notices, thereby avoiding the potential burdens of determining delivery
dates based on a new approach.
---------------------------------------------------------------------------

    \247\ See 17 CFR 248.8.
---------------------------------------------------------------------------

    In the second circumstance, if the institution's change in policies
or practices does not require a revised privacy notice, the institution
would be required to provide an annual privacy notice to customers
within 100 days of the change.\248\ This 100-day period is intended to
provide timely delivery of the updated privacy notice to customers who
were not informed prior to the institution's change in policies or
practices. Moreover, we preliminarily believe that a 100-day period
also generally avoids imposing significant additional costs on the
institution. Any 100-day period will accommodate the institution
delivering the privacy notice alongside any quarterly reporting to
customers. Proposed paragraph 248.5(e)(2)(iii) provides an example for
each scenario described above in which an institution must resume
delivering annual privacy notices.
---------------------------------------------------------------------------

    \248\ Proposed rule 248.5(e)(2)(ii).
---------------------------------------------------------------------------

    The proposed timing requirements for when an institution no longer
meets requirements for the exception and must resume delivering annual
privacy notices are designed to be consistent with the existing timing
requirements for privacy notice delivery in Regulation S-P, where
applicable. The proposed timing requirements also are intended to be
consistent with parallel CFTC, CFPB, and FTC rules.\249\ They also are
intended to provide clarity to institutions when a change in policies
and practices prevent an institution from relying on the annual privacy
notice delivery exception. In addition, providing timing provisions
consistent with those of the CFTC, CFPB, and FTC would facilitate
privacy notice delivery for affiliated financial institutions subject
to GLBA that are not broker-dealers, investment companies, or
registered investment advisers.
---------------------------------------------------------------------------

    \249\ See 17 CFR 160.5(D) (CFTC); 12 CFR 1016.5(e)(2) (CFPB); 16
CFR 313.5(e)(2) (FTC).
---------------------------------------------------------------------------

    We request comment on the proposed exception to the annual privacy
notice delivery requirement provisions, including the following:
    95. The proposed annual privacy notice exception is conditioned on
a broker-dealer, investment company, or registered investment adviser
not changing policies and practices related to the disclosure of
nonpublic personal information (i.e., information on policies and
practices required to be in a privacy notice under paragraphs
248.6(a)(2) through (5) and (9)). Should the exception remain available
when the institution makes minor or non-substantive changes to its
policies and practices? If so, how should we define the scope of
changes that would allow use of the exception?
    96. Should the proposed amendment include a provision for timing in
these circumstances? Should the rule require an institution to provide
notice by the time it has changed its disclosure policies and practices
so that it no longer meets the proposed conditions of the rule in all
circumstances? Should the proposed 100-day time period for

resumption of delivery of annual privacy notices be shorter or longer?
For example, should the period be shorter, such as 30, 60, or 90 days?
Should the period be longer, such as 120 or 150 days? Should it be a
qualitative standard? Or a qualitative standard with an upper ceiling?
Please explain.

F. Request for Comment on Limited Information Disclosure When Personnel
Leave Their Firms

    The Commission requests comment on adding an exception from the
notice and opt out requirements that would permit limited information
disclosure when personnel move from one brokerage or advisory firm to
another. The 2008 Proposal included an exception from the notice and
opt out requirements to permit limited disclosures of investor
information when a registered representative of a broker-dealer or a
supervised person of a registered investment adviser (collectively,
``departing personnel'') moved from one brokerage or advisory firm to
another. The exception that was previously proposed would have
permitted firms with departing personnel to share certain limited
customer contact information and supervise the information transfer,
and required them to retain the related records.\250\ To limit the risk
of identity theft or other abuses, the shared information could not
include any customer's account number, Social Security number, or
securities positions.\251\ In the 2008 Proposal, the Commission noted
that most firms seeking to rely on this proposed exception would not
have needed to revise their GLBA privacy notices, because they already
state in the notices that their disclosures of information not
specifically described include disclosures permitted by law, which
would include disclosures made pursuant to the proposed exception and
the other exceptions provided in section 15 of Regulation S-P.\252\
Although a few commenters supported the exception as proposed, many
expressed concerns about at least certain aspects of the
exception.\253\
---------------------------------------------------------------------------

    \250\ See 2008 Proposal, supra note 38, at 13702-04.
    \251\ See id. See 2008 Proposal, supra note 38, at 13703, n.94.
    \252\ See 2008 Proposal, supra note 38, at 13703, n.94.
    \253\ See e.g., Letter from Brendan Daly, Compliance Manager,
Commonwealth Financial Network (May 12, 2008); Letter from Alan E.
Sorcher, Managing Director and Associate General Counsel, SIFMA (May
12, 2008); Letter from Michael J. Mungenast, Chief Executive Officer
and President, ProEquities, Inc.; Julius L. Loeser, Chief Regulatory
and Compliance Counsel, Comerica Tower at Detroit Center, Corporate
Legal Department (May 9, 2008); and Letter from Becky Nilsen, Chief
Executive Officer, Desert Schools Federal Credit Union (May 12,
2008).
---------------------------------------------------------------------------

    As noted above, the Commission is not adding an exception from the
notice and opt out requirements in connection with this proposal.
However, the Commission requests comment on whether to permit the
limited disclosure of certain investor information when departing
personnel move from one brokerage or advisory firm to another,
including whether an exception from this proposal's notice and opt out
requirements would be appropriate:
    97. Would adopting such an exception from the notice and opt out
provisions of Regulation S-P be appropriate in light of the GLBA's
goals? If so, is there a need for an exception to permit a limited
disclosure of investor information when departing personnel moves from
one brokerage or advisory firm to another? If so, what are other
limitations, benefits, risks, or other considerations related to such
an exception?

G. Other Current Commission Rule Proposals

1. Covered Institutions Subject to the Regulation SCI Proposal and the
Exchange Act Cybersecurity Proposal
a. Discussion
i. Introduction
    In addition to the Regulation S-P proposal, the Commission is
proposing the Exchange Act Cybersecurity Proposal and is proposing to
amend Regulation SCI.\254\ As discussed in more detail below, certain
types of entities that would be subject to the proposed amendments to
Regulation S-P would also be subject to those proposed rules, if
adopted.\255\ As a result, such entities could be subject to multiple
requirements to maintain policies and procedures that address certain
types of cybersecurity risk,\256\ as well as obligations to provide
multiple forms of disclosure or notification related to a cybersecurity
event under the various proposals.\257\ While the Commission
preliminarily believes that these requirements are nonetheless
appropriate, it is seeking comment on the proposed amendments, given
the following: (1) each proposal has a different scope and purpose; (2)
the policies and procedures related to cybersecurity that would be
required under each of the proposed rules would not be inconsistent;
(3) the public disclosures or notifications required by the proposed
rules would require different types of information to be disclosed,
largely to different audiences at different times; and (4) it should be
appropriate for entities to comply with the proposed requirements.
---------------------------------------------------------------------------

    \254\ See Exchange Act Cybersecurity Proposal and Regulation SCI
Proposal, supra note 57.
    \255\ See 17 CFR 242.1000 through 1007 (Regulation SCI);
Regulation SCI Proposal, supra note 57; 17 CFR 248.1 through 248.30
(Regulation S-P); and Exchange Act Cybersecurity Proposal, supra
note 57.
    \256\ As discussed in more detail in the Exchange Act
Cybersecurity Proposal, NIST defines ``cybersecurity risk'' as ``an
effect of uncertainty on or within information and technology.'' See
Exchange Act Cybersecurity Proposal, supra note 57.
    \257\ For example, with respect to cybersecurity, both
Regulation SCI (currently and as it would be amended) and the
Exchange Act Cybersecurity Proposal have or would have provisions
requiring policies and procedures to address certain types of
cybersecurity risks. The proposed amendments to Regulation S-P also
would require policies and procedures regarding cybersecurity risks
to the extent that customer information or consumer information is
stored on an electronic information system that could potentially be
compromised (e.g., on a computer).
---------------------------------------------------------------------------

    The specific instances in which the regulations, currently and as
proposed to be amended, may relate to each other are discussed briefly
below. In addition, we encourage interested persons to provide comments
on the discussion below.
    More specifically, the Commission encourages commenters to identify
any areas where they believe the requirements of the proposed
amendments to Regulation S-P and the requirements of Regulation SCI
(currently and as it would be amended) and the Exchange Act
Cybersecurity Proposal is particularly costly or creates practical
implementation difficulties, provide details on what in particular
about implementation would be difficult, and how the duplication will
be costly or create such difficulties, and to make recommendations on
how to minimize these potential impacts. In addition, the Commission
encourages comments that explain how to achieve the goal of this
proposal to reduce or help mitigate the potential for harm to
individuals whose sensitive customer information has been accessed or
used without authorization. To assist this effort, the Commission is
seeking specific comment below on this topic.
b. Covered Institutions That Are or Would Also Be Subject to Regulation
SCI and the Exchange Act Cybersecurity Proposal
    Various covered institutions under this proposal are or would be
subject to Regulation SCI (currently and as it would be amended) and
the Exchange

Act Cybersecurity Proposal.\258\ For example, alternative trading
systems (``ATSs'') that trade certain stocks exceeding specific volume
thresholds are SCI Entities \259\ and would also be covered
institutions subject to the requirements of the proposed amendments to
Regulation S-P.\260\ Therefore, if the proposed amendments to
Regulation S-P are adopted (as proposed), broker dealers that operate
ATSs would be subject to its requirements in addition to the
requirements of Regulation SCI that apply to the ATS (currently and as
it would be amended).
---------------------------------------------------------------------------

    \258\ See supra note 3 and surrounding text as to the meaning of
``covered institution.''
    \259\ An ``SCI Entity'' is currently defined to include an ATS
that trades certain stocks exceeding specific volume thresholds. As
noted below, the Commission is proposing in the Regulation SCI
Proposal to expand the scope of entities that would be considered
SCI Entities. See 17 CFR 242.1000 and Regulation SCI Proposal, supra
note 57.
    \260\ See 17 CFR 242.1000 (defining the terms ``SCI alternative
trading system,'' ``SCI self-regulatory system,'' and ``Exempt
clearing agency subject to ARP,'' and including all of those defined
terms in the definition of ``SCI Entity''). The definition of ``SCI
Entities'' also includes plan processors and SCI competing
consolidators.
---------------------------------------------------------------------------

    The Commission is also proposing to revise Regulation SCI to expand
the definition of ``SCI entity'' to include broker-dealers that exceed
an asset-based size threshold or a volume-based trading threshold in
national market system (``NMS'') stocks, exchange-listed options,
agency securities, or U.S. treasury securities.\261\ These entities
would also be Market Entities \262\ for the purposes of the Exchange
Act Cybersecurity Proposal, if adopted as proposed. If the amendments
to Regulation SCI are adopted and the proposed amendments to Regulation
S-P are adopted (as proposed), these additional Market Entities would
be subject to Regulation SCI and also would be subject to the
requirements of the proposed amendments to Regulation S-P as well as
the requirements of the Exchange Act Cybersecurity Proposal (if
adopted).
---------------------------------------------------------------------------

    \261\ See Regulation SCI Proposal, supra note 57. See paragraph
(a)(1)(i)(D) of the Exchange Act Cybersecurity Proposal proposed
Rule. To be subject to the Exchange Act Cybersecurity Proposal, the
broker-dealer would either be a carrying broker-dealer, have
regulatory capital equal to or exceeding $50 million, have total
assets equal to or exceeding $1 billion, or operate as a market
maker. See also paragraphs (a)(1)(i)(A), (C), (D), and (E) of the
Exchange Act Cybersecurity Proposal proposed rule.
    \262\ See supra note 71 for a description of the entities
subject to the definition of ``Market Entity'' under the Exchange
Act Cybersecurity Proposal.
---------------------------------------------------------------------------

    Additionally, broker-dealers and transfer agents that would be
subject to the Exchange Act Cybersecurity Proposal also would be
subject to some or all of the requirements of Regulation S-P (currently
and as it would be amended).\263\
---------------------------------------------------------------------------

    \263\ Broadly, Regulation S-P's requirements apply to all
broker-dealers, except for ``notice-registered broker-dealers'' (as
defined in 17 CFR 248.30), who in most cases will be deemed to be in
compliance with Regulation S-P where they instead comply with the
financial privacy rules of the CFTC, and are otherwise explicitly
excluded from certain of Regulation S-P's obligations. See 17 CFR
248.2(c). For the purposes of this section II.G. of this release,
the term ``broker-dealer'' when used to refer to broker-dealers that
are subject to Regulation S-P (currently and as it would be amended)
excludes notice-registered broker-dealers. Currently, transfer
agents registered with the Commission (``registered transfer
agents'') (but not transfer agents registered with another
appropriate regulatory agency) are subject to Regulation S-P's
disposal rule. See 17 CFR 248.30(b). However, no transfer agent is
currently subject to any other portion of Regulation S-P, including
the safeguards rule. See 17 CFR 248.30(a). Under the proposed
amendments to Regulation S-P, both those transfer agents registered
with the Commission, as well as those registered with another
appropriate regulatory agency (as defined in 15 U.S.C. 78c(34)(B))
would be subject to both the disposal rule and the safeguards rule.
---------------------------------------------------------------------------

c. Policies and Procedures To Address Cybersecurity Risks
i. Different Scope of the Policies and Procedures Requirements
    Each of the policies and procedures requirements has a different
scope and purpose. Regulation SCI (currently and as it would be
amended) limits the scope of its requirements to certain systems of the
SCI Entity that support securities market related functions.
Specifically, it does and would require an SCI Entity to have
reasonably designed policies and procedures applicable to its SCI
systems and, for purposes of security standards, its indirect SCI
systems.\264\ While certain aspects of the policies and procedures
required by Regulation SCI (as it exists today and as proposed to be
amended) are designed to address certain cybersecurity risks (among
other things),\265\ the policies and procedures required by Regulation
SCI focus on the SCI entities' operational capability and the
maintenance of fair and orderly markets.
---------------------------------------------------------------------------

    \264\ See 17 CFR 242.1001(a)(1). Regulation SCI also requires
that each SCI Entity's policies and procedures must, at a minimum,
provide for, among other things, regular reviews and testing of SCI
systems and indirect SCI systems, including backup systems, to
identify vulnerabilities from internal and external threats. 17 CFR
242.1001(a)(2)(iv).
    \265\ See 17 CFR 242.1000 (defining ``indirect SCI systems'').
The distinction between SCI systems and indirect SCI systems seeks
to encourage SCI Entities that their SCI systems, which are core
market-facing systems, should be physically or logically separated
from systems that perform other functions (e.g., corporate email and
general office systems for member regulation and recordkeeping). See
Regulation Systems Compliance and Integrity, Release No. 34-73639
(Dec. 5, 2014) [79 FR 72251], at 79 FR at 72279-81 (``Regulation SCI
2014 Adopting Release''). Indirect SCI systems are subject to
Regulation SCI's requirements with respect to security standards.
---------------------------------------------------------------------------

    Similarly, Regulation S-P (currently and as it would be amended)
also has a distinct focus. The policies and procedures required under
Regulation S-P, both currently and as proposed to be amended, are
limited to protecting a certain type of information--customer records
or information and consumer report information \266\--and they apply to
such information even when stored outside of SCI systems or indirect
SCI systems. Furthermore, these policies and procedures need not
address other types of information stored on the systems of the broker-
dealer or transfer agent. Consequently, while Regulation SCI and
Regulation S-P may relate to each other, each serves a distinct
purpose, and the Commission believes it would be appropriate to apply
both requirements to SCI Entities that are covered institutions.
---------------------------------------------------------------------------

    \266\ Or as proposed herein, ``customer information'' and
``consumer information.'' See proposed rules 248.30(e)(5) and
(e)(1), respectively.
---------------------------------------------------------------------------

    The policies and procedures requirements of the Exchange Act
Cybersecurity Proposal are broader in scope with respect to
cybersecurity than either the current or proposed forms of Regulation
SCI or Regulation S-P. The Exchange Act Cybersecurity Proposal would
require Market Entities to establish, maintain, and enforce written
policies and procedures that are reasonably designed to address their
cybersecurity risks.\267\ Unlike Regulation SCI, these requirements
would therefore cover both SCI systems and information systems that are
not SCI systems. And, unlike Regulation S-P, the proposed requirements
would also encompass information beyond customer information and
consumer information. As discussed below, however, the narrower scope
of the cybersecurity-related requirements discussed in this proposal
are not intended to be inconsistent with the policies and procedures
that would be required under the Exchange Act Cybersecurity Proposal,
despite the differences in scope and purpose, which could reduce
duplicative burdens for entities to comply with both requirements.\268\
---------------------------------------------------------------------------

    \267\ See paragraphs (b) and (e) of the Exchange Act
Cybersecurity Proposal (setting forth the requirements of Covered
Entities and Non-Covered Entities, respectively, to have policies
and procedures to address their cybersecurity risks).
    \268\ See infra section III.D.1.a.
---------------------------------------------------------------------------

    To illustrate, a covered institution could use one comprehensive
set of policies and procedures to satisfy the cybersecurity-related
requirements of the Regulation S-P proposed

amendments and the cybersecurity-related policies and procedures
requirements of the Regulation SCI Proposal and the Exchange Act
Cybersecurity Proposal, so long as the cybersecurity-related policies
and procedures required under Regulation S-P and Regulation SCI fit
within and are consistent with the scope of the policies and procedures
required under the Exchange Act Cybersecurity Proposal, and the
Exchange Act Cybersecurity Proposal policies and procedures also
address the more narrowly-focused cybersecurity-related policies and
procedures requirements under the Regulation S-P and Regulation SCI
proposals.
ii. Consistency of the Policies and Procedures Requirements
    The safeguards rule currently requires broker-dealers (but not
transfer agents) to adopt written policies and procedures that address
administrative, technical, and physical safeguards for the protection
of customer records and information.\269\ The safeguards rule further
provides that these policies and procedures must: (1) insure the
security and confidentiality of customer records and information; (2)
protect against any anticipated threats or hazards to the security or
integrity of customer records and information; and (3) protect against
unauthorized access to or use of customer records or information that
could result in substantial harm or inconvenience to any customer.\270\
Additionally, the disposal rule currently requires broker-dealers and
transfer agents that maintain or otherwise possess consumer report
information for a business purpose to properly dispose of the
information by taking reasonable measures to protect against
unauthorized access to or use of the information in connection with its
disposal.\271\
---------------------------------------------------------------------------

    \269\ See 17 CFR 248.30(a).
    \270\ See 17 CFR 248.30(a)(1) through (3).
    \271\ See 17 CFR 248.30(b)(2). Regulation S-P currently defines
the term ``disposal'' to mean: (1) the discarding or abandonment of
consumer report information; or (2) the sale, donation, or transfer
of any medium, including computer equipment, on which consumer
report information is stored. See 17 CFR 248.30(b)(1)(iii).
---------------------------------------------------------------------------

    The proposed amendments to the Regulation S-P safeguards rule would
require policies and procedures to include a response program for
unauthorized access to or use of customer information. Further, the
response program would need to be reasonably designed to detect,
respond to, and recover from unauthorized access to or use of customer
information, including procedures, among others, to: (1) assess the
nature and scope of any incident involving unauthorized access to or
use of customer information and identify the customer information
systems and types of customer information that may have been accessed
or used without authorization; \272\ and (2) take appropriate steps to
contain and control the incident to prevent further unauthorized access
to or use of customer information.\273\
---------------------------------------------------------------------------

    \272\ Regulation SCI's obligation to take corrective action may
include a variety of actions, such as determining the scope of the
SCI event and its causes, among others. See Regulation SCI 2014
Adopting Release, supra note 265, at 72251, 72317. See also
Regulation SCI sec. 242.1002(a).
    \273\ See supra section II.A. As discussed, the response program
also would need to have procedures to notify each affected
individual whose sensitive customer information was, or is
reasonably likely to have been, accessed or used without
authorization unless the covered institution determines, after a
reasonable investigation of the facts and circumstances of the
incident of unauthorized access to or use of sensitive customer
information, the sensitive customer information has not been, and is
not reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience. See id.
---------------------------------------------------------------------------

    The Exchange Act Cybersecurity Proposal would have several policies
and procedures requirements that are designed to address similar
cybersecurity-related risks to these proposed requirements of
Regulation S-P. First, under the Exchange Act Cybersecurity Proposal, a
Covered Entity's \274\ policies and procedures would require measures
designed to detect, mitigate, and remediate any cybersecurity threats
and vulnerabilities with respect to the Covered Entity's information
systems and the information residing on those systems.\275\ Second,
under the Exchange Act Cybersecurity Proposal, a Covered Entity's
policies and procedures would require incident response measures
designed to detect, respond to, and recover from a cybersecurity
incident, including policies and procedures that are reasonably
designed to ensure, among other things, the protection of the Covered
Entity's information systems and the information residing on those
systems.\276\ Therefore, the incident response program policies and
procedures requirements under the Regulation S-P proposal, which are
specifically tailored to address unauthorized access to or use of
customer information, would serve a different purpose than, and are not
intended to be inconsistent with, the broader cybersecurity and
information protection requirements of the incident response policies
and procedures required under the Exchange Act Cybersecurity Proposal.
---------------------------------------------------------------------------

    \274\ See supra note 71 for a description of the entities
proposed as ``Covered Entities'' under the Exchange Act
Cybersecurity Proposal.
    \275\ See paragraph (b)(1)(iv) of the Exchange Act Cybersecurity
Proposal proposed Rule; see also Exchange Act Cybersecurity
Proposal, supra note 57 (discussing this requirement in more
detail).
    \276\ See paragraph (b)(1)(v) of the Exchange Act Cybersecurity
Proposal proposed Rule; see also Exchange Act Cybersecurity
Proposal, supra note 57 (discussing this requirement in more
detail).
---------------------------------------------------------------------------

    Accordingly, policies and procedures implemented by a broker-dealer
that are reasonably designed in compliance with the requirements of the
Exchange Act Cybersecurity Proposal discussed above also should
generally satisfy the existing policies and procedures requirements of
the Regulation S-P safeguards rule to protect customer records or
information against unauthorized access or use that could result in
substantial harm or inconvenience to any customer, to the extent that
such information is stored electronically and, therefore, falls within
the scope of the Exchange Act Cybersecurity Proposal.\277\ In addition,
reasonably designed policies and procedures implemented by a broker-
dealer or transfer agent in compliance with the requirements of the
Exchange Act Cybersecurity Proposal also should generally satisfy the
existing requirements of the disposal rule related to properly
disposing of consumer report information, to the extent that such
information is stored electronically and, therefore, falls within the
scope of the Exchange Act Cybersecurity Proposal.
---------------------------------------------------------------------------

    \277\ To the extent an entity's policies and procedures under
the Exchange Act Cybersecurity Proposal would, or do, not satisfy
the policies and procedures requirements in this proposal, we
believe that the requirements proposed here, such as procedures to
notify affected individuals whose sensitive customer information
was, or is reasonably likely to have been, accessed or used without
authorization, could be added to and should fit within the policies
and procedures required under the Exchange Act Cybersecurity
Proposal that more comprehensively address cybersecurity risks to
the extent that such information is stored electronically.
Furthermore, any burdens from the proposal that do not fit within
the requirements of the Exchange Act Cybersecurity Proposal may
relate to the scope of Regulation S-P and would be appropriate given
their purpose.
---------------------------------------------------------------------------

    In addition, with respect to service providers, the proposed
amendments to the safeguards rule would require broker-dealers, other
than notice-registered broker-dealers, and transfer agents registered
with the Commission or another appropriate regulatory agency to include
written policies and procedures within their response programs that
require their service providers, pursuant to a written contract, to
take appropriate measures that are designed to protect against
unauthorized access to or use of customer information, including

notification to the broker-dealer or transfer agent as soon as
possible, but no later than 48 hours after becoming aware of a breach,
in the event of any breach in security resulting in unauthorized access
to a customer information system maintained by the service provider to
enable the broker-dealer or transfer agent to implement its response
program expeditiously.\278\
---------------------------------------------------------------------------

    \278\ See supra section II.A.3.
---------------------------------------------------------------------------

    The Exchange Act Cybersecurity Proposal also would have several
policies and procedures requirements that are designed to address
similar cybersecurity-related risks that relate to service providers.
First, as part of the Exchange Act Cybersecurity Proposal's risk
assessment requirements, a Covered Entity's policies and procedures
under that proposal would need to require periodic assessments of
cybersecurity risks associated with the Covered Entity's information
systems and information residing on those systems.\279\ This element of
the policies and procedures would need to require that the Covered
Entity identify its service providers that receive, maintain, or
process information, or are otherwise permitted to access the Covered
Entity's information systems and any of the Covered Entity's
information residing on those systems, and assess the cybersecurity
risks associated with the Covered Entity's use of these service
providers.\280\
---------------------------------------------------------------------------

    \279\ See paragraph (b)(1)(i)(A) of the Exchange Act
Cybersecurity Proposal proposed Rule; see also Exchange Act
Cybersecurity Proposal, supra note 57, at section II.B.1.a.
(discussing this requirement in more detail).
    \280\ See paragraph (b)(1)(i)(A)(2) of the Exchange Act
Cybersecurity Proposal proposed Rule.
---------------------------------------------------------------------------

    Second, under the Exchange Act Cybersecurity Proposal, a Covered
Entity's policies and procedures would require oversight of service
providers that receive, maintain, or process the Covered Entity's
information, or are otherwise permitted to access the Covered Entity's
information systems and the information residing on those systems,
pursuant to a written contract between the Covered Entity and the
service provider. Through that written contract the service providers
would be required to implement and maintain appropriate measures that
are designed to protect the Covered Entity's information systems and
information residing on those systems.\281\ Unlike the Exchange Act
Cybersecurity Proposal, however, Regulation S-P's proposed policy and
procedure requirements related to service providers would specifically
require notification to a covered institution as soon as possible, but
no later than 48 hours after becoming aware of a breach, in the event
of any breach in security resulting in unauthorized access to a
customer information system maintained by the service provider, in
order to enable the covered institution to implement its response
program. Therefore, reasonably designed policies and procedures
implemented by a broker-dealer or transfer agent pursuant to the
requirements of the Exchange Act Cybersecurity Proposal largely would
satisfy these proposed requirements of Regulation S-P, to the extent
that such information is stored electronically.\282\
---------------------------------------------------------------------------

    \281\ See paragraphs (b)(1)(iii)(B) of the Exchange Act
Cybersecurity Proposal proposed Rule; see also Exchange Act
Cybersecurity Proposal, supra note 57 (discussing this requirement
in more detail).
    \282\ See supra section II.A.3.
---------------------------------------------------------------------------

    The proposed amendments to the disposal rule would require broker-
dealers, other than notice-registered broker-dealers, and transfer
agents registered with the Commission or another appropriate regulatory
agency that maintain or otherwise possess consumer information or
customer information for a business purpose, to properly dispose of
this information by taking reasonable measures to protect against
unauthorized access to or use of the information in connection with its
disposal. Any broker-dealer or transfer agent subject to the disposal
rule would be required to adopt and implement written policies and
procedures that address the proper disposal of consumer information and
customer information in accordance with this standard.\283\
---------------------------------------------------------------------------

    \283\ See proposed rule 248.30(c).
---------------------------------------------------------------------------

    The Exchange Act Cybersecurity Proposal would have several policies
and procedures requirements that are designed to address similar
cybersecurity-related risks as this proposed requirement of the
disposal rule. First, a Covered Entity's policies and procedures under
the Exchange Act Cybersecurity Proposal would need to include controls:
(1) requiring standards of behavior for individuals authorized to
access the Covered Entity's information systems and the information
residing on those systems, such as an acceptable use policy; \284\ (2)
identifying and authenticating individual users, including but not
limited to implementing authentication measures that require users to
present a combination of two or more credentials for access
verification; \285\ (3) establishing procedures for the timely
distribution, replacement, and revocation of passwords or methods of
authentication; \286\ (4) restricting access to specific information
systems of the Covered Entity or components thereof and the information
residing on those systems solely to individuals requiring access to the
systems and information as is necessary for them to perform their
responsibilities and functions on behalf of the covered entity; \287\
and (5) securing remote access technologies.\288\
---------------------------------------------------------------------------

    \284\ See paragraph (b)(1)(ii)(A) of the Exchange Act
Cybersecurity Proposal proposed Rule.
    \285\ See paragraph (b)(1)(ii)(B) of the Exchange Act
Cybersecurity Proposal proposed Rule.
    \286\ See paragraph (b)(1)(ii)(C) of the Exchange Act
Cybersecurity Proposal proposed Rule.
    \287\ See paragraph (b)(1)(ii)(D) of the Exchange Act
Cybersecurity Proposal proposed Rule.
    \288\ See paragraphs (b)(1)(ii)(A) through (E) of the Exchange
Act Cybersecurity Proposal proposed Rule; see also Exchange Act
Cybersecurity Proposal, supra note 57 (discussing these requirements
in more detail).
---------------------------------------------------------------------------

    Second, under the Exchange Act Cybersecurity Proposal, a Covered
Entity's policies and procedures would need to include measures
designed to protect the Covered Entity's information systems and
protect the information residing on those systems from unauthorized
access or use, based on a periodic assessment of the Covered Entity's
information systems and the information that resides on the
systems.\289\ The periodic assessment would need to take into account:
(1) the sensitivity level and importance of the information to the
Covered Entity's business operations; (2) whether any of the
information is personal information; (3) where and how the information
is accessed, stored and transmitted, including the monitoring of
information in transmission; (4) the information systems' access
controls and malware protection; and (5) the potential effect a
cybersecurity incident involving the information could have on the
Covered Entity and its customers, counterparties, members, registrants,
or users, including the potential to cause a significant cybersecurity
incident.\290\ A broker-dealer or transfer agent that implements these
requirements of the Exchange Act Cybersecurity Proposal should
generally satisfy the proposed requirements of the disposal rule that
customer information or consumer information held for a business
purpose must be properly disposed of, to the extent that such
information is stored electronically and, therefore, falls within the
scope of the Exchange Act Cybersecurity Proposal.
---------------------------------------------------------------------------

    \289\ See paragraph (b)(1)(iii)(A) of the Exchange Act
Cybersecurity Proposal proposed Rule; see also Exchange Act
Cybersecurity Proposal, supra note 57 (discussing these requirements
in more detail).
    \290\ See paragraphs (b)(1)(iii)(A)(1) through (5) of the
Exchange Act Cybersecurity Proposal proposed Rule.
---------------------------------------------------------------------------

    For these reasons, the more narrowly focused existing and proposed
policies and procedures requirements of Regulation S-P that address
particular

cybersecurity risks should fit within and are not intended to be
inconsistent with the broader policies and procedures required under
the Exchange Act Cybersecurity Proposal that more comprehensively
address cybersecurity risks. Therefore, it should be appropriate for a
broker-dealer or transfer agent to comply with the policies and
procedures requirements of the Exchange Act Cybersecurity Proposal (if
adopted) and the existing and proposed cybersecurity-related policies
and procedures requirements of Regulation S-P with an augmented set of
policies and procedures that addresses the requirements of both rules,
to the extent that such information is stored electronically and,
therefore, falls within the scope of the Exchange Act Cybersecurity
Proposal.
d. Disclosure
    The proposed amendments to Regulation S-P and Regulation SCI, and
the Exchange Act Cybersecurity Proposal also have similar, but
distinct, requirements related to notification about certain
cybersecurity incidents. The proposed amendments to Regulation S-P
would require broker-dealers, other than notice-registered broker-
dealers, and transfer agents registered with the Commission or another
appropriate regulatory agency to notify affected individuals whose
sensitive customer information was, or is reasonably likely to have
been, accessed or used without authorization.\291\ These broker-dealers
and transfer agents would not have to provide notice if, after a
reasonable investigation of the facts and circumstances of the incident
of unauthorized access to or use of sensitive customer information,
they determine that the sensitive customer information has not been,
and is not reasonably likely to be, used in a manner that would result
in substantial harm or inconvenience.\292\ Moreover, if the
cybersecurity incident is or would be an SCI event under the current or
proposed requirements of Regulation SCI, a Covered Entity that is or
would be subject to the current and proposed requirements of Regulation
SCI also could be required to disseminate certain information about the
SCI event to certain of its members, participants, or in the case of an
SCI broker-dealer, customers, as applicable, promptly after any
responsible SCI personnel has a reasonable basis to conclude that an
SCI event has occurred.
---------------------------------------------------------------------------

    \291\ See supra section II.A.4.
    \292\ See id.
---------------------------------------------------------------------------

    Under the Exchange Act Cybersecurity Proposal, a Market Entity that
is a Covered Entity would, if it experiences a ``significant
cybersecurity incident,'' be required to disclose a summary description
of each such incident that has occurred during the current or previous
calendar year and to provide updated disclosures if the information
required to be disclosed materially changes, including after the
occurrence of a new significant cybersecurity incident or when
information about a previously disclosed significant cybersecurity
incident materially changes. These disclosures would be required to be
made by filing Part II of proposed Form SCIR on EDGAR,\293\ posting a
copy of the form on its corporate internet website, and, in the case of
a carrying or introducing broker-dealer, by sending the disclosure to
its customers using the same means that the customer elects to receive
account statements.
---------------------------------------------------------------------------

    \293\ The Exchange Act Cybersecurity Proposal would also require
Covered Entities to publicly disclose summary descriptions of the
cybersecurity risks that could materially affect the covered
entity's business and operations and how the covered entity
assesses, prioritizes, and addresses those cybersecurity risks on
Part II of proposed Form SCIR. See Exchange Act Cybersecurity
Proposal, supra note 57 (discussing this requirement in more
detail).
---------------------------------------------------------------------------

    However, despite these similarities, there are distinct
differences. First, the Exchange Act Cybersecurity Proposal, Regulation
SCI (currently and as proposed to be amended), and Regulation S-P (as
proposed to be amended) require different types of information to be
disclosed. Second, the disclosures generally would be made to different
persons: (1) the public at large in the case of the Exchange Act
Cybersecurity Proposal; \294\ (2) members, participants, or customers,
as applicable, of the SCI entity in the case of the Regulation SCI
Proposal; \295\ and (3) affected individuals whose sensitive customer
information was, or is reasonably likely to have been, accessed or used
without authorization or, in some cases, all individuals whose
information resides in the customer information system that was
accessed or used without authorization in the case of Regulation S-P
(as proposed to be amended).\296\
---------------------------------------------------------------------------

    \294\ A carrying broker-dealer would be required to make the
disclosures to its customers as well through the means by which they
receive account statements. As discussed above, the Exchange Act
Cybersecurity Proposal would require Covered Entities to make the
public disclosures by (1) filing Part II of Form SCIR with the
Commission electronically through the EDGAR system, and (2) posting
a copy of the Part II of Form SCIR most recently filed on an easily
accessible portion of its business internet website that can be
viewed by the public without the need of entering a password or
making any type of payment or other consideration. See Exchange Act
Cybersecurity Proposal, supra note 57 (discussing this requirement
in more detail).
    \295\ Regulation SCI, as amended, would require SCI entities to
disseminate information required under sec. 242.1002(c)(1) and
(c)(2) of Regulation SCI promptly to those members, participants, or
in the case of an SCI broker-dealer, customers, of the SCI entity
that any responsible SCI personnel has reasonably estimated may have
been affected by the SCI event, or to any additional members,
participants, or in the case of an SCI broker-dealer, customers,
that any responsible SCI personnel subsequently reasonably estimates
may have been affected by the SCI event. See Regulation SCI
Proposal, supra note 57 (discussing this requirement in more
detail).
    \296\ Under the Regulation S-P and Regulation SCI proposals,
there could be circumstances in which a compromise involving
sensitive customer information at a broker-dealer that is an SCI
entity could result in two forms of notification being provided to
customers for the same incident. In addition, under the Exchange Act
Cybersecurity Proposal, the broker-dealer also may need to publicly
disclose a summary description of the incident via EDGAR and the
entity's business internet website, and, in the case of an
introducing or carrying broker-dealer, send a copy of the disclosure
to its customers.
---------------------------------------------------------------------------

    Additionally, the notification provided about certain cybersecurity
incidents is different under each of these proposals given the distinct
goals of each proposal. For example, the requirement to disclose
summary descriptions of certain cybersecurity incidents from the
current or previous calendar year publicly on EDGAR under the Exchange
Act Cybersecurity Proposal serves a different purpose than the customer
notification obligation proposed by the Regulation S-P amendments,
which would provide more specific information to individuals affected
by a security compromise involving their sensitive customer
information, so that those individuals may take remedial actions if
they so choose.\297\ For these reasons, the customer notification
requirements of the proposed amendments to Regulation S-P are proposed
to apply to covered institutions even if they would be subject to the
disclosure requirements of Regulation SCI and/or the Exchange Act
Cybersecurity Proposal (as proposed).
---------------------------------------------------------------------------

    \297\ Among other things, the disclosure requirements for
certain cybersecurity incidents under the other proposals would
serve the following purposes: (1) with respect to the Exchange Act
Cybersecurity Proposal, the public disclosure would provide greater
transparency about the Covered Entity's exposure to material harm as
a result of the cybersecurity incident, and provide a way for market
participants to evaluate the Covered Entity's cybersecurity risks
and vulnerabilities; (2) with respect to the Regulation SCI
Proposal, the dissemination would provide market participants who
have been affected by an SCI event, including customers of an SCI
broker-dealer, with information they can use to evaluate the event's
impact on their trading and other activities to develop an
appropriate response.

---------------------------------------------------------------------------

a. Request for Comment
    The Commission requests comment on the multiple requirements under
Regulation S-P (as currently exists and as proposed to be amended), the
Exchange Act Cybersecurity Proposal, and Regulation SCI (as currently
exists and as proposed to be amended). In addition, the Commission is
requesting comment on the following matters:
    98. Would it be costly or create practical implementation
difficulties to apply the proposed requirements of Regulation S-P to
have policies and procedures related to addressing cybersecurity risks
to covered institutions if these institutions also would be required to
have policies and procedures under Regulation SCI (currently and as it
would be amended) and/or the Exchange Act Cybersecurity Proposal (if it
is adopted) that address certain cybersecurity risks? If so, explain
why. If not, explain why not. Conversely, would there be benefits to
this approach? Why or why not? Are there ways the policies and
procedures requirements of the proposed amendments to Regulation S-P
could be modified to minimize these potential impacts while achieving
the separate goals of this proposal? If so, explain how and suggest
specific modifications.
    99. Would it be costly or create practical implementation
difficulties to require covered institutions to provide notification to
affected individuals under Regulation S-P (as proposed), as well as
requiring disclosure for certain cybersecurity-related incidents under
the Exchange Act Cybersecurity Proposal and Regulation SCI? If so,
explain why. If not, explain why not. Conversely, would there be
benefits to this approach? Why or why not? Are there ways the
notification requirements of the proposed amendments to Regulation S-P
could be modified to minimize the potential impacts while achieving the
separate goals of this proposal? If so, explain how and suggest
specific modifications.
2. Investment Management Cybersecurity
    On February 9, 2022, the Commission proposed new rules and
amendments relating to the cybersecurity practices and response
measures of registered investment advisers, registered investment
companies, and business development companies (``covered IM
entities'').\298\ The Investment Management Cybersecurity Proposal
would require written cybersecurity policies and procedures reasonably
designed to address cybersecurity risks; disclosures regarding certain
cybersecurity risks and significant cybersecurity incidents;
confidential reporting to the Commission within 48 hours of having a
reasonable basis to conclude that a significant cybersecurity incident
has occurred or is occurring; and certain cybersecurity-related
recordkeeping.\299\
---------------------------------------------------------------------------

    \298\ See Investment Management Cybersecurity Proposal, supra
note 55. The Commission has pending proposals to reopen comments for
the Investment Management Cybersecurity Proposal, and to address
cybersecurity risk with respect to different entities, types of
covered information or systems, and products. The Commission
encourages commenters to review those proposals to determine whether
it might affect their comments on this proposal. See also
Corporation Finance Cybersecurity Proposal, supra note 55; Exchange
Act Cybersecurity Proposal and Regulation SCI Proposal, supra note
57.
    \299\ See Investment Management Cybersecurity Proposal, supra
note 55, for a full description of the proposed requirements. The
Investment Management Cybersecurity Proposal includes recordkeeping
requirements for advisers and funds--proposed amendments to rule
204-2 under the Advisers Act and new rule 38a-2 under the Investment
Company Act would require copies of cybersecurity policies and
procedures, annual review and written report, documentation related
to cybersecurity incidents, including those reported or disclosed,
and cybersecurity risk assessments. These recordkeeping requirements
center around cybersecurity incidents that jeopardize the
confidentiality, integrity, or availability of an adviser or fund's
information or information systems, which may include customer
information, but also includes other information, such as trading or
investment information. In contrast, as discussed in section II.C,
the proposed amendments to Regulation S-P require written records
documenting compliance with the requirements of the safeguards rule
and of the disposal rule.
---------------------------------------------------------------------------

    If the Investment Management Cybersecurity Proposal and this
proposal are both adopted as proposed, covered IM entities would be
required to comply with certain similar requirements under both sets of
rules. Both sets of rules would require covered IM entities to have
policies and procedures regarding measures to detect, respond to, and
recover from certain security incidents. Both also address oversight
over certain service providers as a part of the required policies and
procedures, specifically, requiring the service provider to have
appropriate measures that are designed to protect customer, fund, or
adviser information, as applicable, pursuant to a written
contract.\300\
---------------------------------------------------------------------------

    \300\ The Commission proposed the Adviser Outsourcing Proposal
in October 2022, which would prohibit registered investment advisers
from outsourcing certain services or functions without first meeting
minimum due diligence and monitoring requirements. See Advisers
Outsourcing Proposal, supra note 94. Registered investment advisers
that would be subject to the Adviser Outsourcing Proposal, if
adopted, would also be subject to Regulation S-P, as proposed to be
amended. The Adviser Outsourcing Proposal is meant to address
service providers that perform covered functions (those necessary
for the investment adviser to provide its investment advisory
services in compliance with the Federal securities laws, and that,
if not performed or performed negligently, would be reasonably
likely to cause a material negative impact on the adviser's clients
or on the adviser's ability to provide investment advisory
services). See id. The Commission encourages commenters to review
the Adviser Outsourcing Proposal to determine whether it might
affect their comments on this proposal.
---------------------------------------------------------------------------

    In addition to similar policies and procedures requirements,
covered IM entities would potentially be required to make disclosures
to the public and report to the Commission under the Investment
Management Cybersecurity Proposal, as well as provide notice to an
affected individual under Regulation S-P, for the same incident. The
disclosure and reporting that would be required under the Investment
Management Cybersecurity Proposal, however, differ in purpose from the
notification that would be provided to individuals whose sensitive
customer information was, or is reasonably likely to have been,
accessed or used without authorization under the proposed amendments to
Regulation S-P.\301\
---------------------------------------------------------------------------

    \301\ See proposed rule 248.30(b)(4).
---------------------------------------------------------------------------

    The disclosures and reporting contemplated in the Investment
Management Cybersecurity Proposal would generally require disclosure of
information appropriate to a wider audience of current and prospective
advisory clients and fund shareholders, and would better inform their
investment decisions, as well as provide reporting to the Commission of
significant cybersecurity incidents.\302\ For example, advisers would
be required to describe cybersecurity risks that could materially
affect the advisory services they offer and how they assess,
prioritize, and address cybersecurity risks created by the nature and
scope of their business. The Investment Management Cybersecurity
Proposal would also require disclosure about significant cybersecurity
incidents to prospective and current clients, shareholders, and
prospective shareholders. These disclosures are intended to improve
such persons' ability to evaluate and understand relevant cybersecurity
risks and incidents and their potential effect on adviser and fund
operations. In contrast, as discussed in section II.A.4.f, the notices
required under this proposal would provide more specific information to
individuals whose

sensitive customer information notification was, or is reasonably
likely to have been, accessed or used without authorization, so that
they can take remedial actions as they deem appropriate.\303\ In other
words, the Investment Management Cybersecurity Proposal would provide
more general information appropriate to the wider audience of current
and prospective clients, shareholders, and prospective shareholders,
where this proposal would provide more specific information to
individual customers about their customer information.
---------------------------------------------------------------------------

    \302\ See Investment Management Cybersecurity Proposal, supra
note 55, proposed Form ADV-C reporting to the Commission includes
both general and specific questions related to the significant
cybersecurity incident, such as the nature and scope of the incident
as well as whether any disclosure has been made to any clients and/
or investors.
    \303\ See proposed rule 248.30(b)(4)(iv) (includes information
regarding a description of the incident, type of sensitive customer
information accessed or used without authorization, and what has
been done to protect the sensitive customer information from further
unauthorized access or use, as well as contact information
sufficient to permit an affected individual to contact the covered
institution).
---------------------------------------------------------------------------

    We intend that even if this proposal as well as the Investment
Management Cybersecurity are adopted as proposed, covered IM entities
would be able to avoid duplicative compliance efforts, including by,
for example, developing one set of policies and procedures addressing
all of the requirements from these proposals, using similar
descriptions in the disclosures regarding the same incident, or
providing the required disclosures as a single notice, where
appropriate.\304\
---------------------------------------------------------------------------

    \304\ See infra section III.D.1.a.
---------------------------------------------------------------------------

    We request comment on the application of the proposal and the
Investment Management Cybersecurity Proposal, including the following:
    100. How would covered IM entities comply with the policies and
procedures requirements contemplated in this proposal? Would they do so
by having an integrated set of cybersecurity policies and procedures?
If not, what costs and burdens would covered IM entities incur? If so,
what operational or practical difficulties may arise because of these
combined policies and procedures?
    101. Should we modify any of the proposed requirements under this
proposal for policies and procedures, service provider oversight, and/
or notification of certain incidents, in order to minimize potential
duplication of similar requirements under the Investment Management
Cybersecurity Proposal?
    102. What operational or practical difficulties, if any, may arise
for covered IM entities that choose to comply with the disclosure
requirements contemplated in this proposal and the Investment
Management Cybersecurity Proposal by making substantially similar
disclosures to market participants and customers? To the extent the
proposed disclosure and notification requirements would result in
duplication of effort, what revisions would minimize such duplication
but also ensure investors and customers receive the information
necessary to protect themselves and make investment decisions?
    103. Should we require notice to the Commission when notification
is provided to individuals under this proposal? If yes, what form
should that notification take (for example, a copy of what is provided
to affected individuals under this proposal, or something similar to
the significant cybersecurity incident reporting that would be required
under the Investment Management Cybersecurity Proposal for covered IM
entities)? \305\ Should the timing of any such notification to the
Commission be the same, before or later than notification to the
affected individuals? \306\
---------------------------------------------------------------------------

    \305\ See supra note 302.
    \306\ The Investment Management Cybersecurity Proposal would
require advisers to provide information regarding a significant
cybersecurity incident in a structured format through a series of
check-the-box and fill-in-the-blank questions on new Form ADV-C. See
Investment Management Cybersecurity Proposal, supra note 55, at
section II.B.
---------------------------------------------------------------------------

    104. Do commenters believe there are additional areas of potential
duplication or similarities between this proposal and the Investment
Management Cybersecurity Proposal that we should address in this
proposal? If so, please provide specific examples and whether the
duplication or similarities should be addressed and if so, how.

H. Existing Staff No-Action Letters and Other Staff Statements

    Staff is reviewing certain of its no-action letters and other staff
statements addressing Regulation S-P to determine whether any such
letters, statements, or portions thereof, should be withdrawn in
connection with any adoption of this proposal. We list below the
letters and other staff statements that are being reviewed as of the
date of any adoption of the proposed rules or following a transition
period after such adoption. If interested parties believe that
additional letters or other staff statements, or portions thereof,
should be withdrawn, they should identify the letter or statement,
state why it is relevant to the proposed rule, and how it or any
specific portion thereof should be treated and the reason therefor. To
the extent that a letter or statement listed relates both to the
proposal and another topic, the portion unrelated to the proposal is
not being reviewed in connection with any adoption of this proposal.

                  Letters and Statements To Be Reviewed
------------------------------------------------------------------------
        Name of letter or statement                  Date issued
------------------------------------------------------------------------
Staff Responses to Questions about          January 23, 2003.
 Regulation S-P.
Certain Disclosures of Information to the   March 11, 2011; December 11,
 CFP Board.                                  2014.
Investment Adviser and Broker-Dealer        April 16, 2019.
 Compliance Issues Related to Regulation S-
 P--Privacy Notices and Safeguard Policies.
------------------------------------------------------------------------

I. Proposed Compliance Date

    We propose to provide a compliance date twelve months after the
effective date of any adoption of the proposed amendments in order to
give covered institutions sufficient time to develop and adopt
appropriate procedures to comply with any of the proposed changes and
associated disclosure and reporting requirements, if adopted. The
Commission recognizes that many covered institutions would review their
policies and procedures at least annually. This compliance date would
allow covered institutions to develop and adopt appropriate procedures
in alignment with a regularly scheduled review. Based on our
experience, we believe the proposed compliance date would provide an
appropriate amount of time for covered institutions to comply with the
proposed rules, if adopted.
    We request comment on the proposed compliance date, and
specifically on the following items:
    105. Is the proposed compliance date appropriate? If not, why not?
Is a longer or shorter period necessary to allow covered institutions
to comply with one or more of these particular amendments, if adopted
(for example, 18 months if longer, 6 months if shorter)? If so, what
would be a recommended compliance date?
    106. Should we provide a different compliance date for different
types of entities? For example, should we provide a later compliance
date for smaller entities, and if so what should this be (for example,
18 or 24 months)? How should we define a ``smaller entities'' for this
purpose? Should any such definition be different depending on the type
of covered institution and, if so, how?

III. Economic Analysis

A. Introduction

    The Commission is mindful of the economic effects, including the
costs and benefits, of the proposed rules and amendments. Section 3(f)
of the Exchange Act, section 2(c) of the Investment Company Act, and
section 202(c) of the Investment Advisers Act provide that when
engaging in rulemaking that requires us to consider or determine
whether an action is necessary or appropriate in or consistent with the
public interest, to also consider, in addition to the protection of
investors, whether the action will promote efficiency, competition, and
capital formation. Section 23(a)(2) of the Exchange Act also requires
us to consider the effect that the rules would have on competition, and
prohibits us from adopting any rule that would impose a burden on
competition not necessary or appropriate in furtherance of the Exchange
Act. The analysis below addresses the likely economic effects of the
proposed amendments, including the anticipated and estimated benefits
and costs of the amendments and their likely effects on efficiency,
competition, and capital formation. The Commission also discusses the
potential economic effects of certain alternatives to the approaches
taken in this proposal.
    The proposed amendments would require every broker-dealer,\307\
every investment company, every registered investment adviser, and
every transfer agent to notify affected customers \308\ of certain data
breaches.\309\ To that end, the proposed amendments would require these
covered institutions to develop, implement, and maintain written
policies and procedures that include an incident response program that
is reasonably designed to detect, respond to, and recover from
unauthorized access or use of customer information, and that includes a
customer notification component for cases where sensitive customer
information has been, or is reasonably likely to have been, accessed or
used without authorization.\310\ The proposal would also extend
existing rules for safeguarding customer records and information by
broadening the scope of covered records to ``customer information'' and
extending the covered population to transfer agents,\311\ impose
various related recordkeeping requirements,\312\ and include in the
regulation an existing statutory exception to annual privacy notice
requirements.\313\
---------------------------------------------------------------------------

    \307\ Notice registered broker-dealers subject to and complying
with the financial privacy rules of the CFTC would be deemed to be
in compliance with the proposed provision through the substituted
compliance provisions of Regulation S-P. See supra section II.C.4.
    \308\ As discussed above, ``customers'' includes not only
customers of the aforementioned SEC-registered entities, but also
customers of other financial institutions whose information comes
into the possession of covered institutions. In addition, with
respect to a transfer agent, ``customers'' refers to ``any natural
person who is a shareholder securityholder of an issuer for which
the transfer agent acts or has acted as a transfer agent.'' See
proposed rule 248.30(e)(4).
    \309\ Notification would be required in the event that the
sensitive customer information was, or is reasonably likely to have
been, accessed or used without authorization, unless such covered
institution determines, after a reasonable investigation of the
facts and circumstances of the incident of unauthorized access to or
use of sensitive customer information, that of the sensitive
customer information has not been, and is not reasonably likely to
be, used in a manner that would result in substantial harm or
inconvenience. See proposed rule 248.30(b)(4)(i).
    \310\ See id.; see also supra section II.A.
    \311\ See proposed rule 248.30(a) and 248(e)(3).
    \312\ See proposed rule 248.30(d).
    \313\ See proposed rule 248.5(e).
---------------------------------------------------------------------------

    The proposed amendments would affect the aforementioned covered
institutions as well as customers who would receive the proposed
notices. The proposed amendments would also have indirect effects on
third-party service providers that receive, maintain, process or
otherwise are permitted access to customer information on behalf of
covered institutions: under the proposed amendments, unauthorized use
of or access to sensitive customer information via third-party service
providers would fall under the proposed customer notification
requirement and covered institutions would be required to enter into a
written contract with these service providers regarding measures to
protect against unauthorized access to or use of customer information
and notification to the covered institution in the event of a
breach.\314\
---------------------------------------------------------------------------

    \314\ See infra section III.D.1.b.
---------------------------------------------------------------------------

    We believe that the main economic effects of the proposal would
result from the proposed notification and incident response program
requirements applicable to all covered institutions.\315\ For reasons
discussed later in this section, we believe the proposed extension of
existing provisions of Regulation S-P to transfer agents would have
more limited economic effects.\316\ Finally, we anticipate the proposed
recordkeeping requirements, and the proposed incorporation of the
existing statutory exception to annual privacy notice requirements, to
have minimal economic effects as discussed further below.\317\
---------------------------------------------------------------------------

    \315\ See infra section III.D.1.
    \316\ See infra section III.D.2.
    \317\ See infra sections III.D.3 and III.D.4.
---------------------------------------------------------------------------

    Broadly speaking, we believe the main economic benefits of the
proposed notification and incident response program requirements, as
well as the proposed extension of Regulation S-P to all transfer
agents, would result from reduced exposure of the broader financial
system to cyberattacks. These benefits would result from covered
institutions allocating additional resources towards information
safeguards and cybersecurity to comply with the proposed new
requirements and/or to avoid reputational harm resulting from the
mandated notifications.\318\ More directly, customers would benefit
from reduced risk of their information being compromised, and--insofar
as the proposed notices improve customers' ability to take mitigating
actions--by allowing customers to mitigate the effects of compromises
that occur nonetheless. The main economic costs from these new
requirements would be reputational costs borne by firms that would not
otherwise have notified customers of a data breach, increased
expenditures on safeguards to avoid such reputational costs, and
compliance costs related to the development and implementation of
required policies and procedures.\319\
---------------------------------------------------------------------------

    \318\ While the scope of the safeguards rule and the proposed
amendments is not limited to cybersecurity, in the contemporary
context, their main economic effects are realized through their
effects on cybersecurity. See infra note 343.
    \319\ Throughout this economic analysis, ``compliance costs''
refers to the direct costs that must be borne in order to avoid
violating the Commission's rules. This includes costs related to the
development of policies and procedures required by the regulation,
costs related to delivery of the required notices, and the direct
costs of any other required action. As used here, ``compliance
costs'' excludes costs that are not required, but may nonetheless
arise as a consequences of the Commission's rules (e.g., reputation
costs resulting from disclosure of data breach, or increased
cybersecurity spending aimed at avoiding such reputation costs).
---------------------------------------------------------------------------

    Because all states require some form of customer notification of
certain data breaches,\320\ and many entities are likely to already
have response programs in place,\321\ we generally anticipate that the
economic benefits and costs of the proposed notification requirements
will--in the aggregate--be limited. Our proposal would, however, afford
many individuals greater protections by, for example, defining
``sensitive customer information'' more broadly than the current
definitions used by certain

states; \322\ providing for a 30-day notification deadline that is
shorter than the timing currently mandated by many states, including in
states providing for no deadline or those allowing for various delays;
and providing for a more sensitive notification trigger than in most
states.\323\
---------------------------------------------------------------------------

    \320\ See infra section III.C.2.a.
    \321\ See infra section III.C.3.
    \322\ See supra section II.A.4.b and infra section
III.D.1.c.iii.
    \323\ See infra section III.D.1.c.iv.
---------------------------------------------------------------------------

    Further, in certain states, state customer notification laws do not
apply to entities subject to or in compliance with the GLBA, and our
proposal would help ensure customers receive notice of a breach in
these circumstances.\324\
---------------------------------------------------------------------------

    \324\ See infra section III.D.1.c.ii.
---------------------------------------------------------------------------

    For these reasons, the requirements being proposed here would
improve customers' knowledge of when their sensitive information has
been compromised. Specifically, we expect that the proposed minimum
nationwide standard for notifying customers of data breaches, along
with the preparation of written policies and procedures for incident
response, would result in more customers being notified of data
breaches as well as faster notifications for some customers, and that
both these effects would improve customers' ability to act to protect
their personal information. Moreover, such improved notification
would--in many cases--become public and impose additional reputational
costs on covered institutions that fail to safeguard customers'
sensitive information. We expect that these potential additional
reputational costs would increase the disciplining effect on covered
institutions, incentivizing them to improve customer information
safeguards, reduce their exposure to data breaches, and thereby improve
the cyber-resilience of the financial system more broadly.
    To the extent that a covered institution does not currently have
policies and procedures to safeguard customer information and respond
to unauthorized access to or use of customer information, it would bear
costs to develop and implement the required policies and procedures for
the proposed incident response program. Moreover, transfer agents--who
have heretofore not been subject to any of the customer safeguard
provisions of Regulation S-P--would face additional compliance costs
related to the development of policies and procedures that address
administrative, technical, and physical safeguards for the protection
of customer information as already required by current Regulation S-
P.\325\
---------------------------------------------------------------------------

    \325\ That is, the existing provisions of Regulation S-P not
currently applicable to registered transfer agents. See 17 CFR
248.30(a).
---------------------------------------------------------------------------

    As adopting policies and procedures involves fixed costs, doing so
is almost certain to impose a proportionately larger compliance cost on
smaller covered institutions, which would--in principle--reduce smaller
covered institutions' ability to compete with their larger peers (i.e.,
for whom the fixed costs are spread over more customers).\326\ However,
given the considerable competitive challenges arising from economies of
scale and scope already faced by smaller firms, we do not anticipate
that the costs associated with this proposal would significantly alter
these challenges. Similarly, although the proposed amendments may lead
to improvements to economic efficiency and capital formation, existing
state rules are similar in many respects to this proposal and so we do
not expect the proposed amendments to have a significant impact on
economic efficiency or capital formation vis-[agrave]-vis the baseline.
---------------------------------------------------------------------------

    \326\ See infra section III.D.1.a.
---------------------------------------------------------------------------

    Many of the benefits and costs discussed below are difficult to
quantify. Doing so would involve estimating the losses likely to be
incurred by a customer in the absence of mitigation measures, the
efficacy of mitigation measures implemented with a given delay, and the
expected delay before notification can be provided under the proposed
rules. In general, data needed to arrive at such estimates are not
available to the Commission. Thus, while we have attempted to quantify
economic effects where possible, much of the discussion of economic
effects is qualitative in nature. The Commission seeks comment on all
aspects of the economic analysis, including submissions of data that
could be used to quantify some of these economic effects.

B. Broad Economic Considerations

    In a perfectly competitive market, market forces would lead firms
to ``efficiently'' safeguard customers' information: firms that fail to
provide the level of safeguards demanded by customers would be driven
out of the market by those that do.\327\ Among the several assumptions
required to obtain this efficient outcome is that of customers having
complete and perfect information about the firm's product or service
and the processes and service provider relationships by which they are
being provided, including customer information safeguards. In the
context of covered institutions--firms whose services frequently
involve custody of highly-sensitive customer information--this
assumption is unrealistic. Customers have little visibility into the
internal processes of a firm and its service providers, so it is
impossible for them to directly observe whether a firm is employing
adequate customer information safeguards.\328\ Moreover, firms often
lack incentives to disclose when such information is compromised (and
likely have substantial incentives to avoid such disclosures), limiting
customers' (current or prospective) ability to penalize (i.e., avoid)
covered institutions who fail to protect customer information.\329\ The
resulting information asymmetry prevents market forces from yielding
economically efficient outcomes. This market failure serves as the
economic rationale for the proposed regulatory intervention.
---------------------------------------------------------------------------

    \327\ In the highly stylized standard model of perfect
competition presented in many introductory micro-economic texts,
this ``efficient'' safeguarding of customer information would
correspond to producing the one homogenous good (i.e., a service of
a certain quality) demanded by the representative customer at its
marginal cost. See, e.g., David M. Kreps, A Course in Microeconomic
Theory, Princeton University Press (1990).
    \328\ Here, ``adequate safeguards'' can be thought of as the
level of safeguards that would be demanded by the representative
customer in a world where the level of firms' efforts (and the costs
of these efforts) were observable.
    \329\ The release of information about data breaches can lead to
loss of customers, reputational harm, litigation, or regulatory
scrutiny. See, e.g., Press release, U.S. Fed. Trade Comm'n, Equifax
to Pay $575 Million as Part of Settlement with FTC, CFPB, and States
Related to 2017 Data Breach (July 22, 2019), https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach.
---------------------------------------------------------------------------

    The information asymmetry about specific information breaches that
have occurred, and--more generally--about covered institutions' efforts
at avoiding such breaches, can lead to two inefficiencies. First, the
information asymmetry prevents individual customers whose information
has been compromised from taking timely actions (e.g., increased
monitoring of account activity, or placing blocks on credit reports)
necessary to mitigate the consequences of such compromises. Second, the
information asymmetry can lead covered institutions to generally devote
too little effort (i.e., ``underspend'') toward safeguarding customer
information, thereby increasing the probability of information being
compromised in the first place.\330\

In other words, information asymmetry prevents covered institutions
that spend more effort on safeguarding customer information from having
customers recognize their extra efforts.
---------------------------------------------------------------------------

    \330\ For example, in a recent survey of financial firms, 58% of
the respondents self-reported ``underspending'' on cybersecurity.
See McKinsey & Co. and Institute of International Finance, IIF/
McKinsey Cyber Resilience Survey (Mar. 2020) (``IIF/McKinsey
Report''), https://www.iif.com/portals/0/Files/content/cyber_resilience_survey_3.20.2020_print.pdf. A total of 27 companies
participated in the survey, with 23 having a global footprint.
Approximately half of respondents were European or U.S. Globally
Systemically Important Banks (G-SIBs). See also Investment
Management Cybersecurity Proposal supra note 55.
---------------------------------------------------------------------------

    The proposed amendments could mitigate these inefficiencies in
three ways. First, by ensuring customers receive timely notice when
their information is compromised, they would allow customers to take
appropriate remedial actions. Second, by revealing when such events
occur, they would help customers to draw inferences about a covered
institution's efforts toward protecting customer information which
could help inform their choice of covered institution,\331\ and in so
doing influence firms' efforts toward protecting customer
information.\332\ Third, by imposing a regulatory requirement to
develop, implement, and maintain policies and procedures, the proposed
amendments might further enhance firms' cybersecurity preparations and
would restrict firms' ability to limit efforts in these areas and
thereby mitigate the inefficiency from a competitive ``race to the
bottom.'' \333\
---------------------------------------------------------------------------

    \331\ In the case of transfer agents such effects would be
mediated through firms' choice of transfer agents and therefore less
direct. Nonetheless we believe that, all else being equal, firms
would prefer to avoid employing the services of transfer agents that
allow their investors' information to be compromised.
    \332\ See, e.g., Richard J. Sullivan & Jesse Leigh Maniff, Data
Breach Notification Laws, 101 Econ. Rev. 65 (2016) (``Sullivan &
Maniff'').
    \333\ The ``bottom'' in such a race is a level of cybersecurity
spending that is too low from an efficiency standpoint.
---------------------------------------------------------------------------

    The effectiveness of the proposed amendments at mitigating these
problems would depend on several factors. First, it would depend on the
degree to which customer notification provides actionable information
to customers that helps mitigate the effects of the compromise of
sensitive customer information. Second, it would also depend on the
degree to which the prospect of issuing such notices--and the prospect
of resulting reputational harm, litigation, and regulatory scrutiny--
helps alleviate underspending on safeguarding customer
information.\334\ Finally, the effectiveness of the proposed amendments
would also depend on the extent to which they induce improvements to
existing practices (i.e., the extent to which they strengthen customer
safeguards and increase notification relative to the baseline).
---------------------------------------------------------------------------

    \334\ Although empirical evidence on the effectiveness of
notification breach laws is quite limited, extant studies suggest
that such laws protect consumers from harm. See Sasha Romanosky,
Rahul Telang, & Alessandro Acquisti, Do Data Breach Disclosure Laws
Reduce Identity Theft?, 30 J. Pol'y. Ansys & Mgmt 256 (2011). See
also Sullivan & Maniff, supra note 332.
---------------------------------------------------------------------------

C. Baseline

    The market risks and practices, regulation, and market structure
relevant to the affected parties in place today form the baseline for
our economic analysis. The parties directly affected by the proposed
amendments (``covered institutions'' \335\) include every broker-dealer
(3,509 entities),\336\ every investment company (13,965 distinct legal
entities),\337\ every investment adviser (15,129 entities) \338\
registered with the Commission, and every transfer agent (402 entities)
\339\ registered with the Commission or another appropriate regulatory
agency. In addition, the proposed amendments would affect current and
prospective customers of covered institutions as well as certain
service providers to covered institutions.\340\
---------------------------------------------------------------------------

    \335\ See infra section III.C.3.
    \336\ Of these, 502 are dually-registered as investment
advisers. See infra section III.C.3.a.
    \337\ Many of these distinct legal entities represent different
series of a common registrant. Moreover, many of the registrants are
themselves part of a larger family of companies. We estimate there
are 1,093 such families. See infra section III.C.3.c.
    \338\ See infra section III.C.3.b.
    \339\ See infra section III.C.3.d.
    \340\ See infra section III.C.3.e.
---------------------------------------------------------------------------

1. Safeguarding Customer Information--Risks and Practices
    Over the last two decades, the widespread adoption of digitization
and the migration toward internet-based products and services has
radically changed the manner in which firms interact with customers.
The financial services industry has been at the forefront of these
trends and now represents one the most digitally mature sectors of the
economy.\341\ This progress came with a cost: increased exposure to
cyberattacks that threaten not only the financial firms themselves, but
also their customers. Cyber threat intelligence surveys consistently
find the financial sector to be among the most attacked
industries.\342\
---------------------------------------------------------------------------

    \341\ See Michael Grebe, et al., Digital Maturity Is Paying Off,
BCG (June 7, 2008), available at https://www.bcg.com/publications/2018/digital-maturity-is-paying-off.
    \342\ See, e.g., IBM, X-Force Threat Intelligence Index 2022
(Feb. 2022), available at https://www.ibm.com/security/data-breach/threat-intelligence.
---------------------------------------------------------------------------

    The trend toward digitization has increasingly turned the problem
of safeguarding customer records and information into one of
cybersecurity.\343\ Because financial firms are part of one of the most
attacked industries, the problem of cybersecurity is acute, as the
customer records and information in their possession can be quite
sensitive (e.g., personal identifying information, bank account
numbers, financial transactions) and the compromise of which could lead
to substantial harm.\344\ Not surprisingly, the financial sector is one
of the biggest spenders on cybersecurity measures: a recent survey
found that non-bank financial firms spent an average of approximately
0.4% of revenues--or $2,348/employee/year--on cybersecurity.\345\
---------------------------------------------------------------------------

    \343\ This is not to say that this is exclusively a problem of
cybersecurity. Generally however, the risks associated with purely
physical forms of compromise are of a smaller magnitude, as large-
scale compromise using physical means is cumbersome. The largest
publicly known incidents of compromised information have appeared to
involve electronic access to digital records, as opposed to physical
access to records or computer hardware. For a partial list of recent
data breaches and their causes see, e.g., Michael Hill and Dan
Swinhoe, The 15 Biggest Data Breaches of the 21st Century, CSO (Nov.
8, 2022), available at https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html (last visited
Dec. 29, 2022); Drew Todd, Top 10 Data Breaches of All Time,
SecureWorld (Sept. 14, 2022), available at https://www.secureworld.io/industry-news/top-10-data-breaches-of-all-time
(last visited Dec. 29, 2022).
    \344\ See supra note 342.
    \345\ Julie Bernard et al., Reshaping the Cybersecurity
Landscape, Deloitte Insights (July 24, 2020), available at https://www2.deloitte.com/us/en/insights/industry/financial-services/cybersecurity-maturity-financial-institutions-cyber-risk.html (last
visited Feb. 13, 2023). These spending totals represent self-
reported shares of information technology budgets devoted to
cybersecurity. As such they are unlikely to include additional
indirect costs such as the cost of employee time spent on compliance
with cybersecurity procedures.
---------------------------------------------------------------------------

    While spending on cybersecurity measures in the financial services
industry is considerable, it may nonetheless be inadequate--even in the
estimation of financial firms themselves. According to one recent
survey, 58% of financial firms self-reported ``underspending'' on
cybersecurity measures.\346\ And while adoption of cybersecurity best
practices has been accelerating overall, some firms continue to lag in
their adoption.\347\
---------------------------------------------------------------------------

    \346\ See IIF/McKinsey Report, supra note 330.
    \347\ See EY and Institute of International Finance, 12th Annual
EY/IIF Global Bank Risk Management Survey (2022), available at
https://www.iif.com/portals/0/Files/content/32370132_ey-iif_global_bank_risk_management_survey_2022_final.pdf (stating 58%
of surveyed banks' Chief Risk Officers cite ``inability to manage
cybersecurity risk'' as the top strategic risk); see also Sage
Lazzaro, Public cloud security `just barely adequate,' experts say,
VentureBeat (July 9, 2021), available at https://venturebeat.com/business/public-cloud-security-just-barely-adequate-experts-say/
(noting that the majority of surveyed security professionals believe
the cloud service providers ``should be doing more on security.'')

---------------------------------------------------------------------------

    As discussed in more detail below, the Commission does not
currently require covered institutions to notify customers (or the
Commission) in the event of a data breach, so statistics relating to
data breaches at covered institutions are not readily available.
However, data compiled from notifications required under various state
laws \348\ indicates that in 2021 the number of data breaches reported
in the U.S. rose sharply to 1,862--a 68% increase over the prior
year.\349\ Of these, 279 (15%) were reported by firms in the financial
services industry. It is estimated that the average total cost of a
data breach for a U.S. firm in 2022 was $9.44/million.\350\ The bulk of
these costs is attributed to detection and escalation (33%), lost
business (32%), and post-breach response (27%); customer notification
is estimated to account for only a small fraction (7%) of these
costs.\351\ Thus, for the U.S. financial industry as a whole, this
implies aggregate notification costs under the baseline on the order of
$200 million, which--given the greater exposure of financial firms to
cyber threats--almost surely represent a lower bound.\352\
---------------------------------------------------------------------------

    \348\ See infra section II.A.4.
    \349\ See Identity Theft Resource Center, Data Breach Annual
Report (Jan. 2022) (``ITRC Data Breach Annual Report''), available
at https://www.idtheftcenter.org/wp-content/uploads/2022/04/ITRC_2021_Data_Breach_Report.pdf.
    \350\ An increase of 4% over the prior year; see IBM, Cost of a
Data Breach Report 2022 (July 2022) (``IBM Cost of Data Breach
Report''), https://www.ibm.com/downloads/cas/3R8N1DZJ. While the
report does not provide estimates for U.S. financial services firms
specifically, it estimates that world-wide, the cost of a data
breach for financial services firms averaged $5.97 million, and that
average costs for U.S. firms are approximately twice the world-wide
average.
    \351\ See id.
    \352\ The $200 million figure is based on 7% (the customer
notification portion) of an average cost of $9.44 million multiplied
by 279 data breaches. See supra notes 349 and 350.
---------------------------------------------------------------------------

2. Regulation
    Two features of the existing regulatory framework are most relevant
to the proposed amendments. First are the regulations already in place
that require covered institutions to notify customers in the event that
their information is compromised in some way. Second are regulations
that affect covered institutions' efforts toward safeguarding
customers' information. While the relevance of the former is obvious,
the latter is potentially more significant: regulations aimed at
increasing firms' efforts toward safeguarding customer information
reduce the need for data breach notifications in the first place. In
this section, we summarize these two aspects of the regulatory
framework.
a. Customer Notification Requirements
    All 50 states and the District of Columbia impose some form of data
breach notification requirement under state law. These laws vary in
detail from state to state, but have certain common features. State
laws trigger data breach notification obligations when some type of
``personal information'' of a state's resident is either accessed or
acquired in an unauthorized manner, subject to various common
exceptions. For the vast majority of states (47), a notification
obligation is triggered only when there is unauthorized acquisition,
while a handful of states (4) require notification whenever there is
unauthorized access.\353\
---------------------------------------------------------------------------

    \353\ See, e.g., notification requirements in California (Cal.
Civ. Code sec. 1798.82(a)) and Texas (Tex. Bus. & Com. Code sec.
521.002) triggered by the acquisition of certain information by an
unauthorized person, as compared to notification requirements in
Florida (Fla. Stat. sec. 501.171) and New York (N.Y. Gen. Bus. Law
sec. 899-AA) triggered by unauthorized access to personal
information. ``States'' in this discussion includes the 50 U.S.
states and the District of Columbia, for a total of 51. All state
law citations are to the August 2022 versions of state codes.
---------------------------------------------------------------------------

    Generally, states can be said to adopt either a basic or an
enhanced definition of personal information. A typical example of a
basic definition specifies personal information as the customer name
linked to one or more pieces of nonpublic information such as Social
Security number, driver's license number (or other state identification
number), or financial account number together with any required
credentials to permit access to said account.\354\ A typical enhanced
definition will include additional types of nonpublic information that
trigger the notification requirement; examples include: passport
number, military identification number, or other unique identification
number issued on a government document commonly used to verify the
identity of a specific individual; unique biometric data generated from
measurements or technical analysis of human body characteristics, such
as a fingerprint, retina, or iris image, used to authenticate a
specific individual.\355\ Enhanced definitions would also trigger
notification when a username or email address in combination with a
password or security question and answer that would permit access to an
online account is compromised.\356\ Most states (39) adopt some form of
enhanced definition, while a minority (12) adopt a basic definition.
---------------------------------------------------------------------------

    \354\ See, e.g., Kan. Stat. sec. 50-7a01(g) or Minn. Stat. sec.
325E.61(e).
    \355\ See, e.g., Md. Comm. Code sec. 14-3501, (defining
``personal information'' to include credit card numbers, health
information, health insurance information, and biometric data such
as retina or fingerprint).
    \356\ See, e.g., Arizona Code sec. 18-551 (defining ``personal
information'' to include an individual's user name or email address,
in combination with a password or security question and answer, that
allows access to an online account).
---------------------------------------------------------------------------

    Most states (43) provide an exception to the notification
requirement if, following a breach of security, the entity investigates
and determines that there is no reasonable likelihood that the
individual whose personal information was breached has experienced or
will experience certain harms (``no-harm exception'').\357\ Although
the types of harms vary by state, they most commonly include: ``harm''
generally (12), identity theft or other fraud (10), misuse of personal
information (8). Figure 1 plots the frequency of the various types of
harms referenced in states' no-harm exceptions.
---------------------------------------------------------------------------

    \357\ See, e.g., Fla. Stat. sec. 501.171(4)(c). A variation on
this exception provides for notification only if the investigation
reveals a risk of misuse. See, e.g., Utah Code 13-44-202(1). Eight
states, including California and Texas, do not have a no-harm
exception.

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.000

    In general, state laws provide a general principle for timing of
notification (e.g., delivery shall be made ``without unreasonable
delay,'' or ``in the most expedient time possible and without
unreasonable delay'').\358\ Some states augment the general principle
with a specific deadline (e.g., notice must be made ``in the most
expedient time possible and without unreasonable delay, but not later
than 30 days after the date of determination that the breach occurred''
unless certain exceptions apply.'' \359\ Figure 2 plots the frequency
of different notification deadlines in state laws.
---------------------------------------------------------------------------

    \358\ See, e.g., Cal. Civ. Code sec. 1798.82(a) (disclosure to
be made ``in the most expedient time possible and without
unreasonable delay'' but allowing for needs of law enforcement and
measures to determine the scope of the breach and restore the
system).
    \359\ See, e.g., Colo. Reg. Stat. sec. 6-1-716 (notice to be
made ``in the most expedient time possible and without unreasonable
delay, but not later than thirty days after the date of
determination that a security breach occurred, consistent with the
legitimate needs of law enforcement and consistent with any measures
necessary to determine the scope of the breach and to restore the
reasonable integrity of the computerized data system''); Fla. Stat.
sec. 501.171(4)(a) (notice to be made ``as expeditiously as
practicable and without unreasonable delay . . . but no later than
30 days after the determination of a breach'' unless delayed at the
request of law enforcement or waived pursuant to the state's no-harm
exception).

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.002

    State laws generally require persons or entities that own or
license computerized data that includes private information to notify
residents of the state when a data breach results in the compromise of
their private information. In addition, state laws generally require
persons and entities that do not own or license such computerized data,
but that maintain such computerized data for other entities, to notify
the affected entity in the event of a data breach (so as to allow that
entity to notify affected individuals).\360\ Therefore, we understand
that all proposed covered institutions are already complying with one
or more state notification laws. Variations in these state laws,
however, could result in residents of one state receiving notice while
residents of another receive no notice, or receive it later, for the
same data breach incident.
---------------------------------------------------------------------------

    \360\ See, e.g., Cal. Civ. Code sec. 1798.82(b); DC Code 28-
3852(b); N.Y. Gen. Bus. Law sec. 899-AA(3); Tex. Bus. & Com. Code
sec. 521.053(c). South Dakota does not have such a provision (SDCL
sec. 22-40-19 through 22-40-26). In some states, notification from
the service provider to the information owner is required only in
the case of fraud or misuse. See, e.g., Miss. Code sec. 75-24-29
(requiring notification if the information was or is reasonably
believed to have been acquired by an unauthorized person for
fraudulent purposes); Colo. Rev. Stat. sec. 6-1-716 (requiring
notification if misuse of personal information about a Colorado
resident occurred or is likely to occur).
---------------------------------------------------------------------------

    Covered institutions may use service providers to perform certain
business activities and functions, such as trading and order
management, information technology functions and cloud computing
services. As a result of this outsourcing, service providers may
receive, maintain, or process customer information, or be permitted to
access it, and therefore a security incident at the service provider
could expose information at or belonging to the covered institution. In
some cases, these service providers may be required to notify customers
directly under state notification laws (i.e., when the service provider
owns or licenses the customer data). We anticipate however, that more
frequently service providers would fall under provisions of state laws
that require persons and entities that maintain computerized data to
notify the data owners in the event of a breach.\361\ We also
understand contracts between covered institutions and service providers
could, and may already, call for the service provider to notify the
covered institution of a data breach. Thus, we anticipate that most
service providers contracting with covered institutions that would be
affected by this proposal are already notifying covered institutions of
data breaches, pursuant to either contract or state law.\362\
---------------------------------------------------------------------------

    \361\ Many service providers may not own the data and may not
have knowledge as to which customers are potentially affected by a
data breach (e.g., database, email, or server hosting providers). In
such cases, it would generally not be possible for service providers
to notify affected customers directly.
    \362\ Several state laws provide that a covered institution may
contract with the service provider such that the service provider
directly notifies affected individuals of a data breach. We do not
have information on the frequency of such arrangements. See, e.g.,
Fla. Stat. sec. 501.171(6)(b); Ala. Code sec. 8-38-8.
---------------------------------------------------------------------------

b. Customer Information Safeguards
    Regulation S-P currently requires all currently covered
institutions to adopt written policies and procedures reasonably
designed to: (i) insure the security and confidentiality of customer
records and information; (ii) protect against any anticipated threats
or hazards to the security or integrity of customer records and
information; and (iii) protect against unauthorized access to or use of
customer records and information that could result in substantial harm
or inconvenience to any customer.\363\
---------------------------------------------------------------------------

    \363\ See Reg. S-P Release, supra note 2; see also Disposal Rule
Adopting Release, supra note 32 (requiring written policies and
procedures under Regulation S-P). See Compliance Programs of
Investment Companies and Investment Advisers, Investment Advisers
Act Release No. 2204 (Dec. 17, 2003) [68 FR 74714 (Dec. 24, 2003)],
at n.22 (``Compliance Program Release'') (stating expectation that
policies and procedures would address safeguards for the privacy
protection of client records and information and noting the
applicability of Regulation S-P).
---------------------------------------------------------------------------

    Covered institutions that hold transactional accounts for consumers
may also be subject to Regulation S-ID.\364\ Such entities must develop
and

implement a written identity theft program that includes policies and
procedures to identify relevant types of identity theft red flags,
detect the occurrence of those red flags, and respond appropriately to
the detected red flags.\365\ As some compromise of customer information
is generally a prerequisite for identity theft, it is reasonable to
expect that some of the policies and procedures implemented to effect
compliance with Regulation S-ID incorporate red flags related to the
potential compromise of customer information.\366\
---------------------------------------------------------------------------

    \364\ Regulation S-ID applies to ``financial institutions'' or
``creditors'' that offer or maintain ``covered accounts.'' Entities
that are likely to qualify as financial institutions or creditors
and maintain covered accounts include most registered brokers,
dealers, and investment companies, and some registered investment
advisers. See Reg. S-P Release, supra note 2; see also Identity
Theft Red Flag Rules, Investment Advisers Act Release No. 3582 (Apr.
10, 2013) [78 FR 23637 (Apr. 19, 2013)] (``Identity Theft
Release'').
    \365\ In addition, affected entities must also periodically
update their identity theft programs. See Reg. S-P Release, supra
note 2. Other rules also require updates to policies and procedures
at regular intervals: see, e.g., Rule 38a-1 under the Investment
Company Act; FINRA Rule 3120 (Supervisory Control System); and FINRA
Rule 3130 (Annual Certification of Compliance and Supervisory
Processes).
    \366\ In a 2017 Risk Alert, the SEC Office of Compliance
Inspections and Examinations noted that in a sampling of
registrants, nearly all broker-dealers and most advisers had
specific cybersecurity and Regulation S-ID policies and procedures.
See EXAMS Risk Report, Observations from Cybersecurity Examinations
(Aug. 7, 2017), available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf. See also Identity Theft
Release, supra note 364.
---------------------------------------------------------------------------

    Some covered institutions may also be subject to other regulators'
rules implicating customer information safeguards. Transfer agents
supervised by one of the banking agencies, would be subject to the
Banking Agencies' Incident Response Guidance.\367\ The Banking
Agencies' guidelines require covered financial institutions to develop
a response program covering assessment, notification to relevant
regulators and law enforcement, incident containment, and customer
notice.\368\ The guidelines require customer notification if misuse of
sensitive customer information ``has occurred or is reasonably
possible.'' \369\ They also require notices to occur ``as soon as
possible,'' but permit delays if ``an appropriate law enforcement
agency determines that notification will interfere with a criminal
investigation and provides the institution with a written request for
the delay.'' \370\ Under the guidelines, ``sensitive customer
information'' means ``a customer's name, address, or telephone number,
in conjunction with the customer's Social Security number, driver's
license number, account number, credit or debit card number, or a
personal identification number or password that would permit access to
the customer's account.'' \371\ In addition ``any combination of
components of customer information that would allow someone to log onto
or access the customer's account, such as user name and password or
password and account number'' is also considered sensitive customer
information under the guidelines.\372\ The guidelines also state that
the OCC Information Security Guidance directs every financial
institution to require its service providers by contract to implement
appropriate measures designed to protect against unauthorized access to
or use of customer information that could result in substantial harm or
inconvenience to any customer.\373\
---------------------------------------------------------------------------

    \367\ See Banking Agencies' Incident Response Guidance, supra
note 47.
    \368\ See id. at Supplement A, section II.A.
    \369\ See id. at Supplement A, section III.A.
    \370\ See id. at Supplement A, section III.A.
    \371\ See id. at Supplement A, section III.A.1.
    \372\ See id. at Supplement A, section III.A.1.
    \373\ See id. at Supplement A, section I.C.
---------------------------------------------------------------------------

    In addition, certain ATSs are subject to obligations regarding
their systems that relate to securities market functions under
Regulation SCI aimed at enhancing the capacity, integrity, resiliency,
availability, and security of those systems.\374\
---------------------------------------------------------------------------

    \374\ See Rule 1001 of Regulation SCI. See supra note 57.
---------------------------------------------------------------------------

    We also understand that advisers to private funds may be subject to
the Federal Trade Commission's recently amended Standards for
Safeguarding Customer Information (``FTC Safeguards Rule'') that
contains a number of modifications to the existing rule with respect to
data security requirements to protect customer financial
information.\375\ The FTC Safeguards Rule generally requires financial
institutions to develop, implement, and maintain a comprehensive
information security program that consists of the administrative,
technical, and physical safeguards the financial institution uses to
access, collect, distribute, process, protect, store, use, transmit,
dispose of, or otherwise handle customer information.\376\ The rule
also requires financial institutions to design and implement a
comprehensive information security program with various elements,
including incident response. In addition, it requires financial
institutions to take reasonable steps to select and retain service
providers capable of maintaining appropriate safeguards for customer
information and require those service providers by contract to
implement and maintain such safeguards.\377\
---------------------------------------------------------------------------

    \375\ Issuers that are excluded from the definition of
investment company--such as private funds that are able to rely on
section 3(c)(1) or 3(c)(7) of the Investment Company Act--would not
be subject to Regulation S-P. However, registered investment
advisers are covered institutions for purposes of this proposal.
    \376\ 16 CFR 314.2(c). The FTC Safeguards Rule does not contain
a notification requirement.
    \377\ 16 CFR 314.4(d).
---------------------------------------------------------------------------

    A variety of guidance is available to institutions seeking to
address information security risk, particularly through the development
of policies and procedures. These include the NIST and CISA voluntary
standards \378\ discussed elsewhere in this release, both of which
include assessment, containment, and notification elements similar to
this proposal. We do not have extensive data spanning all types of
covered institutions on their use of these or similar guidelines or on
their development of written policies and procedures to address
incident response. However, past Commission examination sweeps of
broker-dealers and investment advisers suggest that such practices are
widespread.\379\ Thus, we believe that institutions seeking to develop
written policies and procedures likely would have encountered these and
similar standards and may have included the critical elements of
assessment and containment, as well as notification; we request public
comment on this assumption.
---------------------------------------------------------------------------

    \378\ See NIST Computer Security Incident Handling Guide and
CISA Cybersecurity Incident Response Playbook supra note 81.
    \379\ See OCIE, SEC, Cybersecurity Examination Sweep Summary
(Feb. 3, 2015), available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf (written policies and
procedures, for both the broker-dealers (82%) and the advisers
(51%), discuss mitigating the effects of a cybersecurity incident
and/or outline the plan to recover from such an incident. Similarly,
most of the broker-dealers (88%) and many of the advisers (53%)
reference published cybersecurity risk management standards).
---------------------------------------------------------------------------

c. Annual Notice Delivery Requirement
    Under the baseline,\380\ a broker-dealer, investment company, or
registered investment adviser must generally provide an initial privacy
notice to its customers not later than when the institution establishes
the customer relationship and annually after that for as long as the
customer relationship continues.\381\ If an institution chooses to
share nonpublic personal information with a nonaffiliated third party
other than as disclosed in an initial privacy notice, the institution
must generally send a revised privacy notice to its customers.\382\
---------------------------------------------------------------------------

    \380\ For the purposes of the economic analysis, the baseline
does not include the exception to the annual notice delivery
requirement provided by the FAST Act. This statutory exception was
self-effectuating and became effective on Dec. 4, 2015. See supra
note 221 and accompanying text.
    \381\ 17 CFR 248.4 and 248.5.
    \382\ 17 CFR 248.8. Regulation S-P provides certain exceptions
to the requirement for a revised privacy notice, including if the
institution is sharing as permitted under rules 248.13, 248.14, and
248.15 or to a new nonaffiliated third party that was adequately
disclosed in the prior privacy notice.

---------------------------------------------------------------------------

    The types of information required to be included in the initial,
annual, and revised privacy notices are identical. Each privacy notice
must describe the categories of information the institution shares and
the categories of affiliates and non-affiliates with which it shares
nonpublic personal information.\383\ The privacy notices also must
describe the type of information the institution collects, how it
protects the confidentiality and security of nonpublic personal
information, a description of any opt out right, and certain
disclosures the institution makes under the FCRA.\384\
---------------------------------------------------------------------------

    \383\ See 17 CFR 248.6(a)(2)-(5) and 248.6(a)(9).
    \384\ See 17 CFR 248.6(a)(1) (information collection);
248.6(a)(8) (protecting nonpublic personal information), 248.6(a)(6)
(opt out rights); 248.6(a)(7) (disclosures the institution makes
under section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C.
1681a(d)(2)(A)(iii)), notices regarding the ability to opt out of
disclosures of information among affiliates).
---------------------------------------------------------------------------

3. Market Structure
    The amendments being proposed here would affect four categories of
covered institutions: broker-dealers other than notice-registered
broker-dealers, registered investment advisers, investment companies,
and transfer agents registered with the Commission or another
appropriate regulatory agency. These institutions compete in several
distinct markets and offer a wide range of services, including:
effecting customers' securities transactions, providing liquidity,
pooling investments, transferring ownership in securities, advising on
financial matters, managing portfolios, and consulting to pension
funds. Many of the larger covered institutions belong to more than one
category (e.g., a dually-registered broker-dealer/investment adviser),
and thus operate in multiple markets. In the rest of this section we
first outline the market for each class of covered institution and then
consider service providers.
a. Broker-Dealers
    Registered broker-dealers include both brokers (persons engaged in
the business of effecting transactions in securities for the account of
others) \385\ as well as dealers (persons engaged in the business of
buying and selling securities for their own accounts).\386\ Most
brokers and dealers maintain customer relationships, and are thus
likely to come into the possession of sensitive customer
information.\387\ In the market for broker-dealer services, a
relatively small set of large- and medium-sized broker-dealers dominate
while thousands of smaller broker-dealers compete in niche or regional
segments of the market.\388\ Broker-dealers provide a variety of
services related to the securities business, including (1) managing
orders for customers and routing them to various trading venues; (2)
providing advice to customers that is in connection with and reasonably
related to their primary business of effecting securities transactions;
(3) holding customers' funds and securities; (4) handling clearance and
settlement of trades; (5) intermediating between customers and
carrying/clearing brokers; (6) dealing in corporate debt and equities,
government bonds, and municipal bonds, among other securities; (7)
privately placing securities; and (8) effecting transactions in mutual
funds that involve transferring funds directly to the issuer. Some
broker-dealers may specialize in just one narrowly defined service,
while others may provide a wide variety of services.
---------------------------------------------------------------------------

    \385\ See 15 U.S.C. 78c(a)(4).
    \386\ See 15 U.S.C. 78c(a)(5).
    \387\ Such information would include the customers' names, tax
numbers, telephone numbers, broker, brokerage account numbers, etc.
    \388\ See Regulation Best Interest: The Broker-Dealer Standard
of Conduct, Release No. 34-86031 (June 5, 2019) [84 FR 33318 (July
12, 2019)], at 33406.
---------------------------------------------------------------------------

    Based on an analysis of FOCUS filings from year-end 2021, there
were 3,509 registered broker-dealers. Of these, 502 were dually-
registered as investment advisers. There were over 72 million customer
accounts reported by carrying brokers.\389\ However, the majority of
broker-dealers are not ``carrying broker-dealers'' and therefore do not
report the numbers of customer accounts.\390\ Therefore, we expect that
this figure of 72 million understates the total number of customer
accounts because many of the accounts at carrying broker dealers have
corresponding accounts with non-carrying brokers. Both carrying and
non-carrying broker-dealers potentially possess sensitive customer
information for the accounts that they maintain.\391\ Because non-
carrying broker-dealers do not report on the numbers of customer
accounts, it is not possible to ascertain with any degree of confidence
the distribution of customer accounts across the broader broker-dealer
population.
---------------------------------------------------------------------------

    \389\ Form X-17A-5 Schedule I, Item I8080 (as of July 1, 2022).
    \390\ See General Instructions to Form CUSTODY (as of Sept. 30,
2022).
    \391\ This information includes name, address, age, and tax
identification or Social Security number. See FINRA Rule 4512.
---------------------------------------------------------------------------

b. Investment Advisers
    Registered investment advisers provide a variety of services to
their clients, including: financial planning advice, portfolio
management, pension consulting, selecting other advisers, publication
of periodicals and newsletters, security rating and pricing, market
timing, and conducting educational seminars.\392\ Although advisers
engaged in any of these activities are likely to possess sensitive
customer information, the degree of sensitivity will vary widely across
advisers. An adviser that offers advice only on personalized investment
advice may not hold much customer information beyond address, payment
details, and the customer's overall financial condition. On the other
hand, an adviser that performs portfolio management services will
possess account numbers, tax identification numbers, access credentials
to brokerage accounts, and other highly sensitive information.
---------------------------------------------------------------------------

    \392\ See Form ADV.
---------------------------------------------------------------------------

    Based on Form ADV filings received up to June 1, 2022, there were
15,129 SEC-registered investment advisers with a total of 51 million
individual clients \393\ and $128 trillion in assets under
management.\394\ Practically all (97%) of these advisers reported
providing portfolio management services to their clients.\395\ Over
half (56%) reported having custody \396\ of clients' cash or securities
either directly or through a related person with client funds in
custody totaling $46 trillion.\397\
---------------------------------------------------------------------------

    \393\ Form ADV, Items 5D(a-b) (as of June 1 2022).
    \394\ Broadly, regulatory assets under management is the current
value of assets in securities portfolios for which the adviser
provides continuous and regular supervisory or management services.
See Form ADV, Part 1A Instruction 5.b.
    \395\ Form ADV, Items 5G(2-5) (as of June 1 2022).
    \396\ Here, ``custody'' means ``holding, directly or indirectly,
client funds or securities, or having any authority to obtain
possession of them.'' An adviser also has ``custody'' if ``a related
person holds, directly or indirectly, client funds or securities, or
has any authority to obtain possession of them, in connection with
advisory services [the adviser] provide[s] to clients.'' See 17 CFR
275.206(4)-2(d)(2).
    \397\ Form ADV, Items 9A and 9B (as of June 1 2022).

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.003

    Figure 3 plots the cumulative distribution of the number of
individual clients handled by SEC-registered investment advisers. The
distribution is highly skewed: thirteen advisers each have more than
one million clients while 95% of advisers have fewer than 2,000
clients. Many such advisers are quite small, with half reporting fewer
than 62 clients.\398\
---------------------------------------------------------------------------

    \398\ Form ADV, Item 5.A (as of June 1, 2022).
---------------------------------------------------------------------------

    Similarly, most SEC-registered investment advisers are limited
geographically. SEC-registered investment advisers must generally make
a ``notice filing'' with a state in which they have a place of business
or six or more clients.\399\ Figure 4 plots the frequency distribution
of the number the number of such filings. Based on notice filings, half
of SEC-registered investment advisers operate in fewer than four
states, and 38% operate in only one state.\400\
---------------------------------------------------------------------------

    \399\ See General Instructions to Form ADV (as of June 1, 2022).
    \400\ Form ADV, Item 2.C (as of June 1 2022). This includes
1,867 advisers who do not make any notice filings.

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.004

c. Investment Companies
    Investment companies are companies that issue securities and are
primarily engaged in the business of investing in securities.
Investment companies invest money they receive from investors on a