
((5,862 smaller institutions x $18,560) + (6,570 larger institutions
x $172,732)) / 12,432 total institutions = $100,036.03.
    \122\ This estimate is based on the following calculation:
((5,862 smaller institutions x 26 hours) + (6,570 larger
institutions x 66 hours)) / 12,432 total institutions = 47.14 hours.
    \123\ This estimate is based on the following calculation:
((5,862 smaller institutions x $10,764) + (6,570 larger institutions
x $51,084)) / 12,432 total institutions = $32,072.12.
---------------------------------------------------------------------------

Scope of the Safeguards and Disposal Rules
    The amendments also would broaden the scope of information and of
the entities covered by the safeguards and disposal rules. These
amendments do not contain collections of information beyond those
related to the information security and security breach response
requirements, analyzed above.
Records of Compliance
    The proposed amendments would require that written records required
under the disposal and safeguards rules be maintained and preserved by
broker-dealers for not less than three years, the first two years in an
easily accessible place, by registered transfer agents for a period of
not less than two years, the first year in an easily accessible place,
by investment companies for a period not less than six years, the first
two years in an easily accessible place, and registered investment
advisers would have to preserve the records for five years, the first
two years in an appropriate office of the investment adviser. Covered
institutions are already required pursuant to other Commission rules to
maintain and preserve similar records in the same manner, and we do not
believe that the currently approved collections of information for
these rules would change based on the proposed amendments.\124\
---------------------------------------------------------------------------

    \124\ See 17 CFR 240.17a-4(b); 240.17Ad-7(b); 270.31a-2(a)(4)-
(6); 275.204-2(e)(1).
---------------------------------------------------------------------------

Exception for Limited Information Disclosure When Personnel Leave Their
Firms
    The proposed amendments would create a new exception from
Regulation S-P's notice and opt out requirements that would permit
limited disclosures of investor information when a registered
representative of a broker-dealer or supervised person of a registered
investment adviser moves from one brokerage or advisory firm to
another. This exception would require that the departing representative
provide the broker, dealer, or registered investment adviser he or she
is leaving with a written record of the permissible information that
would be disclosed under this exception. Broker-dealers and registered
investment advisers also would be required to retain a record of that
information consistent with existing record retention requirements. All
broker-dealers and registered investment advisers maintain records of
their customers and clients, including relevant contact information and
type of account. Thus, we estimate that allowing a departing
representative to make a copy of this information and requiring the
broker-dealer or registered investment adviser to retain a record of
that information would not result in an additional measurable burden to
the firm.
    We request comment on whether these estimates are reasonable.
Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits comments
in order to: (i) Evaluate whether the proposed collections of
information are necessary for the proper performance of the functions
of the Commission, including whether the information will have
practical utility; (ii) evaluate the accuracy of the Commission's
estimate of the burden of the proposed collections of information;
(iii) determine whether there are ways to enhance the quality, utility,
and clarity of the information to be collected; and (iv) minimize the
burden of the collections of information on those who are to respond,
including through the use of automated collection techniques or other
forms of information technology.
    Members of the public may direct to us any comments concerning the
accuracy of these burden estimates and any suggestions for reducing
these burden hours. Persons wishing to submit comments on the
collection of information requirements of the proposed amendments
should direct them to the Office of Management and Budget, Attention
Desk Officer of the Securities and Exchange Commission, Office of
Information and Regulatory Affairs, Room 10102, New Executive Office
Building, Washington, DC 20523, and should send a copy to Nancy M.
Morris, Secretary, Securities and Exchange Commission, 100 F Street,
NE., Washington, DC 20549-1090 with reference to File No. S7-06-08. OMB
is required to make a decision concerning the collections of
information between 30 and 60 days after publication of this release;
therefore a comment to OMB is best assured of having its full effect if
OMB receives it within 30 days after the publication of this release.
Requests for materials submitted to OMB by the Commission with regard
to these collections of information should be in writing, refer to File
No. S7-06-08, and be submitted to the Securities and Exchange
Commission, Public Reference

Room, 100 F Street, NE., Washington, DC 20549.

V. Cost-Benefit Analysis

    The Commission is sensitive to the costs and benefits imposed by
its rules. We have identified certain costs and benefits of the
proposed amendments and request comment on all aspects of this cost-
benefit analysis, including identification and assessment of any costs
and benefits not discussed in this analysis. We seek comment and data
on the value of the benefits identified. We also welcome comments on
the accuracy of the cost estimates in each section of this analysis,
and request that commenters provide data so we can improve these cost
estimates. In addition, we seek estimates and views regarding these
costs and benefits for particular covered institutions, including
registered transfer agents, as well as any other costs or benefits that
may result from the adoption of these proposed amendments.
    As discussed above, the proposed rule amendments are designed to
enhance covered institutions' information security policies and
procedures as well as their ability to protect personal information.
Under Regulation S-P, covered institutions have been required to
safeguard customer records and information since 2001 and to dispose
properly of consumer report information since 2005. The proposed
amendments would modify Regulation S-P's current safeguards and
disposal rules to: (i) Require more specific standards under the
safeguards rule, including standards that would apply to data security
breach incidents; (ii) broaden the scope of information and the types
of institutions and persons covered by the rules; and (iii) require
covered institutions to maintain written records of their policies and
procedures and their compliance with those policies and procedures. The
proposed amendments also would create a new exception from Regulation
S-P's notice and opt-out requirements that would not unduly restrict
the transfer of representatives from one broker-dealer or registered
investment adviser to another while protecting customer information.

A. Costs and Benefits of More Specific Information Security and
Security Breach Standards

    As noted, since 2001 broker-dealers, investment companies, and
registered investment advisers have been required to adopt policies and
procedures reasonably designed to insure the security and
confidentiality of customer records and information, protect against
anticipated threats or hazards, and protect against unauthorized access
to or use of customer records and information.\125\ The proposed rule
amendments would require more specific standards for safeguarding
personal information, including standards for responding to data
security breaches. The amendments would require covered institutions to
develop, implement, and maintain a comprehensive ``information security
program'' for protecting personal information and for responding to
unauthorized access to or use of personal information that would have
to be appropriate to the institution's size and complexity, the nature
and scope of its activities, and the sensitivity of the personal
information involved. The information security program would have to
include seven safeguarding elements, as described above in section
II.A. Our proposed amendments also would specifically require that
institutions' information security programs include procedures for
responding to incidents of unauthorized access to or use of personal
information. We believe that these proposed amendments would be
consistent with safeguarding guidance and rules issued by the Banking
Agencies and the FTC.\126\
---------------------------------------------------------------------------

    \125\ See 15 U.S.C. 6801; 17 CFR 248.30(a). The Commission also
required that safeguarding policies and procedures be in writing by
July 1, 2005. See Disposal Rule Adopting Release, supra note 15.
    \126\ See supra note 23 and accompanying text.
---------------------------------------------------------------------------

1. Benefits of More Specific Information Security and Security Breach
Standards
    We anticipate that the proposed amendments would benefit covered
institutions and investors by providing specific standards for policies
and procedures to safeguard investor information, boosting investor
confidence and mitigating losses due to security breach incidents,
helping to ensure that information security programs are actively
managed and regularly updated, and reducing the compliance burden for
institutions in the event of a data security breach incident.
    One benefit of the proposed information security and security
breach standards would be to provide firms in the securities industry
with detailed standards for the policies and procedures that a well-
designed information security program should include. As already noted,
a significant increase in reported information security breaches
involving covered institutions, including increasingly sophisticated
identity theft attacks directed at the securities industry, have
altered the risk environment and brought to our attention the
vulnerability of certain of our institutions' information security
policies and procedures.\127\ We are concerned that some Commission-
regulated institutions may not regularly reevaluate and update their
safeguarding programs to deal with these increasingly sophisticated
methods of attack. As a result, our staff has devoted increased
attention to this area.
---------------------------------------------------------------------------

    \127\ See supra notes 16-19 and accompanying text.
---------------------------------------------------------------------------

    The current rule's reasonable design standard has permitted
institutions flexibility to implement safeguarding policies and
procedures tailored to their own privacy policies and practices and
their varying business operations. While many institutions have
appropriate safeguards in place, some institutions, including some
smaller institutions, may have had difficulty keeping up with the
changes in the threat environment. Setting out a more specific
framework for institutions' continuing obligation to protect customer
information, may ease institutions' burden in interpreting our
expectations of safeguarding policies and procedures that are
``reasonably designed,'' while retaining much of the current rule's
flexibility.
    We believe the proposed amendments would be consistent with the
Commission's initial statutory mandate under the GLBA to adopt, in
2000, final financial privacy regulations that are consistent and
comparable with those adopted by other federal financial
regulators.\128\ As noted above, after our adoption of Regulation S-P's
safeguards rule, the FTC and the Banking Agencies issued regulations
with more detailed standards applicable to the institutions they
regulate.\129\ The Banking Agencies also issued guidance for their
institutions on responding to incidents of unauthorized access to or
use of customer information.\130\ Our proposed amendments include
safeguarding elements consistent with the regulatory provisions of
these other agencies that Commission-regulated institutions would have
to address in their safeguarding policies and procedures.\131\
---------------------------------------------------------------------------

    \128\ See Section 504(a) of the GLBA (15 U.S.C. 6804(a)).
    \129\ See supra note 23 and accompanying text.
    \130\ Id.
    \131\ When the FTC adopted its safeguards rule, it stated that
an entity that demonstrated compliance with the Banking Agencies' or
NCUA's safeguarding standards also would satisfy the FTC rule. The
FTC stated, however, that it would not automatically recognize an
institution's compliance with other safeguards rules (including
Regulation S-P) as satisfying the FTC Safeguards Rule. The FTC
stated that it made this decision because ``such other rules and law
do not necessarily provide comparable protection in terms of the
safeguards mandated, data covered, and range of circumstances to
which protection apply.'' See Standards for Safeguarding Customer
Information, 67 FR 36484 (May 23, 2003), at text accompanying and
following nn.28-33. Compliance with other Regulation S-P provisions,
however, currently satisfies other FTC privacy requirements. Thus,
we expect that making the safeguarding provisions of Regulation S-P
comparable to the FTC's requirements would benefit institutions by,
for example, permitting state-registered investment advisers to
satisfy the FTC standards by complying with the Commission's
safeguards rule, which was drafted to address investment advisory
business models.

---------------------------------------------------------------------------

    Covered institutions would benefit from having specific standards
that are consistent and comparable to those already adopted by the
Banking Agencies and the FTC in other ways. For example, covered
institutions that have banking affiliates may have already developed
policies and procedures consistent with the Banking Agencies' guidance
that are applied to all affiliates of the bank. If they do not have the
same policies and procedures, these covered institutions would be able
to apply the banking affiliate's policies and procedures to the
securities businesses with few changes. More specific safeguarding
standards also could increase investor confidence in institutions and
help mitigate losses that can result from lax safeguarding policies and
procedures. Incidents of identity theft have affected a large number of
Americans and are difficult and expensive for victims to deal with and
correct.\132\ Moreover, there is at least anecdotal evidence that the
wave of widely-reported incidents of data security breaches have played
a role in discouraging a significant number of individuals from
conducting business online.\133\ The proposed amendments could benefit
investors and increase their confidence by providing firms with
detailed standards for the processes that a well-designed information
security program should include. This could result in enhanced
protection for the privacy of investor information, and could decrease
incidents of identity theft, thereby mitigating losses due to identity
theft and other misuses of sensitive information. We also believe that
the increased protection that could result from the proposed amendments
could benefit institutions, which frequently incur the costs of
fraudulent activity.\134\ Thus, if only a small number of security
breach incidents were averted because the proposed amendments were
adopted, there still could be a significant cost savings to individuals
and institutions.\135\
---------------------------------------------------------------------------

    \132\ In 2003 the FTC reported that up to 10 million Americans
had been victimized by identity theft over a 12-month period and
that these thefts cost businesses and consumers over $52 billion.
See FTC, Identity Theft Survey Report (Sept. 2003), available at
http://www.ftc.gov/os/2003/09/synovatereport.pdf.
    \133\ A July 2005 study found that 48 percent of consumers
avoided making purchases on the Internet because they feared their
personal information may be stolen. See Cyber Security Industry
Alliance, Internet Voter Survey, at 9 (June 2005), https://
www.csialliance.org/publications/surveys_and_polls/CSIA_
Internet_Security_Survey_June_2005.pdf (last visited Nov. 6,
2007).
    \134\ In most cases, financial institutions do not impose the
losses associated with fraudulent activity on consumers. See, e.g.,
Testimony of Oliver I. Ireland, on Behalf of the Financial Services
Coordinating Council, H.R. 3997, the ``Financial Data Protection Act
of 2005,'' Before the Subcomm. on Financial Institutions and
Consumer Credit, House Comm. on Financial Services (Nov. 9, 2005),
available at http://www.sia.com/testimony/2005/ireland11-9-05.html.
    \135\ One research institution has estimated that the average
cost of a data security breach incident per institution is $1.4
million. See Ponemon Institute, LLC, 2006 Annual Study: Cost of a
Data Breach (Oct. 2006), http://download.pgp.com/pdfs/Ponemon2-
Breach-Survey--061020--F.pdf (last visited Nov. 6, 2007). In
addition, some investigations into data breach incidents have been
reported to cost as much as $5 million. See Daniel Wolfe, Security
Watch, Amer. Banker (Apr. 4, 2007).
---------------------------------------------------------------------------

    As noted above, we are concerned that some institutions do not
regularly reevaluate and update their safeguarding programs. Requiring
covered institutions to designate in writing an employee or employees
to coordinate their information security programs should foster clearer
delegations of authority and responsibility, making it more likely that
an institution's programs are regularly reevaluated and updated. Having
an information security program coordinator also could contribute to an
institution's ability to meet its affirmative and continuing obligation
under the GLBA to safeguard customer information.\136\ If, for example,
elements of a covered institution's information security program were
not maintained on a consolidated basis, but were dispersed throughout
an institution, we believe having a responsible program coordinator or
coordinators should facilitate the institution's awareness of these
elements, as well as enable it to better manage and control risks and
conduct ongoing evaluations.
---------------------------------------------------------------------------

    \136\ See 15 U.S.C. 6801(a).
---------------------------------------------------------------------------

    We expect that the proposed framework for the initial and ongoing
oversight of institutions' information security programs--in the form
of formal risk assessments, periodic testing or monitoring of key
controls, systems, and procedures, staff training, and relevant
evaluations and adjustments--would help to ensure that information
security programs are appropriately updated along with relevant changes
in technology, new business arrangements, changes in the threat
environment, and other circumstances. Finally, the proposed amendment
that would require covered institutions to take reasonable steps to
select and retain service providers that are capable of maintaining
appropriate safeguards and would require service providers by contract
to implement and maintain appropriate safeguards should help to ensure
that sensitive personal information is protected when it leaves the
institution's custody, while still permitting institutions the
flexibility to select appropriate service providers.
    The proposed requirement that information security programs include
specific procedures for responding to incidents of unauthorized access
to or use of personal information is designed to benefit investors and
institutions. The requirement would benefit investors who receive
notice of an information security breach pursuant to an institution's
incident response procedures by allowing those investors to take
precautions to the extent they believe necessary.\137\ The procedures
also would benefit institutions by establishing a national data breach
notification requirement for covered institutions.\138\ Currently at
least 39 states have enacted statutes requiring notification of
individuals in the event of a data security breach.\139\ This patchwork
of overlapping and sometimes inconsistent regulation has created a
difficult environment for financial institutions' compliance programs.
However, many of the state statutes contain exemptions for entities
regulated by federal data security breach regulations.\140\
Accordingly, the proposed amendments could benefit covered institutions
by significantly reducing the number of requirements with which covered
institutions must

comply.\141\ As noted, the banking regulators published similar data
breach notification guidance in 2005.\142\
---------------------------------------------------------------------------

    \137\ Often victims of identity theft are unaware of the crime
until they are denied credit or employment, or are contacted by a
debt collector for payment on a debt they did not incur. See
Identity Theft Task Force, Combating Identity Theft, A Strategic
Plan, p. 3 (Apr. 2007), available at http://www.idtheft.gov/reports/
StrategicPlan.pdf.
    \138\ Establishing national standards for data breach
notification requirements was a recommendation of the Identity Theft
Task Force. Id. at p. 35.
    \139\ See Government Accountability Office, Personal
Information: Data Breaches Are Frequent, but Evidence of Resulting
Identity Theft Is Limited; However, the Full Extent Is Unknown (Jun.
4, 2007) at p. 2, and National Conference of State Legislatures,
State Security Breach Notification Laws (as of Dec. 1, 2007), http:/
/www.ncsl.org/programs/lis/cip/priv/breachlaws.htm (last visited
Dec. 10, 2007).
    \140\ See, e.g., Crowell & Moring LLP, State Laws Governing
Security Breach Notification (last updated Apr. 2007), http://
www.crowell.com/pdf/SecurityBreachTable.pdf (last visited Dec. 10,
2007).
    \141\ Under the proposed amendments, for example, using proposed
Form SP-30 would satisfy an institution's obligations to notify the
Commission or the appropriate designated examining authority.
Because many state laws have exceptions from breach notification
requirements for institutions subject to federal breach notification
requirements, this would streamline institutions' current reporting
obligations to numerous state authorities.
    \142\ See Interagency Guidance on Response Programs for
Unauthorized Access to Customer Information and Customer Notice, 70
FR 15736 (Mar. 29, 2005), available at http://www.occ.treas.gov/
consumer/Customernoticeguidance.pdf. The guidance supplements the
Interagency Guidelines Establishing Standards for Safeguarding
Information which was renamed the Interagency Guidelines
Establishing Information Security Standards.
---------------------------------------------------------------------------

    We request comment on available metrics to quantify these benefits
and any other benefits the commenter may identify. In particular, we
request comment reflecting institutions' experiences in safeguarding
customer information and addressing the security breach incidents
discussed above. Commenters are also requested to identify sources of
empirical data that could be used for the metrics they propose.
2. Costs of More Specific Information Security and Security Breach
Standards
    Some institutions would likely incur additional costs in reviewing,
implementing, and maintaining more specific information security and
security breach standards. Institutions could incur additional costs in
reviewing current safeguarding policies and procedures and designing
and implementing new ones, if necessary, on an initial basis.
Institutions also could incur additional costs on an ongoing basis to
maintain up-to-date information security programs and to respond
appropriately to any data security breach incidents.
    According to Commission filings, approximately 6,016 broker-
dealers, 4,733 investment companies comprising portions of 813 fund
complexes,\143\ 77 business development companies, 9,860 registered
investment advisers, and 501 registered transfer agents, or 17,267
covered institutions, would be required to comply with the proposed
amendments' more specific information security and security breach
standards.\144\ As noted, broker-dealers, investment companies, and
registered investment advisers have been required to have reasonably
designed safeguarding policies and procedures since 2001. In addition,
transfer agents have been required to have information security
safeguards since 2003, in accordance with the FTC Safeguards Rule.\145\
We estimate that 56 percent of all covered institutions, or 9,670
institutions, have one or more financial affiliates (whether these
institutions are regulated by the Commission or other federal financial
regulators).\146\ We estimate that each of the affiliated institutions
has one corporate affiliate. Based on limited inquiries of covered
institutions, we believe that these affiliated institutions are likely
to have developed safeguarding policies and procedures on an
organization-wide basis, rather than each affiliate developing policies
and procedures on its own.\147\ We also believe that the affiliate that
developed the affiliated organization's safeguarding policies and
procedures is also responsible for maintaining these policies and
procedures. We therefore estimate that one-half of the covered
affiliated institutions, or 4,835 institutions, have developed,
documented, and are maintaining safeguarding policies and procedures,
while the other half instead use the policies and procedures developed,
documented, and maintained by their affiliate.\148\ Accordingly, we
estimate that 12,432 covered institutions have developed and adopted
safeguarding policies and procedures and are maintaining these policies
and procedures in accordance with the current rule.\149\
---------------------------------------------------------------------------

    \143\ Although the circumstances for every investment company
vary, we believe that in general the costs of complying with the
proposed rule amendments would be incurred on a per fund complex
basis and not on a per fund basis because almost all investment
companies are externally managed by affiliated organizations and
independent contractors, who, if the proposals are adopted, are
likely to review and implement the amended rules on behalf of all of
the investment companies they manage. See, e.g., Investment Company
Institute, A Guide to Understanding Mutual Funds, at 16, Sept. 2006,
available at http://www.ici.org/pdf/bro_understanding_mfs_p.pdf
(last visited Dec. 3, 2007). Thus, throughout this cost-benefit
analysis we estimate the costs of compliance on a per fund complex
basis.
    \144\ This estimate is based on the following calculation: 6,016
+ 813 + 77 + 9,860 + 501 = 17,267.
    \145\ See supra note 23.
    \146\ The estimate that 56 percent of registrants have an
affiliate is based upon statistics reported as of December 3, 2007
on Form ADV, the Universal Application for Investment Adviser
Regulation, which contains specific questions regarding affiliations
between investment advisers and other persons in the financial
industry. We estimate that other institutions subject to the
safeguards rule would report a rate of affiliation similar to that
reported by registered investment advisers. The estimate that 9,670
institutions have an affiliate is based on the following
calculation: 17,267 x 0.56 = 9,669.52.
    \147\ See supra note 109.
    \148\ This estimate is based on the following calculation: 9,670
/ 2 = 4,835.
    \149\ This estimate is based on the following calculation:
(17,267 - 9,670) + 4,835 = 12,432.
---------------------------------------------------------------------------

    We expect that these institutions' current costs to maintain
safeguarding policies and procedures in compliance with the
Commission's safeguards rule vary greatly depending upon the size of
the institution, its customer base, the complexity of its business
operations, and the extent to which the institution engages in
information sharing. Thus, for example, we estimate that small
investment advisers with fewer than 10 employees require more limited
safeguarding policies and procedures to address a limited scope of
information transfer, storage, and disposal. We believe that larger
broker-dealers or fund complexes, by contrast, are more likely to have
and maintain a more extensive set of information safeguarding policies
and procedures, corresponding to these institutions' more complex
business activities and information sharing practices.
    Of the covered institutions, we estimate that 7,030 registered
investment advisers have 10 or fewer employees.\150\ We estimate that
942 broker-dealers and investment company complexes are small
institutions, and are likely to have no more than 10 employees.\151\
Based on Commission filings, we also estimate that 170 transfer agents
are smaller institutions that are likely to have no more than 10
employees. We therefore estimate that 8,142 institutions, out of 17,267
covered institutions, are smaller institutions that are likely to have
no more than 10 employees.\152\ We believe that the institutions that
have developed and adopted safeguarding policies and procedures are as
likely to be smaller institutions with no more than 10 employees as the
total population of covered institutions.\153\ Therefore, of 12,432
covered institutions that we estimate have developed and adopted and
are maintaining safeguarding policies and procedures, we estimate for
purposes of this analysis that 5,862 institutions are smaller
institutions,

while 6,570 institutions are larger institutions.\154\
---------------------------------------------------------------------------

    \150\ See Investment Adviser Association, Evolution Revolution,
A Profile of the Investment Adviser Profession (2006), available at
http://www.nrs-inc.com/ICAA/EvRev06.pdf.
    \151\ As noted below, 915 broker-dealers and 238 investment
companies, representing 27 fund complexes, are small entities.
    \152\ This estimate is based on the following calculation: 7,030
+ 942 + 170 = 8,142 smaller institutions.
    \153\ 8,142 / 17,267 = 0.4715.
    \154\ 12,432 x 0.4715 = 5,861.88; 12,432 - 5,862 = 6,570.
---------------------------------------------------------------------------

    Based on conversations with representatives of covered
institutions, and information collected from limited inquiries of
covered institutions, we estimate that smaller institutions are
currently spending between $5,000 and $1,000,000 per year to comply
with the safeguards and disposal rules.\155\ We also estimate that
larger institutions are spending between $200,000 and $10,000,000 per
year to comply with the safeguards and disposal rules. These estimates
include costs for dedicated personnel, maintaining up-to-date policies
and procedures, enforcing various safeguarding requirements (such as
``clean desk'' requirements), hiring contractors to properly dispose of
sensitive information, developing and enforcing access procedures,
ongoing staff training, monitoring and reviewing compliance with
safeguarding standards, and computer encryption. These estimates also
include current spending to comply with state data security breach
statutes.\156\
---------------------------------------------------------------------------

    \155\ See supra note 111.
    \156\ These estimates also include transfer agents' current
spending to comply with the FTC Safeguards Rule. As noted, the
proposed amendments would apply to every broker or dealer other than
a notice-registered broker or dealer, every investment company, and
every investment adviser or transfer agent registered with the
Commission. See proposed paragraph (a)(1) of Section 30.
---------------------------------------------------------------------------

    We expect that most covered institutions have information security
programs in place that would be consistent with the proposed
amendments.\157\ We do not have a reliable basis for estimating the
number of institutions that would incur additional costs or the extent
to which those institutions would have to enhance their policies and
procedures, including documentation of the information safeguard
program and its elements. Accordingly, we have estimated the range of
additional costs that individual firms could incur. We seek comment on
the number of firms that have information safeguard programs that would
satisfy the proposed amendments, the number of firms that would have to
enhance their programs, the extent of those enhancements, and the costs
of enhancement.
---------------------------------------------------------------------------

    \157\ This belief is consistent with the analysis of the Office
of the Comptroller of the Currency and Office of Thrift Supervision
when they adopted the Banking Agencies Safeguard Guidelines in 2001.
At that time they stated with respect to the institutions they
regulated, that ``most if not all institutions already have
information security programs in place that are consistent with the
Banking Agencies' Security Guidelines. In such cases, little or no
modification to an institution's program will be required.'' See
Banking Agencies' Security Guidelines, supra note 23. The statement
was made in the analysis of whether the Guidelines would constitute
``a significant regulatory action'' for purposes of Executive Order
12866, which includes an action that would have an annual effect on
the economy of $100 million or more or adversely affect in a
material way the economy, a sector of the economy, productivity,
competition, jobs, the environment, public health or safety, or
State, local, or tribal governments or communities. The Board and
the FDIC did not prepare an analysis under Executive Order 12866.
---------------------------------------------------------------------------

    If the proposed amendments were adopted, covered institutions could
incur costs to supplement their current information security programs
in some or all of the following ways. First, the institution would be
required to review and, as appropriate, revise its current safeguarding
policies and procedures, including their data security breach
procedures and disposal rule procedures, to comply with the more
specific requirements of the proposed amendments. Initially this would
require the institutions to: (i) Designate an employee or employees as
coordinator for the information security program; (ii) identify in
writing reasonably foreseeable security risks that could result in the
unauthorized access or compromise of personal information or personal
information systems; (iii) review existing or design new safeguards to
control these risks; (iv) train staff to implement the safeguards; and
(v) test the effectiveness of the safeguards' key controls, including
access controls, controls to detect, prevent and respond to incidents
of unauthorized access to or use of personal information. Second, an
institution also would be required to review its service providers'
information safeguards and determine whether its service providers are
capable of maintaining appropriate safeguards for personal information,
document this finding, and enter into contracts with the service
providers to implement and maintain appropriate safeguards.
    Third, an institution would be required to review existing
safeguarding procedures relating to data security breach incidents.
Initially, this could include: (i) Assessing current policies and
procedures for responding to data breach incidents; and (ii) designing
and implementing written policies and procedures to assess, control,
and investigate incidents of unauthorized access or use of sensitive
personal information, as well as policies and procedures to notify
individuals and the Commission or a broker-dealer's designated
examining authority, if necessary.
    Fourth, to comply with these amendments on an ongoing basis,
institutions would be required to: (i) Regularly test or monitor, and
maintain a written record of the effectiveness of their safeguards' key
controls, systems and procedures (including an assessment of personal
information system access controls, controls designed to detect,
prevent and respond to data security breach incidents, and controls
related to employee training or supervision); (ii) train staff to
implement their information security program; (iii) continue and
document their oversight of service providers; and (iv) evaluate and
adjust their information security programs in light of testing and
monitoring, and changes in technology, business operations or
arrangements, and other material circumstances.
    Finally, an institution would be required to begin to respond to
any data security breach incidents as may occur on an ongoing basis.
This would include implementing and following written procedures to:
(i) Assess the nature and scope of the incident; (ii) take appropriate
steps to contain and control it, and document those steps in writing;
(iii) promptly conduct a reasonable investigation and make a written
determination of the likelihood that sensitive personal information had
been or would be misused; (iv) if misuse of information had occurred or
were reasonably likely, notify affected individuals; and (v) if an
individual identified with the information had suffered substantial
harm or inconvenience, or any unauthorized person had intentionally
obtained access to or used sensitive personal information, notify the
Commission, or the appropriate designated examining authority as soon
as possible on proposed Form SP-30.
    We expect these estimated costs would vary significantly depending
on the size of the institution, the adequacy of its existing
safeguarding policies and procedures, and the nature of the
institution's operations. The ``reasonably designed'' standard for
information security programs in the proposed rule amendments is
consistent with the current safeguards and disposal rules. Thus, we
believe it should be relatively straightforward for an institution that
does not currently have policies and procedures that apply to specific
elements of the proposed amendments to incorporate these elements into
its current system of safeguarding policies and procedures. In
addition, we estimate that little or no modification to an
institution's safeguarding policies and procedures would be required in
situations where a covered institution's affiliate developed

its existing safeguarding policies and procedures in compliance with
the Banking Agencies' safeguarding guidance or the FTC's rules.
    In addition to an institution's size, the adequacy of its
safeguards, and its operations, we expect that institutions'
information security programs would vary considerably depending on the
way in which each collects information, the number and types of
entities to which each transfers information, and the ways in which
each stores, transfers, and disposes of personal information. Based on
conversations with representatives of covered institutions and
information collected from limited inquiries of institutions, our staff
estimates that the additional initial costs that an institution could
incur to comply with the proposed amendments could range from 0 to 10
percent of its current costs of maintaining an information security
program. Our staff also estimates that the additional costs an
institution could incur for ongoing compliance with the proposed
amendments could range from 0 to 5 percent of its current costs.\158\
For purposes of the PRA, staff estimates that for a smaller
institution, the initial costs could range from between $500 and
$100,000, with an approximate cost of $18,560 per smaller
institution.\159\ Staff also estimates that for a smaller institution,
additional ongoing costs could range from between $250 and $50,000,
with an approximate cost of $10,764 per smaller institution per
year.\160\ With respect to a larger institution, again for purposes of
the PRA, staff estimates that initial costs could range from between
$20,000 and $1 million, with an approximate cost of $172,732 per larger
institution.\161\ Staff further estimates that for a larger
institution, additional ongoing costs could range from between $10,000
and $500,000 per year, with an approximate cost of $51,084 per larger
institution per year.\162\ We note that an institution that currently
incurs the highest estimated costs for its information security program
seems likely already to have a comprehensive information security
program and therefore would be less likely to require program
enhancements to comply with the rule. Accordingly, the high end of the
range of estimated costs for institutions may be excessive.
---------------------------------------------------------------------------

    \158\ While we estimate that additional initial and ongoing
costs would vary significantly across wide ranges, we estimate that
the average cost per institution would be concentrated in the lower
end of those ranges because, as noted, we believe that most
institutions have already developed and adopted safeguarding and
disposal polices and procedures, and are maintaining these policies
and procedures, in accordance (or substantially in accordance) with
the proposed rule amendments.
    \159\ See supra note 112 and accompanying text.
    \160\ See supra note 116 and accompanying text.
    \161\ See supra note 114 and accompanying text.
    \162\ See supra note 119 and accompanying text.
---------------------------------------------------------------------------

    We request comment on our estimated costs and our rationale
underlying them, and any aspect of the estimates or other costs that we
have not considered. We seek information about particular costs of
compliance as well as information as to any overall percentage increase
in costs that firms would likely incur as a result of the proposed
amendments. We request comment accompanied with statistical or other
quantitative information, and comment on the experiences of
institutions in addressing the circumstances addressed above.
Commenters should identify the metrics of any empirical data that
support their cost estimates.

B. Costs and Benefits of Broadened Scope of Information and of Covered
Institutions

    The proposed rule amendments would broaden the scope of information
covered by the safeguards and disposal rules. From the perspective of
ease of compliance, we anticipate that institutions would benefit from
having a common set of rules that apply to both nonpublic personal
information about customers and consumer report information. We also
expect that investors would benefit from expanding the scope of
information covered by the safeguards and disposal rules because both
terms exclude some information that without protections could more
easily be used to obtain unauthorized access to investors' personal
financial information. Because we expect that this expansion of the
scope of information covered by the safeguards and disposal rules would
not require modification of institutions' current policies and
procedures, or their systems and databases for implementing these
policies and procedures, and because many firms currently protect
nonpublic personal information about customers and consumer report
information in the same way, we expect that the proposal would result
in no significant, if any, additional costs to institutions.
    The amendments also would expand the scope of the safeguards rule
to include registered transfer agents, limit the scope of the
safeguards rule to exclude notice-registered broker-dealers, and extend
the disposal rule to apply to natural persons. As noted above, bringing
registered transfer agents within the scope of our safeguards rule
should benefit investors because these institutions maintain sensitive
personal information. We included registered transfer agents in our
estimate of the costs of the proposed information security and security
breach procedures above.\163\ Because transfer agents are currently
subject to the FTC Safeguards Rule, which, if the proposed amendments
were adopted, would be substantially similar to the Commission's
safeguards and disposal rules, we do not anticipate that there would be
any unique or unusual costs to transfer agents, beyond those discussed
above. Similarly, we do not anticipate any costs or benefits resulting
from the proposal to exclude notice-registered broker-dealers from
Regulation S-P because they would be subject to the CFTC's
substantially similar safeguards rules. This proposal would simply
clarify that notice-registered broker-dealers need not comply with both
Regulation S-P and the CFTC's rules.
---------------------------------------------------------------------------

    \163\ See supra section V.A.2.
---------------------------------------------------------------------------

    We expect that the proposal to include natural persons within the
scope of the disposal rule would benefit investors by establishing a
system designed to ensure that personal information is disposed of
properly by employees, particularly those who may work in branches far
from a covered institution's main office. We also believe that this
proposal would benefit investors by requiring compliance by natural
persons, associated with a covered institution, who are directly
responsible for properly disposing of personal information consistent
with the institution's policies. We do not expect that this proposal
would result in costs to institutions beyond those that would be
imposed by the more specific standards analyzed above in section V.A.2.
Specifically, we believe that any changes that would be required to
covered institutions' policies and procedures or training programs to
make it clear that individuals (not just firms) would have
responsibility for complying with the disposal rule are captured in our
estimates above.
    We request comment on these estimates of benefits and costs and our
rationale underlying them, and any aspect of the estimates or other
benefits or costs that we have not considered. In particular, we
request comment accompanied with statistical or other quantitative
evidence, and comment on the experiences of institutions in addressing
the circumstances addressed above. Commenters should identify the
metrics and sources of any empirical data that support their cost
estimates.

C. Costs and Benefits of Maintaining Written Records

    The proposed amendments would require covered institutions to
maintain

and preserve, in an easily accessible place, written records of the
safeguards and disposal policies and procedures. The amendments also
would require that institutions document compliance with their policies
and procedures, and that records would have to be maintained for a
period consistent with current requirements for similar records. We
expect that this proposal would benefit investors by enabling the
Commission's examination staff to evaluate whether institutions are in
compliance with the requirements of the proposed amendments to the
safeguards and disposal rules. We anticipate that institutions are
unlikely to incur significant costs in maintaining records or
documenting compliance to meet the requirements of this proposal
because we would expect to establish a date for compliance with these
amendments that would permit institutions to document and maintain
these records in the normal course of ordinary business. Thus, we do
not expect that this proposal would result in costs to institutions
beyond those that would be imposed by the more specific standards
analyzed above in section V.A.2.
    We request comment on these estimates of benefits and costs and our
rationale underlying them, and any aspect of the estimates or other
benefits or costs that we have not considered. In particular, we
request comment accompanied with statistical or other quantitative
evidence, and comment on the experiences of institutions in addressing
the circumstances addressed above. Commenters should identify the
metrics and sources of any empirical data that support their cost
estimates.

D. Costs and Benefits of Proposed New Exception

    Our proposed amendments would create a new exception from
Regulation S-P's notice and opt out requirements for disclosures of
limited information in connection with the departure of a
representative of a broker-dealer or investment adviser. The proposal
should enhance information security by providing a clear framework for
transferring limited information from one firm to another in this
context. At firms that choose to rely on it, the proposed exception
also should reduce potential incentives some representatives may have
to take information with them secretly when they leave. In addition,
the amendment should promote investor choice regarding whether to
follow a departing representative to another firm. Institutions that
choose to rely on the proposed exception also should benefit from the
greater legal certainty that it would provide. We expect that
institutions would incur minimal costs in retaining a written record of
the information that would be disclosed in connection with a
representative's departure, and expect that for a number of firms such
costs are incurred already in the ordinary course of business.\164\
Institutions need not provide these disclosures. Thus we anticipate
that only those that expect the potential benefits from the disclosure
would justify any associated costs would make the disclosures.
---------------------------------------------------------------------------

    \164\ See supra note 91 and accompanying text.
---------------------------------------------------------------------------

    We request comment on this cost estimate and our rationale
underlying it, and any aspect of the estimates or other costs that we
have not considered. In particular, we request comment accompanied with
statistical or other quantitative evidence, and the experiences of
institutions in addressing the circumstances addressed above.
Commenters should identify the metrics and sources of any empirical
data that support their cost estimates.

E. Request for Comment

    We request comment on all aspects of this cost-benefit analysis,
including comment as to whether the estimates we have used in our
analysis are reasonable. We welcome comment on any aspect of our
analysis, the estimates we have made, and the assumptions we have
described. In particular, we request comment as to any costs or
benefits we may not have considered here that could result from the
adoption of the proposed amendments. We also request comment on the
numerical estimates we have made here, and request comment and specific
costs and benefits from covered institutions that have experienced any
of the situations analyzed above.

VI. Initial Regulatory Flexibility Analysis

    This Initial Regulatory Flexibility Analysis (``IRFA'') has been
prepared in accordance with 5 U.S.C. 603. It relates to proposed
amendments to Regulation S-P that seek to strengthen the protections
for safeguarding and disposing of sensitive personal information and
provide a limited exception to notice and opt out requirements intended
to augment investors' ability to choose whether to follow personnel who
move from one broker-dealer or registered investment adviser to
another. The proposed amendments would: (i) Require covered
institutions to adopt more specific standards under the safeguards
rule, including standards that would apply to security breach
incidents; (ii) broaden the scope of information and the types of
institutions and persons covered by the rules; and (iii) require
covered institutions to maintain written records of the policies and
procedures and their ongoing compliance with those polices and
procedures. The proposed amendments also would require covered
institutions seeking to rely on the new exception related to departing
representatives to maintain a record of the information disclosed under
the exception to a representative's new firm.

A. Reasons for the Proposed Action

    We have become concerned with the significant increase in the
number of information security breaches that have come to light in
recent years and the potential created by such breaches for misuse of
personal financial information, including identity theft. We are
concerned that some firms do not regularly reevaluate and update their
safeguarding programs to deal with increasingly sophisticated methods
of attack. To help prevent and address security breaches at covered
institutions, we propose to require more specific standards for
safeguarding personal information, including standards for responding
to data security breaches. In order to provide better protection
against unauthorized disclosure of personal financial information, we
believe that the scope of information covered by the current safeguards
and disposal rules should be broader.
    We also propose a new exception to Regulation S-P's notice and opt
out requirements to permit limited disclosures of investor information
when a registered representative of a broker-dealer or a supervised
person of an investment adviser moves from one brokerage or advisory
firm to another. The proposed exception should provide legal certainty
to firms that choose to rely on it and reduce incentives some
representatives may have to take information with them secretly when
they leave. We believe this amendment also would help to augment
investors' ability to choose whether or not to follow a departing
representative to another firm.

B. Objectives of the Proposed Action

    The overall objectives of the proposed amendments are to: (i)
Strengthen the protections for safeguarding and disposing of sensitive
personal information; and (ii) provide a limited exception to
Regulation S-P's notice and opt out requirements that would preserve
investors' ability to choose whether to follow personnel who move

from one broker-dealer or investment adviser to another. We believe
that the proposed amendments would help to:
     Prevent and mitigate information security breach
incidents;
     Ensure that sensitive financial information is not
disposed of improperly;
     Ensure that firms regularly review and update their
safeguarding policies and procedures;
     Ensure that the full range of appropriate information and
all relevant types of institutions regulated by the Commission are
covered by Regulation S-P's requirements; and
     Enhance information security at firms choosing to rely on
a new exemption for disclosures of limited information when
representatives move from one firm to another by providing a clear
framework for such disclosures and promote investor choice regarding
whether or not to follow a departing representative to another firm.

C. Legal Basis

    The amendments to Regulation S-P are proposed pursuant to the
authority set forth in Sections 501, 504, 505, and 525 of the GLBA,
Section 628(a)(1) of the FCRA, Sections 17, 17A, 23, and 36 of the
Exchange Act, Sections 31(a) and 38 of the Investment Company Act, and
Sections 204 and 211 of the Investment Advisers Act.\165\
---------------------------------------------------------------------------

    \165\ 15 U.S.C. 6801, 6804, 6805, and 6825; 15 U.S.C.
1681w(a)(1); 15 U.S.C. 78q, 78q-1, 78w, and 78mm; 15 U.S.C. 80a-
30(a), 80a-37; and 15 U.S.C. 80b-4, 80b-11.
---------------------------------------------------------------------------

D. Small Entities Subject to the Proposed Rule Amendments

    The proposed amendments to Regulation S-P would affect brokers,
dealers, registered investment advisers, investment companies, and
registered transfer agents, including entities that are considered to
be a small business or small organization (collectively, ``small
entity'') for purposes of the Regulatory Flexibility Act. For purposes
of the Regulatory Flexibility Act, under the Exchange Act a broker or
dealer is a small entity if it: (i) Had total capital of less than
$500,000 on the date in its prior fiscal year as of which its audited
financial statements were prepared or, if not required to file audited
financial statements, on the last business day of its prior fiscal
year; and (ii) is not affiliated with any person that is not a small
entity.\166\ A registered transfer agent is a small entity if it: (i)
Received less than 500 items for transfer and less than 500 items for
processing during the preceding six months; (ii) transferred items only
of issuers that are small entities; (iii) maintained master shareholder
files that in the aggregate contained less than 1,000 shareholder
accounts or was the named transfer agent for less than 1,000
shareholder accounts at all times during the preceding fiscal year; and
(iv) is not affiliated with any person that is not a small entity.\167\
Under the Investment Company Act, investment companies are considered
small entities if they, together with other funds in the same group of
related funds, have net assets of $50 million or less as of the end of
its most recent fiscal year.\168\ Under the Investment Advisers Act, a
small entity is an investment adviser that: (i) Manages less than $25
million in assets; (ii) has total assets of less than $5 million on the
last day of its most recent fiscal year; and (iii) does not control, is
not controlled by, and is not under common control with another
investment adviser that manages $25 million or more in assets, or any
person that has had total assets of $5 million or more on the last day
of the most recent fiscal year.\169\
---------------------------------------------------------------------------

    \166\ 17 CFR 240.0-10.
    \167\ Id.
    \168\ 17 CFR 270.0-10.
    \169\ 17 CFR 275.0-7.
---------------------------------------------------------------------------

    Based on Commission filings, we estimate that 894 broker-dealers,
153 registered transfer agents, 203 investment companies, and 760
registered investment advisers may be considered small entities.

E. Reporting, Recordkeeping, and Other Compliance Requirements

    The proposed amendments to Regulation S-P would require more
specific compliance requirements and create new reporting requirements
for institutions that experience a breach of information security. The
proposed amendments also would introduce new mandatory recordkeeping
requirements.
    Under the proposed amendments to Regulation S-P, covered
institutions would have to develop, implement, and maintain a
comprehensive ``information security program'' for protecting personal
information and responding to unauthorized access to or use of personal
information. We expect that some covered institutions, including
covered institutions that are small entities, would be required to
supplement their current costs by the costs involved in reviewing and,
as appropriate, revising their current safeguarding policies and
procedures, including their data security breach response procedures
and disposal rule procedures, to comply with the more specific
requirements of the proposed amendments. Initially this would require
institutions to: (i) Designate an employee or employees as coordinator
for their information security program; (ii) identify in writing
reasonably foreseeable security risks that could result in the
unauthorized or compromise of personal information or personal
information systems; (iii) create a written record of their design and
implementation of their safeguards to control identified risks; (iv)
train staff to implement their information security program; and (v)
oversee service providers and document that oversight in writing.
    Institutions also would have to review existing safeguarding
procedures relating to data security breach incidents. This would
include: (i) Assessing current policies and procedures for responding
to data breach incidents; and (ii) designing and implementing written
policies and procedures to assess, control, and investigate incidents
of unauthorized access or use of sensitive personal information, as
well as policies and procedures for, under certain conditions,
notifying individuals and the Commission or, in the case of a broker-
dealer, the appropriate designated examining authority.
    To comply with these amendments on an ongoing basis, institutions
would have to implement procedures to: (i) Regularly test or monitor,
and maintain a written record of the effectiveness of their safeguards'
key controls, systems and procedures (including access controls,
controls related to data security breach incidents, and controls
related to employee training and supervision); (ii) augment staff
training as necessary; (iii) provide continued oversight of service
providers; and (iv) regularly evaluate and adjust their information
security program in light of their regular testing and monitoring,
changes in technology, their business operations or arrangements, and
other material circumstances.
    Institutions also would have to respond appropriately to incidents
of data security breach as may occur on an ongoing basis. This would
include following their written procedures to: (i) Assess the nature
and scope of the incident; (ii) take appropriate steps to contain and
control the incident; (iii) promptly conduct a reasonable investigation
and make a written determination of the likelihood that sensitive
personal information has been or will be misused; (iv) if misuse of
information has occurred or is reasonably likely, notify affected
individuals as soon as possible; and (v) if an individual identified
with the information has suffered substantial

harm or inconvenience, or any unauthorized person has intentionally
obtained access to or used sensitive personal information, notify the
Commission or an appropriate designated examining authority as soon as
possible on proposed Form SP-30.
    Overall, we expect there would be incremental costs associated with
the proposed amendments to Regulation S-P. Some proportion of large or
small institutions would be likely to experience some increase in costs
to comply with the proposed amendments if they are adopted.
    More specifically, we estimate that with respect to the more
specific safeguarding elements, covered institutions would incur one-
time costs that could include the costs of assessment and revision of
safeguarding standards, staff training, and reviewing and entering into
contracts with service providers.\170\ We also estimate that the
ongoing, long-term costs associated with the proposed amendments could
include costs of regularly testing or monitoring the safeguards,
augmenting staff training, providing continued oversight of service
providers, evaluating and adjusting safeguards, and responding
appropriately to incidents of data security breach.\171\
---------------------------------------------------------------------------

    \170\ See supra section IV.A.3.
    \171\ Id.
---------------------------------------------------------------------------

    We encourage written comments regarding this analysis. We solicit
comments as to whether the proposed amendments could have an effect
that we have not considered. We also request that commenters describe
the nature of any impact on small entities and provide empirical data
to support the extent of the impact.

F. Duplicative, Overlapping, or Conflicting Federal Rules

    As discussed above, the proposed amendments would impose
requirements that covered institutions maintain and document a written
information security program. The proposed amendments also would
require reporting to individuals and appropriate regulators after
certain serious data breach incidents. Covered institutions are subject
to requirements elsewhere under the federal securities laws and rules
of the self-regulatory organizations that require them to adopt written
policies and procedures that may relate to some similar issues.\172\
The proposed amendments to Regulation S-P, however, would not require
covered institutions to maintain duplicate copies of records covered by
the rule, and an institution's information security program would not
have to be maintained in a single location. Moreover, although the
proposed amendments would require covered institutions to keep certain
records that may be required under existing recordkeeping rules, the
purposes of the requirements are different, and institutions need not
maintain duplicates of the records themselves.\173\ We believe,
therefore, that any duplication of regulatory requirements would be
limited and would not impose significant additional costs on covered
institutions including small entities. We believe there are no other
federal rules that duplicate, overlap, or conflict with the proposed
reporting requirements.
---------------------------------------------------------------------------

    \172\ See, e.g., 15 U.S.C. 80b-4a (requiring each adviser
registered with the Commission to have written policies and
procedures reasonably designed to prevent misuse of material non-
public information by the adviser or persons associated with the
adviser); and NASD Rule 3010 (requiring each broker-dealer to
establish and maintain written procedures to supervise the types of
business it is engaged in and to supervise the activities of
registered representatives and associated persons, which could
include registered investment advisers).
    \173\ See, e.g., 17 CFR 240.17a-3 (requiring broker-dealers to
make and keep, among other things, blotters or other records of
original entry, securities position records, and order tickets) and
17 CFR 270.31a-1(b)(11) (requiring investment companies to maintain,
among other things, minute books of directors' meetings and ``files
of all advisory material received from the investment adviser'').
---------------------------------------------------------------------------

G. Significant Alternatives

    The Regulatory Flexibility Act directs us to consider significant
alternatives that would accomplish the stated objectives, while
minimizing any significant adverse impact on small entities. In
connection with the proposed amendments, we considered the following
alternatives:
    (i) Establishing different compliance or reporting standards that
take into account the resources available to small entities;
    (ii) The clarification, consolidation, or simplification of the
reporting and compliance requirements under the rule for small
entities;
    (iii) Use of performance rather than design standards; and
    (iv) Exempting small entities from coverage of the rule, or any
part of the rule.
    With regard to the first alternative, we have proposed amendments
to Regulation S-P that would continue to permit institutions
substantial flexibility to design safeguarding policies and procedures
appropriate for their size and complexity, the nature and scope of
their activities, and the sensitivity of the personal information at
issue. We nevertheless believe it necessary to provide a more specific
framework of elements that every institution should consider and
address, regardless of its size. The proposed amendments to Regulation
S-P arise from our concern with the increasing number of information
security breaches that have come to light in recent years, particularly
those involving institutions regulated by the Commission. Establishing
different compliance or reporting requirements for small entities could
lead to less favorable protections for these entities' customers and
compromise the effectiveness of the proposed amendments.
    With regard to the second alternative, we believe that the proposed
amendments should, by their operation, simplify reporting and
compliance requirements for small entities. Small covered institutions
are likely to maintain personal information on fewer individuals than
large covered institutions, and they are likely to have relatively
simple personal information systems. Under proposed paragraph (a)(1) of
Section 30, the information security programs that would be required by
the proposed amendments would have to be appropriate to a covered
institution's size and complexity, and the nature and scope of its
activities. Accordingly, we believe that the requirements of the
proposed amendment already would be simplified for small entities. We
also believe that the requirements of the proposed amendments could not
be further simplified, or clarified or consolidated, without
compromising the investor protection objectives the proposed amendments
are designed to achieve.
    With regard to the third alternative, the proposed amendments are
for the most part performance based. Rather than specifying the types
of policies and procedures or the technologies that an institution
would be required to use to safeguard personal information, the
proposed amendments would require the institution to assess the types
of risks that it is likely to face and to address those in the manner
the institution believes most appropriate. With respect to the specific
requirements regarding notifications in the event of a data security
breach, we have proposed that institutions provide only the information
that seems most relevant for the Commission, a self-regulatory
organization, or a consumer to know in order to adequately assess the
potential damage that could result from the breach and to develop an
appropriate response.
    Finally, with regard to alternative four, we believe that an
exemption for small entities would not be appropriate.

Small entities are as vulnerable as large ones to the types of data
security breach incidents we are trying to address. We believe that the
specific elements we have proposed must be considered and incorporated
into the policies and procedures of all covered institutions,
regardless of their size, to mitigate the potential for fraud or other
substantial harm or inconvenience to investors. Exempting small
entities from coverage of the proposed amendments or any part of the
proposed amendments could compromise the effectiveness of the proposed
amendments and harm investors by lowering standards for safeguarding
investor information maintained by small covered institutions.
Excluding small entities from requirements that would be applicable to
larger covered institutions also could create competitive disparities
between large and small entities, for example by undermining investor
confidence in the security of information maintained by small covered
institutions.
    We request comment on whether it is feasible or necessary for small
entities to have special requirements or timetables for, or exemptions
from, compliance with the proposed amendments. In particular, could any
of the proposed amendments be altered in order to ease the regulatory
burden on small entities, without sacrificing the effectiveness of the
proposed amendments?

H. Request for Comments

    We encourage the submission of comments with respect to any aspect
of this IRFA. In particular, we request comments regarding: (i) The
number of small entities that may be affected by the proposed
amendments; (ii) the existence or nature of the potential impact of the
proposed amendments on small entities discussed in the analysis; and
(iii) how to quantify the impact of the proposed amendments. Commenters
are asked to describe the nature of any impact and provide empirical
data supporting the extent of the impact. Such comments will be
considered in the preparation of the Final Regulatory Flexibility
Analysis, if the proposed amendments are adopted, and will be placed in
the same public file as comments on the proposed amendments. Comments
should be submitted to the Commission at the addresses previously
indicated.

VII. Consideration of Burden on Competition and Promotion of
Efficiency, Competition and Capital Formation

    Exchange Act Section 23(a)(2) requires us, when adopting rules
under the Exchange Act, to consider the impact any new rule would have
on competition.\174\ In addition, Section 23(a)(2) prohibits us from
adopting any rule that would impose a burden on competition not
necessary or appropriate in furtherance of the purposes of Title I of
the Exchange Act. The proposed amendments to Regulation S-P would: (i)
Require more specific standards under the safeguards rule, including
standards that would apply to data security breach incidents; (ii)
broaden the scope of information and the types of institutions and
persons covered by the safeguards and disposal rules; and (iii) require
covered institutions to maintain written records of their policies and
procedures and their compliance with those policies and procedures. The
proposed amendments also would create a new exception from Regulation
S-P's notice and opt-out requirements for firms to transfer limited
investor information regarding clients of departing representatives to
those representatives' new firms.
---------------------------------------------------------------------------

    \174\ 15 U.S.C. 78w(a)(2).
---------------------------------------------------------------------------

    Other financial institutions are currently subject to substantially
similar safeguarding and data breach response requirements under rules
adopted by the Banking Agencies and the FTC. Under the proposed
amendments, all financial institutions would have to bear similar costs
in implementing substantially similar rules thus enhancing competition.
We expect that the proposed amendment to create the new exception for
firms to transfer limited investor information regarding clients of
departing representatives to those representatives' new firms would not
limit and might promote competition in the securities industry by
providing legal certainty for firms that choose to rely on it and by
facilitating the transition for customers who choose to follow a
departing representative to a new firm.
    In addition, Exchange Act Section 3(f), Investment Company Act
Section 2(c), and Investment Advisers Act Section 202(c) require us,
when engaging in rulemaking where we are required to consider or
determine whether an action is necessary or appropriate in the public
interest, to consider, in addition to the protection of investors,
whether the action will promote efficiency, competition, and capital
formation.\175\ Our analysis on competition is discussed above. As
discussed above, the proposed amendments could result in additional
costs for covered institutions, which could affect the efficiency of
these institutions. On the other hand, the amendments could promote
investor confidence and bring new investors to these institutions. In
the long term, the proposed amendments also could help reduce covered
institutions' costs by mitigating the frequency and consequences of
information security breaches. We do not believe the proposed
amendments would have a significant effect on capital formation,
although if the proposals lead to better information security practices
at covered institutions, potential investors could feel more
comfortable investing money in the capital markets. As a result, we
expect that the potential additional expense of compliance with these
proposed rule amendments would have little, if any, adverse effect on
efficiency, competition, and capital formation.
---------------------------------------------------------------------------

    \175\ 15 U.S.C. 78c(f); 15 U.S.C. 80a-2(c); and 15 U.S.C. 80b-
2(c).
---------------------------------------------------------------------------

    We request comment as to whether our estimates of the burdens the
proposed amendments would have on covered institutions are reasonable.
We welcome comment on any aspect of this analysis, and specifically
request comment on any effect the proposed amendments might have on the
promotion of efficiency, competition, and capital formation that we
have not considered. Would the proposed amendments or their resulting
costs affect the efficiency, competition, and capital formation of
covered institutions and their businesses? Commenters are requested to
provide empirical data and other factual support for their views to the
extent possible.

VIII. Small Business Regulatory Enforcement Fairness Act

    For purposes of the Small Business Regulatory Enforcement Fairness
Act of 1996, or ``SBREFA,'' \176\ we must advise OMB as to whether the
proposed regulation constitutes a ``major'' rule. Under SBREFA, a rule
is considered ``major'' if, upon adoption, it results or is likely to
result in:
---------------------------------------------------------------------------

    \176\ Pub. L. No. 104-121, Title II, 110 Stat. 857 (1996)
(codified in various sections of titles 5 and 15 of the United
States Code, and as a note to 5 U.S.C. 601).
---------------------------------------------------------------------------

     An annual effect on the economy of $100 million or more
(either in the form of an increase or a decrease);
     A major increase in costs or prices for consumers or
individual industries; or
     Significant adverse effect on competition, investment or
innovation.
    If a rule is ``major,'' its effectiveness will generally be delayed
for 60 days pending Congressional review. We

request comment on the potential impact of the proposed regulation on
the economy on an annual basis. Commenters are requested to provide
empirical data and other factual support for their view to the extent
possible.

IX. Statutory Authority

    The Commission is proposing to amend Regulation S-P pursuant to
authority set forth in Sections 501, 504, 505 and 525 of the GLBA (15
U.S.C. 6801, 6804, 6805 and 6825), Section 628(a)(1) of the FCRA (15
U.S.C. 1681w(a)(1)), Sections 17, 17A, 23, and 36 of the Exchange Act
(15 U.S.C. 78q, 78q-1, 78w, and 78mm), Sections 31(a) and 38 of the
Investment Company Act (15 U.S.C. 80a-30(a) and 80a-37), and Sections
204 and 211 of the Investment Advisers Act (15 U.S.C. 80b-4 and 80b-
11).

X. Text of Proposed Rules and Rule Amendments

List of Subjects in 17 CFR Part 248

    Brokers, Dealers, Investment advisers, Investment companies,
Privacy, Reporting and recordkeeping requirements, Transfer agents.

    For the reasons set out in the preamble, the Commission proposes to
amend 17 CFR part 248 as follows.
    1. Revise the heading of part 248 to read as follows:

PART 248--REGULATION S-P: PRIVACY OF CONSUMER FINANCIAL INFORMATION
AND SAFEGUARDING PERSONAL INFORMATION

    2. Revise the authority citation for part 248 to read as follows:

    Authority: 15 U.S.C. 78q, 78q-1, 78w, 78mm, 80a-30(a), 80a-37,
80b-4, 80b-11, 1681w(a)(1), 6801-6809, and 6825.

    3. Section 248.1(b) is amended by removing ``(b)'' from the
reference to ``Sec.  248.30(b)'' in the first sentence of the
paragraph.
    4. Section 248.2(b) is amended by removing ``(b)'' from the
reference to ``Sec.  248.30(b)'' in the first sentence.
    5. Section 248.3(u) is amended by:
    a. Removing ``or'' at the end of paragraph (u)(1)(ii);
    b. Removing the period at the end of paragraph (u)(1)(iii) and in
its place adding ``; or''; and
    d. Adding paragraph (u)(1)(iv) to read as follows:

Sec.  248.3  Definitions.

* * * * *
    (u) * * *
    (1) * * *
    (iv) Handled or maintained by you or on your behalf that is
identified with any consumer, or with any employee, investor, or
securityholder who is a natural person.
* * * * *
    6. Remove the heading of subpart A of part 248 and add in its place
the following undesignated center heading: ``Privacy and Opt Out
Notices''.
    7. Remove the heading of subpart B of part 248 and add in its place
the following undesignated center heading: ``Limits on Disclosures''.
    8. Remove the heading of subpart C of part 248 and add in its place
the following undesignated center heading: ``Exceptions''.
    9. Section 248.15 is amended by:
    a. Removing the word ``or'' at the end of paragraph (a)(6);
    b. Removing the period at the end of paragraph (a)(7)(iii) and in
its place adding ``; or''; and
    c. Adding paragraph (a)(8).
    The addition reads as follows:

Sec.  248.15  Other exceptions to notice and opt out requirements.

    (a) * * *
    (8) To a broker, dealer, or investment adviser registered with the
Commission in order to allow one of your representatives who leaves you
to become the representative of another broker, dealer, or registered
investment adviser to solicit customers to whom the representative
personally provided a financial product or service on your behalf,
provided:
    (i) The information is limited to a customer's name, a general
description of the type of account and products held by the customer,
and the customer's contact information, including the customer's
address, telephone number, and email information;
    (ii) The information does not include any customer's account
number, Social Security number, or securities positions; and
    (iii) You require your departing representative to provide to you,
not later than the representative's separation from employment with
you, a written record of the information that will be disclosed
pursuant to this exception, and you maintain and preserve such records
under Sec.  248.30(c).
    (iv) For purposes of this section, representative means:
    (A) A natural person associated with a broker or dealer registered
with the Commission, who is registered or approved in compliance with
Sec.  240.15b7-1 of this chapter; or
    (B) A supervised person of an investment adviser as defined in
section 202(a)(25) of the Investment Advisers Act of 1940 (15 U.S.C.
80b-2(a)(25)).
    10. Remove the heading of subpart D of part 248 and add in its
place the following undesignated center heading: ``Relation to Other
Laws; Effective Date''.
    11. Amend part 248 by adding the undesignated center heading,
``Information Security Programs'' before Sec.  248.30, and revising
Sec.  248.30 to read as follows:
INFORMATION SECURITY PROGRAMS

Sec.  248.30  Information security programs for personal information;
records of compliance.

    (a) Information security programs.--(1) General requirements. Every
broker or dealer other than a notice-registered broker or dealer, every
investment company, and every investment adviser or transfer agent
registered with the Commission, must develop, implement, and maintain a
comprehensive information security program. Your program must include
written policies and procedures that provide administrative, technical,
and physical safeguards for protecting personal information, and for
responding to unauthorized access to or use of personal information.
Your program also must be appropriate to your size and complexity, the
nature and scope of your activities, and the sensitivity of any
personal information at issue.
    (2) Objectives. Your information security program must be
reasonably designed to:
    (i) Ensure the security and confidentiality of personal
information;
    (ii) Protect against any anticipated threats or hazards to the
security or integrity of personal information; and
    (iii) Protect against unauthorized access to or use of personal
information that could result in substantial harm or inconvenience to
any consumer, employee, investor or securityholder who is a natural
person.
    (3) Safeguards. In order to develop, implement, and maintain your
information security program, you must:
    (i) Designate in writing an employee or employees to coordinate
your information security program;
    (ii) Identify in writing reasonably foreseeable internal and
external risks to the security, confidentiality, and integrity of
personal information and personal information systems that could result
in the unauthorized disclosure, misuse, alteration, destruction or
other compromise of such information or systems;
    (iii) Design and implement safeguards to control the risks you
identify, and maintain a written record of your design;
    (iv) Regularly test or otherwise monitor, and maintain a written
record

of the effectiveness of the safeguards' key controls, systems, and
procedures, including the effectiveness of:
    (A) Access controls on personal information systems;
    (B) Controls to detect, prevent and respond to incidents of
unauthorized access to or use of personal information; and
    (C) Employee training and supervision relating to your information
security program.
    (v) Train staff to implement your information security program;
    (vi) Oversee service providers, and document in writing that in
your oversight you are:
    (A) Taking reasonable steps to select and retain service providers
that are capable of maintaining appropriate safeguards for the personal
information at issue; and
    (B) Requiring your service providers by contract to implement and
maintain appropriate safeguards; and
    (vii) Evaluate and adjust your information security program
accordingly in light of:
    (A) The results of the testing and monitoring required by paragraph
(a)(3)(iv) of this section;
    (B) Relevant changes in technology;
    (C) Any material changes to your operations or business
arrangements; and
    (D) Any other circumstances that you know or reasonably believe may
have a material impact on your information security program.
    (4) Procedures for responding to unauthorized access or use. At a
minimum, your information security program must include written
procedures to:
    (i) Assess the nature and scope of any incident involving
unauthorized access to or use of personal information, and maintain a
written record of the personal information systems and types of
personal information that may have been accessed or misused;
    (ii) Take appropriate steps to contain and control the incident to
prevent further unauthorized access to or use of personal information
and maintain a written record of the steps you take;
    (iii) After becoming aware of an incident of unauthorized access to
sensitive personal information, promptly conduct a reasonable
investigation, determine the likelihood that the information has been
or will be misused, and maintain a written record of your
determination;
    (iv) If you determine that misuse of the information has occurred
or is reasonably possible, notify each individual with whom the
information is identified as soon as possible in accordance with
paragraph (a)(5) of this section and maintain a written record that you
provided notification; provided however that if an appropriate law
enforcement agency determines that notification will interfere with a
criminal investigation and requests in writing that you delay
notification, you may delay notification until it no longer interferes
with the criminal investigation; and
    (v) If you are a broker or dealer other than a notice-registered
broker or dealer, provide written notice on Form SP-30 to your
designated examining authority (see 17 CFR 240.17d-1), and, if you are
an investment company or an investment adviser or transfer agent
registered with the Commission, provide written notice on Form SP-30 to
the principal office of the Commission, as soon as possible after you
become aware of any incident of unauthorized access to or use of
personal information in which:
    (A) There is a significant risk that an individual identified with
the information might suffer substantial harm or inconvenience; or
    (B) An unauthorized person has intentionally obtained access to or
used sensitive personal information.
    (5) Notifying individuals of unauthorized access or use. If you
determine that an unauthorized person has obtained access to or used
sensitive personal information, and you determine that misuse of the
information has occurred or is reasonably possible, you must notify
each individual with whom the information is identified in a clear and
conspicuous manner and by a means designed to ensure that the
individual can reasonably be expected to receive it. The notice must:
    (i) Describe in general terms the incident and the type of
sensitive personal information that was the subject of unauthorized
access or use;
    (ii) Describe what you have done to protect the individual's
information from further unauthorized access or use;
    (iii) Include a toll-free telephone number to call, or if you do
not have any toll-free number, include a telephone number to call and
the address and the name of a specific office to write for further
information and assistance;
    (iv) If the individual has an account with you, recommend that the
individual review account statements and immediately report any
suspicious activity to you; and
    (v) Include information about the availability of online guidance
from the FTC regarding steps an individual can take to protect against
identity theft, a statement encouraging the individual to report any
incidents of identity theft to the FTC, and the FTC's Web site address
and toll-free telephone number that individuals may use to obtain the
identity theft guidance and report suspected incidents of identity
theft.
    (b) Disposal of personal information.--(1) Standard. Every broker
or dealer other than a notice-registered broker or dealer, every
investment company, every investment adviser or transfer agent
registered with the Commission, and every natural person who is an
associated person of a broker or dealer, a supervised person of an
investment adviser registered with the Commission, or an associated
person of a transfer agent registered with the Commission, that
maintains or otherwise possesses personal information for a business
purpose must properly dispose of the information by taking reasonable
measures to protect against unauthorized access to or use of the
information in connection with its disposal.
    (2) Written policies, procedures and records. Every broker or
dealer, other than a notice-registered broker or dealer, every
investment company, and every investment adviser and transfer agent
registered with the Commission must:
    (i) Adopt written policies and procedures that address the proper
disposal of personal information according to the requirements of
paragraph (b)(1) of this section; and
    (ii) Document in writing its proper disposal of personal
information in compliance with paragraph (b)(1) of this section.
    (3) Relation to other laws. Nothing in this paragraph (b) shall be
construed:
    (i) To require any broker, dealer, investment company, investment
adviser, transfer agent, associated person of a broker or dealer,
supervised person of an investment adviser, or associated person of a
transfer agent, to maintain or destroy any record pertaining to an
individual that is not imposed under other law; or
    (ii) To alter or affect any requirement imposed under any other
provision of law to maintain or destroy records.
    (c) Recordkeeping. (1) Every broker or dealer other than a notice-
registered broker or dealer, every investment company, and every
investment adviser or transfer agent registered with the Commission,
must make and maintain the records and written policies and procedures
required under paragraphs (a) and (b)(2) of this section. Every broker
or dealer other than a notice-registered broker or dealer, and every
investment adviser registered with the Commission seeking to rely on
the

exception in Sec.  248.15(a)(8) must make and maintain the records
required by Sec.  248.15(a)(8)(iii).
    (2) Starting from when the record was made, or from when the
written policy or procedure was last modified, the records and written
policies and procedures required under paragraphs (a) and (b)(2) of
this section, and the records made pursuant to Sec.  248.15(a)(8)(iii),
must be preserved in accordance with:
    (i) 17 CFR 240.17a-4(b) by a broker or dealer other than a notice-
registered broker or dealer;
    (ii) 240.17Ad-7(b) by a transfer agent registered with the
Commission;
    (iii) 270.31a-2(a)(4)-(6) by an investment company; and
    (iv) 275.204-2(e)(1) by an investment adviser registered with the
Commission.
    (d) Definitions. As used in this Sec.  248.30, unless the context
otherwise requires:
    (1) Associated person of a broker or dealer has the same meaning as
in section 3(a)(18) of the Securities Exchange Act of 1934 (15 U.S.C.
78c(a)(18)).
    (2) Associated person of a transfer agent has the same meaning as
in section 3(a)(49) of the Securities Exchange Act of 1934 (15 U.S.C.
78c(a)(49)).
    (3) Consumer report has the same meaning as in section 603(d) of
the Fair Credit Reporting Act (15 U.S.C. 1681a(d)).
    (4) Consumer report information means any record about an
individual, whether in paper, electronic or other form, that is a
consumer report or is derived from a consumer report. Consumer report
information also means a compilation of such records. Consumer report
information does not include information that does not identify
individuals, such as aggregate information or blind data.
    (5) Disposal means:
    (i) The discarding or abandonment of personal information; or
    (ii) The sale, donation, or transfer of any medium, including
computer equipment, on which personal information is stored.
    (6) Information security program means the administrative,
technical, or physical safeguards you use to access, collect,
distribute, process, protect, store, use, transmit, dispose of, or
otherwise handle personal information.
    (7) Notice-registered broker or dealer means a broker or dealer
registered by notice with the Commission under section 15(b)(11) of the
Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11)).
    (8) Personal information means any record containing consumer
report information, or nonpublic personal information as defined in
Sec.  248.3(t), that is identified with any consumer, or with any
employee, investor, or securityholder who is a natural person, whether
in paper, electronic, or other form, that is handled or maintained by
you or on your behalf.
    (9) Personal information system means any method used to access,
collect, store, use, transmit, protect, or dispose of personal
information.
    (10) Sensitive personal information means personal information, or
any combination of components of personal information, that would allow
an unauthorized person to use, log into, or access an individual's
account, or to establish a new account using the individual's
identifying information, including the individual's:
    (i) Social Security number; or
    (ii) Name, telephone number, street address, e-mail address, or
online user name, in combination with the individual's account number,
credit or debit card number, driver's license number, credit card
expiration date or security code, mother's maiden name, password,
personal identification number, biometric record, or other
authenticating information.
    (11) Service provider means any person or entity that receives,
maintains, processes, or otherwise is permitted access to personal
information through its provision of services directly to a broker,
dealer, investment company, or investment adviser or transfer agent
registered with the Commission.
    (12) (i) Substantial harm or inconvenience means personal injury,
or more than trivial financial loss, expenditure of effort or loss of
time, including theft, fraud, harassment, impersonation, intimidation,
damaged reputation, impaired eligibility for credit, or the
unauthorized use of information identified with an individual to obtain
a financial product or service, or to access, log into, effect a
transaction in, or otherwise use the individual's account.
    (ii) Substantial harm or inconvenience does not include
unintentional access to personal information by an unauthorized person
that results only in trivial financial loss, expenditure of effort or
loss of time, such as if use of the information results only in your
deciding to change the individual's account number or password.
    (13) Supervised person of an investment adviser has the same
meaning as in section 202(a)(25) of the Investment Advisers Act of 1940
(15 U.S.C. 80b-2(a)(25)).
    (14) Transfer agent has the same meaning as in section 3(a)(25) of
the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(25)).
    12. Redesignate Appendix A to part 248 as Appendix B to part 248,
and revise its heading to read as follows:
    Appendix B to part 248--Sample Clauses
    13. Add new Appendix A to part 248 to read as follows:

Appendix A to Part 248--Forms

    (1) Availability of Forms. Any person may obtain a copy of Form
S-P or Form SP-30 prescribed for use in this part by written request
to the Securities and Exchange Commission, 100 F Street, NE.,
Washington, DC 20549. Any person also may view the forms on the
Commission Web site as follows:
    (a) Form S-P at: [Web site URL];
    (b) Form SP-30 at: [Web site URL].
    (2) Form S-P. Use of Form S-P by brokers, dealers, and
investment companies, and by investment advisers registered with the
Commission, constitutes compliance with the notice content
requirements of Sec. Sec.  248.6 and 248.7.
    (3) Form SP-30. Form SP-30 must be used pursuant to Sec.
248.30(a)(4)(v) as the notice of an incident of unauthorized access
to or use of personal information to be filed with the appropriate
designated examining authority by brokers or dealers other than
notice-registered brokers or dealers, and to be filed with the
Commission by investment companies, and by investment advisers and
transfer agents registered with the Commission.
    14. Add Form SP-30 (referenced in paragraph (3) of Appendix A to
part 248) to read as follows:

    Note: The text of Form SP-30 does not, and this amendment will
not, appear in the Code of Federal Regulations.

UNITED STATES SECURITIES AND EXCHANGE COMMISSION

Washington, DC 20549

FORM SP-30

SECURITY INCIDENT REPORTING FORM

(Pursuant to Sec.  248.30(a)(4)(v) of Regulation S-P (17 CFR
248.30(a)(4)(v)))

    1. Provide identifying information (IARD/CRD number, CIK,*
business name, principal business and mailing addresses, and
telephone number).

    * CIK stands for ``Central Index Key,'' which is the unique
number the Commission assigns to each entity that submits filings to
it.
    2. Provide contact employee (name, title, address, and telephone
number).
    3. Type of Institution:

----Broker-Dealer
----Investment Adviser
----Investment Adviser/Broker-Dealer (Dual Registrant)
----Investment Company
----Transfer Agent

    4. Describe the security incident (e.g., unauthorized use of
your customers' online trading accounts, unauthorized use of your
employee's password to access sensitive personal information
maintained on one of your databases, or unauthorized access to your
files on an investment company's shareholders):
    (a) Provide the date(s) of the incident;
    (b) List Registrant's offices, divisions or branches involved;
    (c) Describe personal information system(s) compromised;
    (d) Describe the incident and identify anyone you reasonably
believe accessed or used personal information without authorization
or compromised the personal information system(s).
    5. Provide information on third-party service provider(s)
involved:
    (a) Identify any third-party service provider involved;
    (b) Describe the services provided;
    (c) If the service provider is an affiliate, describe the
affiliation;
    (d) Describe the involvement of the service provider(s) in the
incident.
    6. Describe steps taken or that you plan to take to assess the
incident.
    7. Provide the number of individuals whose information appears
to have been compromised:----------
    8. Describe steps you have taken or plan to take to prevent
improper use of any personal information that was or may be
compromised by the incident.
    9. Do you intend to notify affected individuals?
    (a) If yes, when?
    (b) If no, why not?
    10. Describe any steps you have taken or any plan to review your
policies and procedures in light of this incident.
    11. Describe Customer account losses (to the extent known).
    (a) Number of Customer Accounts Accessed: ----------
    (b) Unauthorized Money Transfers
    (i) Initial Customer Losses from Actual or Attempted
Unauthorized Transfers: $----------
    (ii) Mitigation of Customer Losses from Firm's Efforts
    (A) Surveillance/Investigative Intervention: $----------
    (B) Recoveries from Receiving Parties: $----------
    (C) Firm Compensation to Customers: $----------
    (iii) Net Customer Losses: $----------
    (c) Unauthorized Changes to Securities Portfolio (e.g., Pump and
Dump Schemes)
    (i) Initial Customer Losses from Actual or Attempted
Unauthorized Trading
    (A) Value of Accounts Before the Unauthorized Trading: $--------
--
    (B) Value of Accounts After the Unauthorized Trading: $--------
--
    (C) Initial Customer Losses/Gains: $----------
    (ii) Did the firm return the affected customer accounts to their
positions before the unauthorized trading? Yes/No
    (iii) Net Customer Losses/Gains: $----------

     Dated: March 4, 2008.

    By the Commission.
Nancy M. Morris,
Secretary.

[FR Doc. E8-4612 Filed 3-12-08; 8:45 am]

BILLING CODE 8011-01-P