[Federal Register Volume 88, Number 66 (Thursday, April 6, 2023)]
[Proposed Rules]
[Pages 20616-20685]
[FR Doc No: 2023-05774]

Vol. 88

Thursday,

No. 66

April 6, 2023

Part II

Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Parts 240, 248, 270, et al.

Regulation S-P: Privacy of Consumer Financial Information and
Safeguarding Customer Information; Proposed Rule

Federal Register / Vol. 88 , No. 66 / Thursday, April 6, 2023 /
Proposed Rules

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 240, 248, 270, and 275

[Release Nos. 34-97141; IA-6262; IC-34854; File No. S7-05-23]
RIN 3235-AN26

Regulation S-P: Privacy of Consumer Financial Information and
Safeguarding Customer Information

AGENCY: Securities and Exchange Commission.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'' or
``SEC'') is proposing rule amendments that would require brokers and
dealers (or ``broker-dealers''), investment companies, and investment
advisers registered with the Commission (``registered investment
advisers'') to adopt written policies and procedures for incident
response programs to address unauthorized access to or use of customer
information, including procedures for providing timely notification to
individuals affected by an incident involving sensitive customer
information with details about the incident and information designed to
help affected individuals respond appropriately. The Commission also is
proposing to broaden the scope of information covered by amending
requirements for safeguarding customer records and information, and for
properly disposing of consumer report information. In addition, the
proposed amendments would extend the application of the safeguards
provisions to transfer agents. The proposed amendments would also
include requirements to maintain written records documenting compliance
with the proposed amended rules. Finally, the proposed amendments would
conform annual privacy notice delivery provisions to the terms of an
exception provided by a statutory amendment to the Gramm-Leach-Bliley
Act (``GLBA'').

DATES: Comments should be received on or before June 5, 2023.

ADDRESSES: Comments may be submitted by any of the following methods:

Electronic Comments

     Use the Commission's internet comment form (http://www.sec.gov/rules/submitcomments.htm); or
     Send an email to [email protected]. Please include
File Number S7-05-23 on the subject line.

Paper Comments

     Send paper comments to Secretary, Securities and Exchange
Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number S7-05-23. The file number
should be included on the subject line if email is used. To help the
Commission process and review your comments more efficiently, please
use only one method of submission. The Commission will post all
comments on the Commission's website (http://www.sec.gov/rules/proposed.shtml). Comments are also available for website viewing and
printing in the Commission's Public Reference Room, 100 F Street NE,
Washington, DC 20549, on official business days between the hours of 10
a.m. and 3 p.m. Operating conditions may limit access to the
Commission's public reference room. All comments received will be
posted without change; the Commission does not edit personal
identifying information from submissions. You should submit only
information that you wish to make available publicly.
    Studies, memoranda, or other substantive items may be added by the
Commission or staff to the comment file during this rulemaking. A
notification of the inclusion in the comment file of any such materials
will be made available on the Commission's website. To ensure direct
electronic receipt of such notifications, sign up through the ``Stay
Connected'' option at www.sec.gov to receive notifications by email.

FOR FURTHER INFORMATION CONTACT: Susan Poklemba, Brice Prince, or James
Wintering, Special Counsels; Edward Schellhorn, Branch Chief; Devin
Ryan, Assistant Director; John Fahey, Deputy Chief Counsel; Emily
Westerberg Russell, Chief Counsel; Office of Chief Counsel, Division of
Trading and Markets,<PHONE_NUMBER>; Jessica Leonardo or Taylor
Evenson, Senior Counsels; Aaron Ellias, Acting Branch Chief; Marc
Mehrespand, Branch Chief; Thoreau Bartmann, Co-Chief Counsel, Chief
Counsel's Office, Division of Investment Management,<PHONE_NUMBER>,
Securities and Exchange Commission, 100 F Street NE, Washington, DC
20549.

SUPPLEMENTARY INFORMATION: The Commission is proposing for public
comment amendments to 17 CFR 248 (``Regulation S-P'') \1\ under Title V
of the GLBA [15 U.S.C. 6801-6827], the Fair Credit Reporting Act
(``FCRA'') [15 U.S.C. 1681-1681x], the Securities Exchange Act of 1934
(``Exchange Act'') [15 U.S.C. 78a et seq.], the Investment Company Act
of 1940 (``Investment Company Act'') [15 U.S.C. 80a-1 et seq.], and the
Investment Advisers Act of 1940 (``Investment Advisers Act'') [15
U.S.C. 80b-1 et seq.].
---------------------------------------------------------------------------

    \1\ Unless otherwise noted, all references below to rules
contained in Regulation S-P are to Part 248 of Chapter 17 of the
Code of Federal Regulations (``CFR'').
---------------------------------------------------------------------------

Table of Contents

I. Introduction
    A. Background
    B. 2008 Proposal
    C. Overview of the Proposal
II. Discussion
    A. Incident Response Program Including Customer Notification
    1. Assessment
    2. Containment and Control
    3. Service Providers
    4. Notice to Affected Individuals
    B. Remote Work Arrangement Considerations
    C. Scope of Information Protected Under the Safeguards Rule and
Disposal Rule
    1. Definition of Customer Information
    2. Safeguards Rule and Disposal Rule Coverage of Customer
Information
    3. Extending the Scope of the Safeguards Rule and the Disposal
Rule To Cover All Transfer Agents
    4. Maintaining the Current Regulatory Framework for Notice-
Registered Broker-Dealers
    D. Recordkeeping
    E. Exception From the Annual Notice Delivery Requirement
    1. Current Regulation S-P Requirements for Privacy Notices
    2. Proposed Amendment
    F. Request for Comment on Limited Information Disclosure When
Personnel Leave Their Firms
    G. Other Current Commission Rule Proposals
    1. Covered Institutions Subject to the Regulation SCI Proposal
and the Exchange Act Cybersecurity Proposal
    2. Investment Management Cybersecurity
    H. Existing Staff No-Action Letters and Other Staff Statements
    I. Proposed Compliance Date
III. Economic Analysis
    A. Introduction
    B. Broad Economic Considerations
    C. Baseline
    1. Safeguarding Customer Information--Risks and Practices
    2. Regulation
    3. Market Structure
    D. Benefits and Costs of the Proposed Rule Amendments
    1. Response Program
    2. Extend Scope of Customer Safeguards to Transfer Agents
    3. Recordkeeping
    4. Exception From Annual Notice Delivery Requirement
    E. Effects on Efficiency, Competition, and Capital Formation
    F. Reasonable Alternatives Considered
    1. Reasonable Assurances From Service Providers
    2. Lower Threshold for Customer Notice

    3. Encryption Safe Harbor
    4. Longer Customer Notification Deadlines
    5. Broader Law Enforcement Exception From Notification
Requirements
    G. Request for Comment on Economic Analysis
IV. Paperwork Reduction Act
    A. Introduction
    B. Amendments to the Safeguards Rule and Disposal Rule
    C. Request for Comment
V. Initial Regulatory Flexibility Act Analysis
    A. Reason for and Objectives of the Proposed Action
    B. Legal Basis
    C. Small Entities Subject to Proposed Rule Amendments
    D. Projected Reporting, Recordkeeping, and Other Compliance
Requirements
    E. Duplicative, Overlapping, or Conflicting Federal Rules
    F. Significant Alternatives
    G. Request for Comment
VI. Consideration of Impact on the Economy Statutory Authority

I. Introduction

    The Commission adopted Regulation S-P in 2000.\2\ Regulation S-P's
provisions include, among other requirements, rule 248.30(a)
(``safeguards rule''), which requires brokers, dealers, investment
companies,\3\ and registered investment advisers to adopt written
policies and procedures for administrative, technical, and physical
safeguards to protect customer records and information.\4\ Another
provision of Regulation S-P, rule 248.30(b) (``disposal rule''), which
applies to transfer agents registered with the Commission in addition
to the institutions covered by the safeguards rule, requires proper
disposal of consumer report information.\5\ Since Regulation S-P was
adopted, evolving digital communications and information storage tools
and other technologies have made it easier for firms to obtain, share,
and maintain individuals' personal information. This evolution also has
changed or exacerbated the risks of unauthorized access to or use of
personal information,\6\ thus increasing the risk of potential harm to
individuals whose information is not protected against unauthorized
access or use.\7\
---------------------------------------------------------------------------

    \2\ See Privacy of Consumer Financial Information (Regulation S-
P), Exchange Act Release No. 42974 (June 22, 2000) [65 FR 40334
(June 29, 2000)] (``Reg. S-P Release''). Regulation S-P is codified
at 17 CFR Part 248, Subpart A.
    \3\ Regulation S-P applies to investment companies as the term
is defined in section 3 of the Investment Company Act (15 U.S.C.
80a-3), whether or not the investment company is registered with the
Commission. See 17 CFR 248.3(r). Thus, a business development
company, which is an investment company but is not required to
register as such with the Commission, is subject to Regulation S-P.
Similarly, employees' securities companies--including those that are
not required to register under the Investment Company Act--are
investment companies and are, therefore, subject to Regulation S-P.
By contrast, issuers that are excluded from the definition of
investment company--such as private funds that are able to rely on
section 3(c)(1) or 3(c)(7) of the Investment Company Act--would not
be subject to Regulation S-P.
    \4\ See 17 CFR 248.30(a).
    \5\ See 17 CFR 248.30(b). In this release, institutions to which
Regulation S-P currently applies, or to which the proposed
amendments would apply, are sometimes referred to as ``covered
institutions.'' The term, ``covered institution'' is sometimes used
in this release to refer to institutions to as ``you'' in Regulation
S-P.
    \6\ Unauthorized use differs from unauthorized access in that a
person making unauthorized use of customer information may or many
not be authorized to access it. CF. Van Buren v. United States, 141
S. Ct. 1648, 1652 (2021) (discussing how a person can access a
computer without authorization or exceed authorized access). As
described in more detail below, covered institutions would have to
provide notice to affected individuals whose sensitive customer
information was, or is reasonably likely to have been, accessed or
used without authorization.
    \7\ See, e.g., Federal Bureau of Investigation, 2021 Internet
Crime Report (Mar. 22, 2022), at 7-8, available at https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf (stating that
the FBI's internet Crime Complaint Center received 847,376
complaints in 2021 (an increase of approximately 181% from 2017).
The complaints included 51,629 related to identity theft and 51,829
related to personal data breaches (increases of approximately 193%
and 68% from 2017, respectively)); the Financial Industry Regulatory
Authority (``FINRA''), 2021 Report on FINRA's Examination and Risk
Monitoring Program: Cybersecurity and Technology Governance (Feb.
2021), available at https://www.finra.org/sites/default/files/2021-02/2021-report-finras-examination-risk-monitoring-program.pdf
(noting increased cybersecurity or technology-related incidents at
firms); Office of Compliance Inspections and Examinations (now the
Division of Examinations) (``EXAMS''), Risk Alert, Cybersecurity:
Safeguarding Client Accounts against Credential Compromise (Sept.
15, 2020), available at https://www.sec.gov/files/Risk%20Alert%20-%20Credential%20Compromise.pdf (describing increasingly
sophisticated methods used by attackers to gain access to customer
accounts and firm systems). This Risk Alert, and any other
Commission staff statements represent the views of the staff. They
are not a rule, regulation, or statement of the Commission.
Furthermore, the Commission has neither approved nor disapproved
their content. These staff statements, like all staff statements,
have no legal force or effect: they do not alter or amend applicable
law; and they create no new or additional obligations for any
person.
---------------------------------------------------------------------------

    This environment of expanded risks supports our proposing updates
to the requirements of Regulation S-P. Currently, the safeguards rule
addresses protecting customer information against unauthorized access
or use, but it does not include a requirement to notify affected
individuals in the event of a data breach. In assessing firm and
industry compliance with these requirements, Commission staff typically
focus on information security controls, including whether firms have
taken appropriate measures to safeguard customer accounts and to
respond to data breaches.\8\ Commission staff have observed a number of
practices with respect to the information safeguards requirements of
Regulation S-P and have provided observations on several occasions to
assist firms in improving their practices.\9\ Although many firms have
improved their programs for safeguarding customer records and
information in light of these observations, nonetheless we are
concerned that some firms may not maintain plans for addressing
incidents of unauthorized access to or use of data.\10\ We also are
concerned the incident response programs that firms have implemented
may be insufficient to respond to evolving threats or may not include
well-designed plans for customer notification.\11\
---------------------------------------------------------------------------

    \8\ See EXAMS, 2022 Examination Priorities, available at https://www.sec.gov/files/2022-exam-priorities.pdf; EXAMS, Investment
Adviser and Broker-Dealer Compliance Issues Related to Regulation S-
P--Privacy Notices and Safeguard Policies (Apr. 16, 2019) (``Reg. S-
P Risk Alert''), available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf.
    \9\ See Reg. S-P Risk Alert, supra note 8 (noting that examples
of the most common deficiencies or weaknesses observed by EXAMS
staff included that broker-dealer and investment adviser written
incident response plans did not address, among other things, actions
required to address a cybersecurity incident and assessments of
system vulnerabilities); EXAMS, Observations from Cybersecurity
Examinations (Aug. 7, 2017) (``Observations Risk Alert''), available
at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf.
    \10\ See Reg. S-P Risk Alert, supra note 8; Observations Risk
Alert, supra note 9 (noting that some firms lacked plans for
addressing access incidents).
    \11\ See Reg. S-P Risk Alert, supra note 8. Although broker-
dealers are subject to self-regulatory organization (``SRO'') rules
requiring written supervisory procedures and written business
continuity plans addressing subjects including data back-up and
recovery, SRO rules do not require notification to customers whose
information is compromised. See, e.g., FINRA Rule 3110 (Supervision)
(requiring members to establish, maintain, and enforce written
procedures to supervise the types of business in which they engage
and the activities of their associated persons that are reasonably
designed to achieve compliance with applicable securities laws and
regulations, and with applicable FINRA rules), and FINRA Rule 4370
(Business Continuity Plans and Emergency Contact Information)
(requiring members to create and maintain a written business
continuity plan identifying procedures relating to an emergency or
significant business disruption that must address specified topics
including data back-up and recovery).
---------------------------------------------------------------------------

    We therefore preliminarily believe specifically requiring a
reasonably designed incident response program, including policies and
procedures for assessment, control and containment, and customer
notification, could help reduce or mitigate the potential for harm to
individuals whose sensitive information is exposed or compromised in a
data breach. Requiring firms to adopt incident response programs to
address unauthorized access to or use of customer information,
including

customer notification and recordkeeping requirements, would enhance
protections for customer information. The advance planning required
under an incident response program should improve an institution's
preparedness and the effectiveness of its response to data breaches
while still being consistent with the requirements for safeguarding
standards articulated in the GLBA.\12\
---------------------------------------------------------------------------

    \12\ The GLBA's requirements for standards for safeguarding
customer records and information are described in the Background
section below. See infra section I.A.
---------------------------------------------------------------------------

    In certain instances, some types of customer notification plans may
already be required by existing state laws mandating customer
notifications. While all 50 states have enacted laws in recent years
requiring firms to notify individuals of data breaches, standards
differ by state, with some states imposing heightened notification
requirements relative to other states.\13\ Currently, broker-dealers,
investment companies, and registered investment advisers respond to
data breaches according to applicable state laws. For example, states
differ in the types of information that, if accessed or used without
authorization, may trigger a notification requirement.\14\ States also
differ regarding a firm's duty to investigate a data breach when
determining whether notice is required, deadlines to deliver notice,
and the information required to be included in a notice, among other
matters.\15\ As a result, a firm's notification obligations arising
from a single data breach may vary such that customers in one state may
receive notice while customers of the same institution in another state
may not receive notice or may receive less information. In reviewing
these state laws, we determined that certain aspects of these
provisions would be appropriately adopted as components of a Federal
minimum standard for customer notification, which would help affected
customers understand how to respond to a data breach to protect
themselves from potential harm that could result.
---------------------------------------------------------------------------

    \13\ Upon its adoption, rule 248.17 essentially restated the
then-current text of section 507 of the GLBA, and as such,
referenced determinations made by the Federal Trade Commission. See
Reg. S-P Release, supra note 2. The proposal would, however, update
rule 248.17 to instead reference determinations made by the Consumer
Financial Protection Bureau, consistent with changes made to section
507 of the GLBA by the Dodd-Frank Wall Street Reform and Consumer
Protection Act. See Public Law 111-203, sec. 1041, 124 Stat. 1376
(2010).
    \14\ For example, some states may require a firm to notify
individuals when a data breach includes biometric information, while
others do not. Compare Cal. Civil Code sec. 1798.29 (notice to
California residents of a data breach generally required when a
resident's personal information was or is reasonably believed to
have been acquired by an unauthorized person; ``personal
information'' is defined to mean an individual's first or last name
in combination with one of a list of specified elements, which
includes certain unique biometric data) with Ala. Stat. secs. 8-38-
2, 8-38-4, 8-38-5 (notice of a data breach to Alabama residents is
generally required when sensitive personally identifying information
has been acquired by an unauthorized person and is reasonably likely
to cause substantial harm to the resident to whom the information
relates; ``sensitive personally identifying information'' is defined
as the resident's first or last name in combination with one of a
list of specified elements, which does not include biometric
information).
    \15\ See infra sections II.A.4 and III.C.2.a.
---------------------------------------------------------------------------

    Our proposal would afford certain individuals greater protections
by, for example, defining ``sensitive customer information'' more
broadly than the current definitions used by at least 12 states,
thereby requiring customers in those states to receive notice for a
broader range of personal information included in a breach.\16\
Additionally, the 30-day notification deadline proposed in this release
is shorter than the timing currently mandated by 15 states, and would
also offer enhanced protections to individuals in 32 states with laws
that do not include a notification deadline as well as those in states
that mandate or permit delayed notifications for law enforcement
purposes.\17\ A standardized notification deadline ensures timely
notice to affected customers and would enhance their ability to take
action quickly to protect themselves against the consequences of a
breach. Further, consistent with 22 state laws, this proposal would
require customer notification unless, after investigation, the covered
institution finds no risk of harm.\18\ Twenty-one states currently have
a presumption against notifying customers of a breach, and only require
notice if, after investigation, the covered institution finds risk of
harm.\19\ In addition, in the 11 states where state customer
notification laws do not apply to entities subject to or in compliance
with the GLBA, the proposal would help ensure customers of such
institutions receive notice of a breach.\20\ As discussed more fully
below, establishing a federal minimum standard would protect
individuals in an environment of enhanced risk.\21\
---------------------------------------------------------------------------

    \16\ See infra section II.C.1.
    \17\ See infra section II.A.4.e.
    \18\ See infra section II.A.4.a.
    \19\ See id.
    \20\ See id.
    \21\ The effect of any inconsistency between the proposed
customer notification and state law requirements may, however, be
mitigated because many states offer safe harbors from their
notification laws for entities that are subject to or in compliance
with requirements under Federal regulations. In particular, as
noted, 11 states offer safe harbors for entities subject to or in
compliance with the GLBA, while others offer safe harbors for
compliance with the notification requirements of the entity's
``primary federal regulator.'' See, e.g., Del. Code Ann. tit. 6
section 12B-103 (providing that a person regulated by the GLBA and
maintaining procedures for security breaches pursuant to the law
established by its Federal regulator is deemed to be in compliance
with the Delaware notification requirements if the person notifies
affected Delaware residents in accordance with those procedures).
See infra note 106 and accompanying text.
---------------------------------------------------------------------------

    There are compelling reasons to revisit other aspects of the
current safeguards regime as well. As noted above, the safeguards rule
currently applies to broker-dealers, investment companies, and
registered investment advisers. The safeguards rule does not currently
apply to transfer agents, even though they also obtain, share, and
maintain personal information on behalf of securityholders who hold
securities in registered form (i.e., in their own name rather than
indirectly through a broker). Securityholders whose personal
information is maintained by transfer agents could be harmed by the
unauthorized access or use of such information in the same manner as
customers of broker-dealers, investment companies, and registered
investment advisers, yet such securityholders are not currently
protected by the safeguards rule. The Commission preliminarily believes
that extending the safeguards rule to cover transfer agents is
necessary to ensure that there is a Federal minimum standard for the
notification of securityholders who are affected by a data breach that
leads to the unauthorized access or use of their information,
regardless of whether that data breach occurs at a broker-dealer,
investment company, registered investment adviser, or transfer
agent.\22\
---------------------------------------------------------------------------

    \22\ See infra section II.C.3.
---------------------------------------------------------------------------

    In addition, the safeguards rule currently requires only that
institutions protect their own customers' information. This potentially
overlooks information a broker-dealer, investment company, or
registered investment adviser may have received from another financial
institution about that financial institution's customers,\23\ such as

nonpublic personal information from an introducing broker or dealer
that clears transactions for its customers through a clearing broker on
a fully disclosed basis.\24\ Applying the safeguards rule and the
disposal rule to customer information that a covered institution
receives from other financial institutions would better protect
individuals by ensuring customer information safeguards are not lost
when a third-party financial institution shares that information with a
covered institution.\25\ Finally, applying the safeguards rule and the
disposal rule to a broader set of information should enhance the
security and confidentiality of customers' personal information.
---------------------------------------------------------------------------

    \23\ Under section 501(b) of the GLBA, the standards to be
established by the Commission must, among other things, ``protect
against unauthorized access to or use of'' customer records or
information ``which could result in substantial harm or
inconvenience to any customer.'' See 15 U.S.C. 6801(b)(3) (emphasis
added). We agree with the Federal Trade Commission (``FTC'') that
applying the safeguards rule to cover customer information that a
financial institution receives pertaining to another institution's
customers is consistent with the purpose and language of the GLBA.
Further, the Commission agrees with the FTC that this approach is
the most reasonable reading of the statutory language and clearly
furthers the express congressional policy to respect the privacy of
these customers and to protect the security and confidentiality of
their nonpublic personal information. See FTC, Standards for
Safeguarding Customer Information, 67 FR 36484, 36485-86 (May 23,
2002); see also infra section II.C.2 (describing proposed new
definition of ``customer information'' that would include both
nonpublic personal information that a covered institution collects
about its own customers and nonpublic personal information about
customers of a third-party financial institution that the covered
institution receives from the third-party financial institution).
    \24\ See 17 CFR 248.3(g)(2)(iii) (``An individual is not your
consumer if he or she has an account with another broker or dealer
(the introducing broker-dealer) that carries securities for the
individual in a special omnibus account with you (the clearing
broker-dealer) in the name of the introducing broker-dealer, and
when you receive only the account numbers and transaction
information of the introducing broker-dealer's consumers in order to
clear transactions.'').
    \25\ See infra section II.C.2.
---------------------------------------------------------------------------

    Therefore, the Commission is proposing amendments to Regulation S-P
to enhance the protection of this information by: (1) requiring covered
institutions to include incident response programs in their safeguards
policies and procedures to address unauthorized access to or use of
customer information, including procedures for providing timely
notification to affected individuals; (2) extending the safeguards rule
to all transfer agents registered with the Commission or another
appropriate regulatory agency as defined in section 3(a)(34)(B) of the
Exchange Act (unless otherwise noted, we refer to them collectively as
``transfer agents'' for purposes of this release); (3) more closely
aligning the information protected by the safeguards rule and the
disposal rule; and (4) broadening the set of customers covered by those
rules.

A. Background

    Title V of the GLBA,\26\ among other things, directed the
Commission and other Federal financial regulators to establish and
implement standards requiring financial institutions subject to their
jurisdiction to adopt administrative, technical, and physical
safeguards for the protection of customer records and information.\27\
The GLBA specified that these standards were ``(1) to insure the
security and confidentiality of customer records and information; (2)
to protect against any anticipated threats or hazards to the security
or integrity of such records; and (3) to protect against unauthorized
access to or use of such records or information which could result in
substantial harm or inconvenience to any customer.'' \28\
---------------------------------------------------------------------------

    \26\ 15 U.S.C. 6801-6827.
    \27\ See 15 U.S.C. 6801(b) and 6804(a)(1).
    \28\ 15 U.S.C. 6801(b).
---------------------------------------------------------------------------

    As noted above, the safeguards rule sets forth standards for
safeguarding customer records and information and currently requires
covered institutions to adopt written policies and procedures for
administrative, technical, and physical safeguards to protect customer
records and information.\29\ While the term ``customer records and
information'' is not defined in the GLBA or in Regulation S-P,\30\ the
safeguards must be reasonably designed to meet the GLBA's
standards.\31\ This approach is designed to provide flexibility for
covered institutions to safeguard customer records and information in
accordance with their own privacy policies and practices and business
models.
---------------------------------------------------------------------------

    \29\ 17 CFR 248.30(a). Other sections of Regulation S-P
implement the notice and opt out provisions of the GLBA. See 17 CFR
248.1-248.18. In addition to the safeguards rule and the disposal
rule (17 CFR 248.30(b)), the GLBA and Regulation S-P require
brokers, dealers, investment companies and registered investment
advisers to provide an annual notice of their privacy policies and
practices to their customers (and notice to consumers before sharing
their nonpublic customer information with nonaffiliated third
parties outside certain exceptions). See 15 U.S.C. 6803(a); 17 CFR
248.4; 17 CFR 248.5. We are also proposing an exception to the
annual notice delivery requirement. See infra section II.E.
    \30\ See 17 CFR 248.30(a); 15 U.S.C. 6801(b)(1) (discussing but
not defining ``customer records or information'').
    \31\ Specifically, the safeguards must be reasonably designed to
insure the security and confidentiality of customer records and
information, protect against anticipated threats to the security or
integrity of those records and information, and protect against
unauthorized access to or use of such records or information that
could result in substantial harm or inconvenience to any customer.
See 17 CFR 248.30(a). See also 15 U.S.C. 6801(b).
---------------------------------------------------------------------------

    Pursuant to the Fair and Accurate Credit Transactions Act of 2003
(``FACT Act''), the Commission amended Regulation S-P in 2004 by
adopting the disposal rule to protect against the improper disposal of
``consumer report information.'' \32\ ``Consumer report information''
is defined as ``any record about an individual, whether in paper,
electronic or other form, that is a consumer report or is derived from
a consumer report'' and also means ``a compilation of such records,''
but does not include ``information that does not identify individuals,
such as aggregate information or blind data.'' \33\ The disposal rule
currently applies to the financial institutions subject to the
safeguards rule, except that it excludes ``notice-registered broker-
dealers,'' \34\ and it applies to transfer agents registered with the
Commission.\35\ The disposal rule requires these entities that maintain
or possess ``consumer report information'' for a business purpose, to
take ``reasonable measures to protect against unauthorized access to or
use of the information in connection with its disposal.'' \36\
---------------------------------------------------------------------------

    \32\ 17 CFR 248.30(b). See Disposal of Consumer Report
Information, Exchange Act Release No. 50781 (Dec. 2, 2004) [69 FR
71322 (Dec. 8, 2004)] (``Disposal Rule Adopting Release''). Section
216 of the FACT Act amended the FCRA by adding section 628 (codified
at 15 U.S.C. 1681w), which directed the Commission and other Federal
financial regulators to adopt regulations ``requiring any person who
maintains or possesses consumer information or any compilation of
consumer information derived from a consumer report for a business
purpose must properly dispose of the information.''
    \33\ See 17 CFR 248.30(b)(1)(ii).
    \34\ See 17 CFR 248.30(b)(1)(iv) (defining ``notice-registered
broker-dealers'' as ``a broker or dealer registered by notice with
the Commission under section 15(b)(11) of the Securities Exchange
Act of 1934 (15 U.S.C. 78o(b)(11))''). See also infra section II.C.4
further detailing the current regulatory framework for notice-
registered broker-dealers under the safeguards rule and the disposal
rule.
    \35\ See 17 CFR 248.30(b)(2)(i).
    \36\ See 17 CFR 248.30(b).
---------------------------------------------------------------------------

    The GLBA and FACT Act oblige us to adopt regulations, to the extent
possible, that are consistent and comparable with those adopted by the
Banking Agencies and the FTC.\37\ Accordingly, in determining the scope
of the proposed amendments contemplated in this proposal, including for
example, the definitions of ``customer information'' and ``sensitive
customer information'' described below, we are mindful of the need to
set standards for safeguarding customer records and information that
are consistent and comparable with the corresponding standards set by
the Banking Agencies and the FTC.
---------------------------------------------------------------------------

    \37\ See generally 15 U.S.C. 6804(a) (directing the agencies
authorized to prescribe regulations under title V of the GLBA to
assure to the extent possible that their regulations are consistent
and comparable); 15 U.S.C. 1681w(a)(2)(A) (directing the agencies
with enforcement authority set forth in 15 U.S.C. 1681s to consult
and coordinate so that, to the extent possible, their regulations
are consistent and comparable). The ``Banking Agencies'' include the
Office of the Comptroller of the Currency (``OCC''), the Board of
Governors of the Federal Reserve System (``FRB''), the Federal
Deposit Insurance Corporation (``FDIC''), and the former Office of
Thrift Supervision.

---------------------------------------------------------------------------

B. 2008 Proposal

    In 2008, the Commission proposed amendments to Regulation S-P
primarily to help prevent information security breaches in the
securities industry and to improve responsiveness when such breaches
occur, with the goal of better protecting investors from identity theft
and other misuse of what the proposal would have defined as ``personal
information.'' \38\ The 2008 Proposal would have set out specific
standards for safeguarding customer records and information, including
requirements for procedures to respond to incidents of unauthorized
access to or use of personal information. Those requirements would have
included procedures for notifying the Commission (or a broker-dealer's
designated examining authority \39\) of data breach incidents, and
procedures for notifying individuals of incidents of unauthorized
access to or misuse of sensitive personal information, if the misuse
had occurred or was reasonably possible. The 2008 Proposal also would
have amended the safeguards rule and the disposal rule so that both
would have protected ``personal information,'' which would have
included any record containing either ``nonpublic personal
information'' or ``consumer report information.'' \40\ In addition, the
2008 Proposal would have extended the safeguards rule to apply to
transfer agents registered with the Commission, and would have extended
the disposal rule to apply to natural persons who are associated
persons of a broker or dealer, supervised persons of a registered
investment adviser, and associated persons of any transfer agent
registered with the Commission. The 2008 Proposal would have further
required brokers, dealers, investment companies, registered investment
advisers, and transfer agents registered with the Commission to
maintain and preserve written records of their policies and procedures
required under the disposal and safeguards rules and compliance with
those policies and procedures.
---------------------------------------------------------------------------

    \38\ See Part 248--Regulation S-P: Privacy of Consumer Financial
Information and Safeguarding Customer information, Exchange Act
Release No. 57427 (Mar. 4, 2008) [73 FR 13692, 13693-94 (Mar. 13,
2008)] (``2008 Proposal''). The amendments to Regulation S-P
referenced in the 2008 Proposal have not been adopted.
    \39\ A broker-dealer's designated examining authority is the SRO
of which the broker-dealer is a member, or, if the broker-dealer is
a member of more than one SRO, the SRO designated by the Commission
pursuant to 17 CFR 240.17d-1 as responsible for examination of the
member for compliance with applicable financial responsibility rules
(including the Commission's customer account protection rules at 17
CFR 240.15c3-3). See 2008 Proposal, supra note 38, at n.44.
    \40\ The 2008 Proposal would have made both the safeguards rule
and the disposal rule, as amended, applicable to ``personal
information,'' which would have been defined to include any record
containing either ``nonpublic personal information'' or ``consumer
report information'' that is identified with any consumer, or with
any employee, investor, or securityholder who is a natural person,
whether in paper, electronic, or other form, that is handled or
maintained by or on behalf of a covered institution. See 2008
Proposal, supra note 38, at 73 FR 13700.
---------------------------------------------------------------------------

    The Commission received over 400 comment letters in response to the
2008 Proposal.\41\ The current proposal to amend Regulation S-P has
been informed by comments received on the 2008 Proposal. Most
commenters supported requirements for comprehensive information
security programs that are consistent and comparable to the rules and
guidance of other Federal financial regulators.\42\ Many commenters,
however, objected to changes in the scope of information and entities
covered by the proposed amendments.\43\ Many commenters opposed or
suggested modifying the proposed amendments' information security
breach response provisions.\44\ Comments were mixed on the proposed
exception for disclosures relating to transfers of representatives from
one broker-dealer or registered investment adviser to another.\45\
---------------------------------------------------------------------------

    \41\ Comments on the proposal, including comments referenced in
this Release are available on the Commission website at http://www.sec.gov/comments/s7-06-08/s70608.shtml. Approximately 328 of the
comments received contained substantially the same content. See
example of Letter Type A available at https://www.sec.gov/comments/s7-06-08/s70608typea.htm.
    \42\ See, e.g., Letter from Alan E. Sorcher, Managing Director
and Associate General Counsel, Securities Industry and Financial
Markets Association (May 12, 2008) (``SIFMA Letter''); Letter from
Tamara K. Salmon, Senior Associate Counsel, Investment Company
Institute (May 2, 2008) (``ICI Letter''); Letter from Marcia E.
Asquith, Senior Vice President and Corporate Secretary, Financial
Industry Regulatory Authority (May 12, 2008) (``FINRA Letter'').
    \43\ See, e.g., SIFMA Letter; Letter from Charles V. Rossi,
President, The Securities Transfer Association, Inc. (May 9, 2008)
(``STA Letter'').
    \44\ See, e.g., SIFMA Letter; ICI Letter; Letter from Karen L.
Barr, General Counsel, Investment Adviser Association (May 12, 2008)
(``IAA Letter''); Letter from Sarah Miller, General Counsel, ABA
Securities Association (May 22, 2008) (``ABASA Letter'').
    \45\ See, e.g., SIFMA Letter; IAA Letter (both in support);
Letter from Julius L. Loeser, Chief Regulatory and Compliance
Counsel, Comerica Securities, Inc. (May 9, 2008) (``Comerica
Letter''); Letter from Steven French, President, MemberMap LLC (May
11, 2008) (``MemberMap Letter'') (both opposed).
---------------------------------------------------------------------------

C. Overview of the Proposal

    There are no Commission rules at this time expressly requiring
broker-dealers, investment companies, or registered investment advisers
to have policies and procedures for responding to data breach incidents
or to notify customers of those breaches.\46\ As noted above, advance
planning would be part of creating a reasonably designed incident
response program, and its prompt implementation following a breach
(including notification to affected individuals), is important in
limiting potential harmful impacts to individuals. While we recognize
that state laws require covered institutions to notify state residents
of data breaches, those laws are not consistent and exclude some
entities from certain requirements. Accordingly, a Federal minimum
standard would provide notification to all customers of a covered
institution affected by a data breach (regardless of state residency)
and provide consistent disclosure of important information to help
affected customers respond to a data breach. Other Federal regulators'
GLBA safeguarding standards also include a requirement for a data
breach response plan or program.\47\
---------------------------------------------------------------------------

    \46\ As noted above, there are no SRO rules requiring
notification to customers whose information has been compromised.
See supra note 11. The Commission has pending proposals to address
cybersecurity risk with respect to investment advisers, investment
companies, and public companies. The Commission encourages
commenters to review those proposals to determine whether it might
affect their comments on this proposing release. See infra note 55.
    \47\ The FTC recently amended its Safeguards Rule by, among
other things, adding a requirement for financial institutions under
the FTC's GLBA jurisdiction to establish a written incident response
plan designed to respond to information security events. See FTC,
Standards for Safeguarding Customer Information, 86 FR 70272 (Dec.
9, 2021) (``FTC Safeguards Release''). As amended, the FTC's rule
requires that a response plan address security events materially
affecting the confidentiality, integrity, or availability of
customer information in the financial institution's control, and
that the plan include specified elements that would include
procedures for satisfying an institution's independent obligation to
perform notification as required by state law. See FTC Safeguards
Release, at 70297-98, n.295. Earlier, the Banking Agencies and the
National Credit Union Administration (``NCUA'') jointly issued
guidance on responding to incidents of unauthorized access to or use
of customer information. See Interagency Guidance on Response
Programs for Unauthorized Access to Customer Information and
Customer Notice, 70 FR 15736, 15743 (Mar. 29, 2005) (``Banking
Agencies' Incident Response Guidance''). The Banking Agencies'
Incident Response Guidance provides, among other things, that when
an institution becomes aware of an incident of unauthorized access
to sensitive customer information, the institution should conduct a
reasonable investigation to determine promptly the likelihood that
the information has been or will be misused. If the institution
determines that misuse of the information has occurred or is
reasonably possible, it should notify affected customers as soon as
possible.
---------------------------------------------------------------------------

    The Commission is proposing amendments to Regulation S-P's
safeguards rule. The proposed amendments would require covered
institutions to develop, implement, and maintain written policies and

procedures for an incident response program that is reasonably designed
to detect, respond to, and recover from unauthorized access to or use
of customer information.\48\ The amendments would require that a
response program include procedures to assess the nature and scope of
any incident and to take appropriate steps to contain and control the
incident to prevent further unauthorized access or use.\49\
---------------------------------------------------------------------------

    \48\ See proposed rule 248.30(b).
    \49\ See proposed rule 248.30(b)(3).
---------------------------------------------------------------------------

    The proposed response program procedures also would have to include
notification to individuals whose sensitive customer information was,
or is reasonably likely to have been, accessed or used without
authorization.\50\ Notice would not be required if a covered
institution determines, after a reasonable investigation of the facts
and circumstances of the incident of unauthorized access to or use of
sensitive customer information, that the sensitive customer information
has not been, and is not reasonably likely to be, used in a manner that
would result in substantial harm or inconvenience.\51\ Under the
proposed amendments, a customer notice must be clear and conspicuous
and provided by a means designed to ensure that each affected
individual can reasonably be expected to receive it.\52\ A covered
institution would be required to provide notice as soon as practicable,
but not later than 30 days, that the incident occurred or is reasonably
likely to have occurred.\53\ To the extent a covered institution would
have a notification obligation under both the proposed rules and a
similar state law, a covered institution should be able to provide one
notice to satisfy notification obligations under both the proposed
rules and the state law, provided it included all information required
under both the proposed rules and the state law.\54\
---------------------------------------------------------------------------

    \50\ See proposed rule 248.30(b)(4). See proposed rule
248.30(e)(9) for the definition of ``sensitive customer
information.'' See also infra section II.A.4, which includes a
discussion of ``sensitive customer information.''
    \51\ See id.
    \52\ See proposed rule 248.30(b)(4)(i).
    \53\ See proposed rule 248.30(b)(4)(iii).
    \54\ We are not aware of any laws that would require the sending
of multiple customer notices.
---------------------------------------------------------------------------

    The Commission also is proposing amendments to Regulation S-P to
enhance the protection of customers' nonpublic personal information.
These proposed amendments would more closely align the information
protected under the safeguards rule and the disposal rule by applying
the protections of both rules to ``customer information,'' a newly
defined term. We also propose to broaden the group of customers whose
information is protected under both rules. Additionally, we propose to
bring all transfer agents within the scope of the safeguards rule.
    The proposal is not inconsistent with other recent cybersecurity-
related rulemaking proposals.\55\ Additionally, as described in greater
detail below,\56\ the Commission is also proposing rules and rule
amendments related to cybersecurity risk and related disclosures as
well as Regulation SCI.\57\ We encourage commenters to review those
other cybersecurity-related rulemaking proposals to determine whether
those proposals might affect comments on this proposing release.
---------------------------------------------------------------------------

    \55\ See Cybersecurity Risk Management for Investment Advisers,
Registered Investment Companies, and Business Development Companies,
Securities Act Release No. 11028 (Feb. 9, 2022) [87 FR 13524 (Mar.
9, 2022)] (``Investment Management Cybersecurity Proposal''); see
also Cybersecurity Risk Management, Strategy, Governance, and
Incident Disclosure, Securities Act Release No. 11038 (Mar. 9, 2022)
[87 FR 16590 (Mar. 23, 2022) (``Corporation Finance Cybersecurity
Proposal'').
    \56\ See infra section II.G.
    \57\ Regulation SCI is codified at 17 CFR 242.1000 through 1007.
As described further below, while the overall nature of each
cybersecurity-related proposal is similar given the topic, the scope
of each proposal addresses different cybersecurity-related issues as
they relate in different ways to different entities, types of
covered information or systems, and products. See Cybersecurity Risk
Management Proposed Rule for Broker-Dealers, Clearing Agencies,
Major Security-Based Swap Participants, the Municipal Securities
Rulemaking Board, National Securities Associations, National
Securities Exchanges, Security-Based Swap Data Repositories,
Security-Based Swap Dealers, and Transfer Agents, Exchange Act
Release No. 97142 (Mar. 15, 2023), (``Exchange Act Cybersecurity
Proposal'') and Regulation Systems Compliance and Integrity,
Exchange Act Release No. 97143 (Mar. 15, 2023), (``Regulation SCI
Proposal'').
---------------------------------------------------------------------------

II. Discussion

A. Incident Response Program Including Customer Notification

    Security incidents can occur in different ways, such as through
takeovers of online accounts by bad actors, improper disposal of
customer information in areas that may be accessed by unauthorized
persons, or the loss or theft of data that includes customer
information. Whatever the means, unauthorized access to, or use of,
customer information may result in misuse, exposure or theft of a
customer's nonpublic personal information, which could result in
substantial harm or inconvenience to individuals affected by a security
incident. Exposure of customer information in a security incident,
whether it results from unauthorized access to or use of customer
information by an employee \58\ or external actor,\59\ could leave
affected individuals vulnerable to having their information further
compromised.\60\ Bad actors can use customer information to cause harm
in a number of ways, such as by stealing

customer identities to sell to other bad actors on the dark web,\61\
publishing customer information on the dark web, using customer
identities to carry out fraud themselves, or taking over a customer's
account for malevolent purposes. For example, a bad actor could use
compromised customer information such as login credentials (e.g., a
username and password), as part of an account takeover scheme to obtain
unauthorized entry to a customer's online brokerage account, putting
customer assets at risk for unauthorized fund transfers or trades.\62\
Similarly, a bad actor could engage in new account fraud by using
compromised customer information to establish a brokerage account
without the customer's knowledge through identity theft. Once the bad
actor has taken over the customer's account, or has opened a fraudulent
new account, it could potentially use a separate account at another
broker-dealer to trade against these accounts for profit, which could
result in harm to the affected customer.\63\
---------------------------------------------------------------------------

    \58\ For example, an employee might access and download
confidential customer data to a personal server that is subsequently
hacked by a third party. Once the customer data has been stolen,
portions of the customer data could be posted on the internet along
with an offer to sell a larger quantity of stolen data in exchange
for payment. See, e.g., Commission Order, In the Matter of Morgan
Stanley Smith Barney LLC, Release No. 34-78021 (June 8, 2016),
available at https://www.sec.gov/litigation/admin/2016/34-78021.pdf
(settled order) (finding that an employee misappropriated data
regarding approximately 730,000 customer accounts, associated with
approximately 330,000 different households, by accessing two of the
firm's portals. The misappropriated data included personally
identifiable information (``PII'') such as customers' full names,
phone numbers, street addresses, account numbers, account balances,
and securities holdings).
    \59\ For example, unauthorized third parties could take over
email accounts, resulting in exposure of customer information. An
email account takeover occurs when an unauthorized third party gains
access to the email account and, in addition to being able to view
its contents, is also able to take actions of a legitimate user,
such as sending and deleting emails or setting up forwarding rules.
See, e.g., Commission Order, In the Matter of Cambridge Investment
Research, Inc., et al., Release No. 34-92806 (Aug. 30, 2021)
(``Cambridge Order''), available at https://www.sec.gov/litigation/admin/2021/34-92806.pdf (settled order) (finding that cloud-based
email accounts of over 121 Cambridge independent contractor
representatives were taken over by third parties resulting in the
exposure of at least 2,177 customers' PII stored in the compromised
email accounts and potential exposure of another 3,800 customers'
PII); Commission Order, In the Matter of Cetera Advisor Networks
LLC, et al., Release No. 34-92800 (Aug. 30, 2021), available at
https://www.sec.gov/litigation/admin/2021/34-92800.pdf (settled
order) (finding that email accounts of over 60 Cetera personnel were
taken over by unauthorized third parties resulting in the exposure
of over 4,388 of Cetera customers' PII stored in the compromised
email accounts); Commission Order, In the Matter of KMS Financial
Services, Inc., Release No. 34-92807 (Aug. 30, 2021) (``KMS
Order''), available at https://www.sec.gov/litigation/admin/2021/34-92807.pdf (settled order) (finding that fifteen KMS financial
adviser email accounts were accessed by unauthorized third parties
resulting in the exposure of customer records and information,
including PII, of approximately 4,900 KMS customers).
    \60\ Modes of compromise could include, for example, phishing or
credential stuffing. ``Phishing'' is a means of gaining unauthorized
access to a computer system or service by using a fraudulent or
``spoofed'' email to trick a victim into taking action, such as
downloading malicious software or entering his or her log-in
credentials on a fake website purporting to be the legitimate log-in
website for the system or service, while ``credential stuffing'' is
a means of gaining unauthorized access to accounts by automatically
entering large numbers of pairs of log-in credentials that were
obtained elsewhere. See Cambridge Order, supra note 59, at 3, n.5
and n.6.
    For example, individuals affected by a security incident might
receive phishing emails requesting them to wire funds to a bank
account or enter PII to access a document, among other things. See,
e.g., KMS Order, supra note 59, at 4.
    \61\ The ``dark web'' is a part of the internet that requires
specialized software to access and is specifically designed to
facilitate anonymity by obscuring users' identities, including by
hiding users' internet protocol addresses. The anonymity provided by
the dark web has allowed users to sell and purchase illegal products
and services. See, e.g., SEC v. Apostolos Trovias, Case 1:21-cv-
05925 (S.D.N.Y. filed July 9, 2021) Dkt. No. 1 (complaint) at 1-2,
available at https://www.sec.gov/litigation/complaints/2021/comp-pr2021-122.pdf. The SEC obtained a final judgment against the
defendant on July 19, 2022. See Litigation Release No. 25447 (July
21, 2022), available at https://www.sec.gov/litigation/litreleases/2022/judg25447.pdf.
    \62\ See, e.g., FINRA Regulatory Notice 20-32, FINRA Reminds
Firms to Be Aware of Fraudulent Options Trading in Connection With
Potential Account Takeovers and New Account Fraud (Sept. 17, 2020),
available at https://www.finra.org/rules-guidance/notices/20-32
(stating that FINRA recently observed an increase in fraudulent
options trading being facilitated by account takeover schemes and
the use of new account fraud); see also FINRA Regulatory Notice 20-
13, FINRA Reminds Firms to Beware of Fraud During the Coronavirus
(COVID-19) Pandemic (May 5, 2020), available at https://www.finra.org/rules-guidance/notices/20-13 (stating that some firms
have reported an increase in newly opened fraudulent accounts, and
urging firms to be cognizant of the heightened threat of frauds and
scams to which firms and their customers may be exposed during the
COVID-19 pandemic).
    \63\ In 2017, the SEC charged an individual with engaging in an
illegal brokerage account takeover and unauthorized trading scheme
with at least one other person. The SEC's complaint alleged that, in
furtherance of the scheme, the other person(s) accessed at least 110
brokerage accounts of unwitting accountholders, secretly and without
authorization, and used those accounts to place securities trades
that artificially affected the stock prices of various publicly
traded companies. At or about the same time, the charged individual
used his brokerage accounts to trade the same securities, generating
profits by taking advantage of the artificial stock prices that
resulted from the unauthorized trades placed in the victims'
accounts. The complaint alleged that the individual generated at
least $700,000 in illicit profits through his participation in the
scheme by buying or selling stock in his brokerage accounts in his
name at artificially low or high prices generated by the
unauthorized trading of stock in the victims' accounts. See SEC v.
Joseph P. Willner, Case 1:17-cv-06305 (E.D.N.Y. filed Oct. 30, 2017)
(complaint), available at https://www.sec.gov/litigation/complaints/2017/comp-pr2017-202.pdf. In Oct. 2020, the U.S. District Court for
the Eastern District of New York entered a final consent judgment
against this individual for his role in the scheme. See Litigation
Release No. 24947 (Oct. 19, 2020), available at https://www.sec.gov/litigation/litreleases/2020/lr24947.htm.
---------------------------------------------------------------------------

    To help protect against harms that may result from a security
incident involving customer information, the Commission is proposing to
amend the safeguards rule to require that covered institutions'
safeguards policies and procedures include a response program for
unauthorized access to or use of customer information, which would
include customer notification procedures.\64\ The proposed amendments
would require the response program to be reasonably designed to detect,
respond to, and recover from both unauthorized access to and
unauthorized use of customer information (for the purposes of this
release, an ``incident'').\65\ As noted above, any instance of
unauthorized access to or use of customer information would trigger a
covered institution's incident response protocol. The amendments would
also require that the response program include procedures for notifying
affected individuals whose sensitive customer information was, or is
reasonably likely to have been, accessed or used without
authorization.\66\
---------------------------------------------------------------------------

    \64\ See proposed rule 248.30(b)(3). For clarity, when the
proposed amendments to the safeguards rule refer to ``unauthorized
access to or use'', the word ``unauthorized'' modifies both
``access'' and ``use.''
    \65\ See proposed rule 248.30(b)(3). See also infra section
II.C.1 for a discussion of ``customer information.''
    \66\ See proposed rule 248.30(e)(9) for the definition of
``sensitive customer information.'' See also infra section II.A.4,
which includes a discussion of ``sensitive customer information.''
Notice would have to be provided unless a covered institution
determines, after a reasonable investigation of the facts and
circumstances of the incident of unauthorized access to or use of
sensitive customer information, that sensitive customer information
has not been, and is not reasonably likely to be, used in a manner
that would result in substantial harm or inconvenience.
---------------------------------------------------------------------------

    In this regard, requiring covered institutions to have this type of
incident response program could help mitigate the risk of harm to
affected individuals stemming from such incidents. For example, having
a response program should help covered institutions to be better
prepared to respond to incidents, and providing notice to affected
individuals should aid those individuals in taking protective measures
that could mitigate harm that might otherwise result from unauthorized
access to or use of their information. Further, a reasonably designed
response program will help facilitate more consistent and systematic
responses to customer information security incidents, and help avoid
inadequate responses based on a covered institution's initial
impressions of the scope of the information involved in the compromise.
In addition, requiring the response program to address any incident
involving customer information can help a covered institution better
contain and control these incidents and facilitate a prompt recovery.
    The amendments would require that a covered institution's response
program include policies and procedures containing certain general
elements, but would not prescribe specific steps a covered institution
must take when carrying out incident response activities. Instead,
covered institutions may tailor their policies and procedures to their
individual facts and circumstances. We recognize that given the number
and varying characteristics (e.g., size, business, and complexity) of
covered institutions, each such institution needs to be able to tailor
its incident response program procedures based on its individual facts
and circumstances. The proposed amendments therefore are intended to
give covered institutions the flexibility to address the general
elements in the response program based on the size and complexity of
the institution and the nature and scope of its activities.
    Specifically, a covered institution's incident response program
would be required to have written policies and procedures to:
    (i) assess the nature and scope of any incident involving
unauthorized access to or use of customer information and identify the
customer information systems and types of customer information that may
have been accessed or used without authorization; \67\
---------------------------------------------------------------------------

    \67\ See proposed rule 248.30(b)(3)(i). The term ``customer
information systems'' would mean the information resources owned or
used by a covered institution, including physical or virtual
infrastructure controlled by such information resources, or
components thereof, organized for the collection, processing,
maintenance, use, sharing, dissemination, or disposition of customer
information to maintain or support the covered institution's
operations. See proposed rule 248.30(e)(6).
---------------------------------------------------------------------------

    (ii) take appropriate steps to contain and control the incident to
prevent

further unauthorized access to or use of customer information; \68\ and
---------------------------------------------------------------------------

    \68\ See proposed rule 248.30(b)(3)(ii).
---------------------------------------------------------------------------

    (iii) notify each affected individual whose sensitive customer
information was, or is reasonably likely to have been, accessed or used
without authorization in accordance with the notification obligations
discussed below, unless the covered institution determines, after a
reasonable investigation of the facts and circumstances of the incident
of unauthorized access to or use of sensitive customer information,
that the sensitive customer information has not been, and is not
reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience.\69\
---------------------------------------------------------------------------

    \69\ See proposed rule 248.30(b)(3)(iii).
---------------------------------------------------------------------------

    The proposed response program is designed to further the objectives
of the safeguards rule, particularly protecting against unauthorized
access to or use of customer information. We have also proposed rules
that would more broadly address general cybersecurity risks, with which
the response program proposed in Regulation S-P is not inconsistent, as
discussed in more detail below.\70\ Our recent proposals would require
investment advisers, investment companies, and certain market entities
\71\ to adopt and implement written policies and procedures that
require measures to detect, respond to, and recover from a
cybersecurity incident.\72\ The Investment Management Cybersecurity
Proposal, including the cybersecurity response measures, is more
broadly focused on investment advisers and investment companies and
their operations. Among other objectives, the proposed measures would
include policies and procedures reasonably designed to ensure the
protection of adviser (or fund) information systems and adviser (or
fund) information residing therein.\73\ Similarly, the Exchange Act
Cybersecurity Proposal, which includes cybersecurity response measures,
is more broadly focused on Market Entities and their operations, and
would include policies and procedures reasonably designed to ensure the
protection of the Market Entities' information systems and the
information residing on those systems.
---------------------------------------------------------------------------

    \70\ See infra section II.G.1-II.G.2, which addresses areas that
are related between the Regulation SCI Proposal and the Exchange Act
Cybersecurity Proposal, as well as with the Investment Management
Cybersecurity Proposal, respectively.
    \71\ The Exchange Act Cybersecurity Proposal rules would be
applicable to ``Market Entities'' including: broker-dealers;
clearing agencies; major security-based swap participants; the
Municipal Securities Rulemaking Board; national securities
exchanges; national securities associations (i.e., FINRA); security-
based swap data repositories; security-based swap dealers; and
transfer agents (collectively, ``Covered Entities'') as well as
broker-dealers that are non-Covered Entities. See Exchange Act
Cybersecurity Proposal, supra note 57.
    \72\ See Investment Management Cybersecurity Proposal, supra
note 55; Exchange Act Cybersecurity Proposal, supra note 57.
    \73\ See Investment Management Cybersecurity Proposal, supra
note 55, at 13589 for definitions of ``fund information system'' and
``fund information.''
---------------------------------------------------------------------------

    The response program proposed in Regulation S-P, however, is
narrowly focused and the required incident response policies and
procedures should be specifically tailored to address unauthorized
access to or use of customer information, including procedures for
assessing the nature and scope of such incidents and identifying the
customer information and customer information systems that may have
been accessed or used without authorization, as well as taking steps to
contain and control the incident to prevent further unauthorized access
to or use of customer information. Given the risk of harm posed to
customers and other affected individuals by incidents involving
customer information, it is important that covered institutions'
policies and procedures be reasonably designed to implement an incident
response under these circumstances.
    We request comment on the proposed rule's requirement that covered
institutions' policies and procedures include an incident response
program that is reasonably designed to detect, respond to, and recover
from unauthorized access to or use of customer information, including
the following:
    1. What best practices have commenters developed or become aware of
with respect to the types of measures that can be implemented as part
of an incident response program? Are there any measures commenters have
found to be ineffective or relatively less effective? To the contrary,
are there any measures that commenters have found to be effective, or
relatively more effective?
    2. Should we require the response program procedures to set forth a
specific timeframe for implementing incident response activities under
Regulation S-P? For example, should the procedures state that incident
response activities, such as assessment and containment, should
commence promptly, or immediately, once an incident has been
discovered?
    3. Are the proposed elements for the incident response program
appropriate? Should we modify the proposed elements? For instance,
should the rule prescribe more specific steps for incident response
within the framework of the procedures, such as detailing the steps
that an institution should take to assess the nature and scope of an
incident, or to contain and control an incident? If so, please describe
the steps and explain why they should be included. Alternatively,
should the requirements for the incident response program be less
prescriptive and more principles-based? If so, please describe how and
why the requirements should be modified.
    4. Are there additional or different elements that should be
included in an incident response program? For example, should the rule
require procedures for taking corrective measures in response to an
incident, such as securing accounts associated with the customer
information at issue? Should the rule require procedures for monitoring
customer information and customer information systems for unauthorized
access to or use of those systems, and data loss as it relates to those
systems? Should the rule require procedures for identifying the titles
and roles of individuals or departments (e.g., managers, directors, and
officers) who should be responsible for overseeing, implementing, and
executing the incident response program, as well as procedures to
determine compliance? If additional or different elements should be
added, please describe the element, and explain why it should be
included in the response program.
    5. Is the scope of the incident response program appropriate? For
example, is the scope of the incident response program reasonably
aligned with the vulnerability of the customer information at issue?
     Should the incident response program be more limited in
scope, so that it would only address incidents that involve
unauthorized access to or use of a subset of customer information
(e.g., sensitive customer information)? If so, please explain the
subset of customer information that should require an incident response
program.
     Alternatively, should the incident response program be
more expansive in scope, so that it would cover additional activity
beyond unauthorized access to or use of customer information? For
example, should the incident response program address cybersecurity
incident response and recovery at large (i.e., should the rule require
covered institutions to have a response program reasonably designed to
detect, respond to, and recover from a cybersecurity incident)?
1. Assessment
    The Commission is proposing to require that the incident response
program include procedures for: (1)

assessing the nature and scope of any incident involving unauthorized
access to or use of customer information, and (2) identifying the
customer information systems and types of customer information that may
have been accessed or used without authorization.\74\ For example, a
covered institution's assessment may include gathering information
about the type of access, the extent to which systems or other assets
have been affected, the level of privilege attained by any unauthorized
persons, the operational or informational impact of the breach, and
whether any data has been lost or exfiltrated.\75\ Examining a range of
data sources could shed light on the incident timeline, and assessing
affected systems and networks could help to identify additional
anomalous activity that might be adversarial behavior.\76\
---------------------------------------------------------------------------

    \74\ See proposed rule 248.30(b)(3)(i). The proposed
requirements related to assessing the nature and scope of a security
incident are consistent with the components of a response program as
set forth in the Banking Agencies' Incident Response Guidance. See
Banking Agencies' Incident Response Guidance, supra note 47, at
15752.
    \75\ See Cybersecurity and Infrastructure Security Agency
(``CISA''), Cybersecurity Incident & Vulnerability Response
Playbooks (Nov. 2021), at 10-13 (``CISA Incident Response
Playbook''), available at https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf. While the CISA Incident Response Playbook
specifically provides Federal agencies with a standard set of
procedures to respond to incidents impacting ``Federal Civilian
Executive Branch'' networks, it may also be useful for the purpose
of strengthening cybersecurity response practices and operational
procedures for public and private sector entities in addition to the
Federal government. See CISA, Press Release, CISA Releases Incident
and Vulnerability Response Playbooks to Strengthen Cybersecurity for
Federal Civilian Agencies (Nov. 16, 2021), available at https://www.cisa.gov/news/2021/11/16/cisa-releases-incident-and-vulnerability-response-playbooks-strengthen. A list of the Federal
Civilian Executive Branch agencies identified by CISA is available
at https://www.cisa.gov/agencies. The National Institute for
Standards and Technology (``NIST'') defines ``exfiltration'' as
``the unauthorized transfer of information from a system.'' See NIST
Special Publication 800-53, Revision 5, Security and Privacy
Controls for Information Systems and Organizations, Appendix A at
402 (Sept. 2020) available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.
    \76\ See CISA Incident Response Playbook, supra note 75, at 10-
13. NIST defines ``adversary'' as ``[a]n entity that is not
authorized to access or modify information, or who works to defeat
any protections afforded the information.'' See NIST Special
Publication 800-107, Recommendation for Applications Using Approved
Hash Algorithms, Section 3.1 Terms and Definitions, at 3 (Aug.
2012), available at https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-107r1.pdf.
---------------------------------------------------------------------------

    The assessment requirement is designed to require a covered
institution to identify both the customer information systems and types
of customer information that may have been accessed or used without
authorization during the incident, as well as the specific customers
affected, which would be necessary to fulfill the obligation to notify
affected individuals. Covered institutions generally should evaluate
and adjust their assessment procedures periodically, regardless of any
specific regulatory requirement, to ensure they remain reasonably
designed to accomplish their goals. In addition, assessment should help
facilitate the evaluation of whether sensitive customer information has
been accessed or used without authorization, which informs whether
notice would have to be provided, as discussed below. A covered
institution's assessment may also be useful for collecting other
information that is required to populate the notice, such as
identifying the date or estimated date of the incident, among other
details. Information developed during the assessment process may also
help covered institutions develop a contextual understanding of the
circumstances surrounding an incident, as well as enhance their
technical understanding of the incident, which should be helpful in
guiding incident response activities such as containment and control
measures. The assessment process may also be helpful for identifying
and evaluating existing vulnerabilities that could benefit from
remediation in order to prevent such vulnerabilities from being
exploited in the future.
    We request comment on the proposed rule's requirements related to
assessing the nature and scope of any incident involving unauthorized
access to or use of customer information, including the following:
    6. Should we provide additional examples for consideration in
assessing the nature and scope of an incident, beyond the examples
provided above (e.g., type of access, the extent to which systems or
other assets have been affected, the level of privilege attained by any
unauthorized persons, the operational or informational impact of the
breach, and whether any data has been lost or exfiltrated)?
    7. Should we require that the assessment include the specific
components referenced in the above question?
    8. Should we require any specific training for personnel performing
assessments of security incidents? Should the training have to
encompass security updates and training sufficient to address relevant
security risks?
    9. Various rules applicable to certain entities require, among
other things, the review, testing, verification, and/or amendment of
policies and procedures at regular intervals.\77\ Should we
specifically require covered institutions to evaluate and adjust, as
appropriate, the assessment procedures periodically in this rule? If
so, how frequently should the evaluation occur? Should we require any
testing (such as a practice exercise) of a covered institution's
assessment process?
---------------------------------------------------------------------------

    \77\ See e.g., Rule 38a-1(a)(3) under the Investment Company
Act; FINRA Rule 3120 (Supervisory Control System) and FINRA Rule
3130 (Annual Certification of Compliance and Supervisory Processes).
---------------------------------------------------------------------------

    10. Would covered institutions expect to use third parties to
conduct these assessments? If so, to what extent and in what manner?
Should there be any additional or specific requirements for third
parties that conduct assessments? Why or why not?
2. Containment and Control
    The Commission is proposing to require that the response program
have procedures for taking appropriate steps to contain and control a
security incident, to prevent further unauthorized access to or use of
customer information.\78\ The objective of containment and control is
to prevent additional damage from unauthorized activity and to reduce
the immediate impact of an incident by removing the source of the
unauthorized activity.\79\ Covered institutions generally should
evaluate and revise their containment and control procedures
periodically, regardless of any specific regulatory requirement, to
ensure they remain reasonably designed to accomplish their goals.
Strategies for containing and controlling an incident vary depending
upon the type of incident and may include, for example, isolating
compromised systems or enhancing the monitoring of intruder activities,
searching for additional compromised systems, changing system
administrator passwords, rotating private keys, and changing or
disabling default user accounts and passwords, among other
interventions. Some standards advise that after ensuring that all means
of persistent access into the network have been accounted for, and any
intrusive

activity has been sufficiently contained, the artifacts of the incident
should also be eliminated (e.g., by removing malicious code or re-
imaging infected systems) and vulnerabilities or other conditions that
were exploited to gain unauthorized access should be mitigated.\80\
---------------------------------------------------------------------------

    \78\ See proposed rule 248.30(b)(3)(ii). These proposed
requirements are consistent with the components of a response
program as set forth in the Banking Agencies' Incident Response
Guidance. See Banking Agencies' Incident Response Guidance, supra
note 47, at 15752.
    \79\ For a further discussion of the purposes and practices of
such containment measures, see generally CISA Incident Response
Playbook, supra note 76, at 14; see also Federal Financial
Institutions Examination Council (``FFIEC''), Information Technology
Examination Handbook--Information Security (Sept. 2016), at 52,
available at https://ithandbook.ffiec.gov/media/274793/ffiec_itbooklet_informationsecurity.pdf.
    \80\ See, e.g., CISA Incident Response Playbook, supra note 75,
at 15.
---------------------------------------------------------------------------

    Additional eradication activities may include, for example,
remediating all infected IT environments (e.g., cloud, operational
technology, hybrid, host, and network systems), resetting passwords on
compromised accounts, and monitoring for any signs of adversary
response to containment activities. Because incident response may
involve making complex judgment calls, such as deciding when to shut
down or disconnect a system, developing and implementing written
containment and control policies and procedures will provide a
framework to help facilitate improved decision making at covered
institutions during potentially high-pressure incident response
situations.
    We request comment on the proposed rule's requirement that the
incident response program have procedures for taking appropriate steps
to contain and control a security incident, including the following:
    11. Should there be additional or more specific requirements for
containing and controlling a breach of a customer information system?
Should the rule prescribe specific minimum steps that need to be taken
to remediate any identified weaknesses in customer information systems
and associated controls? For example, should we require that a covered
institution's containment or control activities be consistent with any
current governmental or industry standards or guidance, such as
standards disseminated by NIST, guidance disseminated by CISA, or
others? \81\
---------------------------------------------------------------------------

    \81\ Examples of such standards and guidance include the NIST
Computer Security Incident Handling Guide (NIST Special Publication
800-61, Revision 2, available at https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) and the CISA Incident Response
Playbook, supra note 75, among others.
---------------------------------------------------------------------------

    12. Are the examples of steps that may be taken to contain and
control an incident (e.g., isolating compromised systems or enhancing
the monitoring of intruder activities, searching for additional
compromised systems, changing system administrator passwords, rotating
private keys, and changing or disabling default user accounts and
passwords) appropriate? Are there any additional examples of steps that
could be taken to contain and control an incident that should be
provided?
    13. Are the examples of remediation and eradication activities
provided (e.g., remediating all infected IT environments (such as
cloud, operational technology, hybrid, host, and network systems,
resetting passwords on compromised accounts, and monitoring for any
signs of adversary response to containment activities) appropriate? Are
there any additional examples of remediation or eradication activities
that should be provided?
    14. Should the rule require that a covered institution evaluate and
revise its incident response plan following a customer information
incident?
    15. Various rules applicable to certain entities require, among
other things, the review, testing, verification, and/or amendment of
policies and procedures at regular intervals.\82\ Should we
specifically require covered institutions to evaluate and revise
containment and control procedures related to preventing unauthorized
access to or use of customer information periodically? If so, how
frequently should the evaluation occur? For example, should a covered
institution be required to evaluate and revise these containment and
control procedures at least annually?
---------------------------------------------------------------------------

    \82\ See e.g., Rule 38a-1(a)(3) under the Investment Company
Act; FINRA Rule 3120 (Supervisory Control System) and FINRA Rule
3130 (Annual Certification of Compliance and Supervisory Processes).
---------------------------------------------------------------------------

    16. Who should be responsible for making decisions related to
containment and control? Should the rule require covered institutions
to designate specific personnel to be responsible for making decisions
related to containment and control? For example, should a covered
institution have to identify specific personnel with sufficient
cybersecurity qualifications and experience to either determine if an
incident has been contained or controlled themselves, or hire a third
party who has the requisite cybersecurity and recovery expertise to
perform containment and control functions? If so, what type of
qualifications or experience are useful for informing decisions related
to containment and control? Or should it be the same individuals who
are designated to perform incident response and recovery related
functions for cybersecurity incidents under the Investment Management
Cybersecurity Proposal and the Exchange Act Cybersecurity Proposal?
3. Service Providers
    We understand that a covered institution may contract with third-
party service providers to perform certain business activities and
functions, for example, trading and order management, information
technology functions, and cloud computing services, among others, in a
practice commonly referred to as outsourcing.\83\ As a result of this
outsourcing, service providers may receive, maintain, or process
customer information, or be permitted to access a covered institution's
customer information systems. These outsourcing relationships or
activities may expose covered institutions and their customers to risk
through the covered institutions' service providers, including risks
related to system resiliency and the ability of a service provider to
protect customer information and systems (including service provider
incident response programs). Moreover, a security incident at a service
provider could lead to the unauthorized access to or use of customer
information or customer information systems, which could potentially
result in harm to customers. For example, a bad actor could use a
service provider's access to a covered institution's systems to
infiltrate the covered institution's network through a cybersecurity
compromise in the supply chain,\84\ which is a vector that can be used
to conduct a data breach, and thereby gain unauthorized access to the
covered institution's customer information and customer information
systems through

an initial compromise at the service provider.\85\
---------------------------------------------------------------------------

    \83\ See, e.g., Outsourcing by Investment Advisers, Investment
Advisers Act Release No. 6176 (Oct. 26, 2022) [87 FR 68816 (Nov. 16,
2022)] (``Adviser Outsourcing Proposal''); FINRA Notice to Members
05-48, Members' Responsibilities When Outsourcing Activities to
Third-Party Service Providers (July 28, 2005), available at https://www.finra.org/rules-guidance/notices/05-48.
    \84\ NIST defines a ``cybersecurity compromise in the supply
chain'' as ``an occurrence within the supply chain whereby the
confidentiality, integrity, or availability of a system or the
information the system processes, stores, or transmits is
jeopardized. A supply chain incident can occur anywhere during the
life cycle of the system, product or service.'' See NIST, Special
Publication NIST SP 800-161r1, Cybersecurity Supply Chain Risk
Management Practices for Systems and Organizations, Glossary at 299,
available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1.pdf. According to NIST, key cybersecurity supply
chain risks include risks from third-party service providers with
physical or virtual access to information systems, software code, or
intellectual property. See NIST, Best Practices in Cyber Supply
Chain Risk Management, Conference Materials (``NIST Best Practices
in Cyber Supply Chain Risk Management''), available at https://csrc.nist.gov/CSRC/media/Projects/Supply-Chain-Risk-Management/documents/briefings/Workshop-Brief-on-Cyber-Supply-Chain-Best-Practices.pdf.
    \85\ For example, in a 2013 cyber supply chain attack, a bad
actor breached the Target Corporation's network and was able to
steal personal information for up to 70 million customers. The bad
actor was able to gain a foothold in Target's network through a
third-party vendor. See U.S. Senate, Committee on Commerce, Science,
and Transportation, A ``Kill Chain'' Analysis of the 2013 Target
Data Breach, Majority Staff Report (Mar. 26, 2014), available at
https://www.commerce.senate.gov/services/files/24d3c229-4f2f-405d-b8db-a3a67f183883.
---------------------------------------------------------------------------

    Under the proposed amendments, we propose to define the term
``service provider'' to mean any person or entity that is a third party
and receives, maintains, processes, or otherwise is permitted access to
customer information through its provision of services directly to a
covered institution.\86\ This definition would include affiliates of
covered institutions if they are permitted access to this information
through their provision of services. The proposed scope is intended to
help protect against the risk of harm that may arise from third-party
access to a covered institution's customer information and customer
information systems. For example, in 2015, Division of Examinations
staff released observations following the examinations of some
institutions' cybersecurity policies and procedures relating to vendors
and other business partners, which revealed mixed results with respect
to whether the firms incorporated requirements related to cybersecurity
risk into their contracts with vendors and business partners.\87\
---------------------------------------------------------------------------

    \86\ See proposed rule 248.30(e)(10).
    \87\ See EXAMS, Cybersecurity Examination Sweep Summary,
National Exam Program Risk Alert, Volume IV, Issue 4 (Feb. 3, 2015),
at 4, available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf.
---------------------------------------------------------------------------

    Given the potential for bad actors to target third parties with
access to a covered institution's systems, it is important to help
mitigate the risk of harm posed by security compromises that may occur
at service providers. For example, a covered institution could retain a
cloud service provider to maintain its books and records.\88\ A
security incident at this cloud service provider that resulted in
unauthorized access to or use of these books and records could create a
risk of substantial harm to the covered institution's customers and
trigger a need for notification to allow the affected customers to
address this risk. Because service providers would be obligated to
notify a covered institution in the event of security breaches
involving customer information systems, as discussed below, this could
potentially help covered institutions implement their own incident
response protocol more quickly and efficiently after such breaches,
which would include notifying affected individuals as needed.
---------------------------------------------------------------------------

    \88\ According to NIST, key cybersecurity supply chain risks
include risks from third-party data storage or data aggregators. See
NIST Best Practices in Cyber Supply Chain Risk Management, supra
note 84.
---------------------------------------------------------------------------

    The proposed amendments would require that a covered institution's
incident response program include written policies and procedures that
address the risk of harm posed by security compromises at service
providers.\89\ Specifically, these policies and procedures would
require covered institutions, pursuant to a written contract between
the covered institution and its service providers, to require service
providers to take appropriate measures that are designed to protect
against unauthorized access to or use of customer information.\90\
Appropriate measures would include the obligation for a service
provider to notify a covered institution as soon as possible, but no
later than 48 hours after becoming aware of a breach, in the event of
any breach in security that results in unauthorized access to a
customer information system maintained by the service provider, in
order to enable the covered institution to implement its incident
response program expeditiously.\91\ In addition, we are not limiting
entities that can provide customer notification for or on behalf of
covered institutions. A covered institution may, as part of its
incident response program, enter into a written agreement with its
service provider to have the service provider notify affected
individuals on its behalf in accordance with the notification
obligations discussed below.\92\ In that circumstance, the covered
institution could delegate performance of its notice obligation to a
service provider through written agreement, but the covered institution
would remain responsible for any failure to provide a notice as
required by the proposed rules, if adopted.\93\
---------------------------------------------------------------------------

    \89\ See proposed rule 248.30(b)(5)(i).
    \90\ Id.
    \91\ Id.
    \92\ See proposed rule 248.30(b)(5)(ii).
    \93\ Covered institutions may delegate other functions to
service providers, such as reasonable investigation to determine
whether sensitive customer information has not been and is not
reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience. Covered institutions would remain
responsible for these functions even if they are delegated to
service providers.
---------------------------------------------------------------------------

    We request comment on the proposed requirements related to service
providers, including the following:
    17. Should we modify the proposed definition of ``service
provider''? For example, should we exclude a covered institution's
affiliates from the definition? Alternatively, should we define
``service provider'' in this rule in a manner similar to proposed rule
206(4)-11 under the Investment Advisers Act? Are there any other
alternative definitions of ``service provider'' that should be used?
\94\
---------------------------------------------------------------------------

    \94\ See Adviser Outsourcing Proposal supra note 83. In proposed
rule 206(4)-11, ``service provider'' would mean a person or entity
that performs one or more covered functions, and is not a supervised
person as defined in 15 U.S.C. 80b-2(a)(25) of the Investment
Advisers Act, of the investment adviser. In the proposal, a
``covered function'' would mean a function or service that is
necessary for the investment adviser to provide its investment
advisory services in compliance with the Federal securities laws,
and that, if not performed or performed negligently, would be
reasonably likely to cause a material negative impact on the
adviser's clients or on the adviser's ability to provide investment
advisory services. In the proposal, a covered function would not
include clerical, ministerial, utility, or general office functions
or services.
---------------------------------------------------------------------------

    18. Should there be additional or more specific requirements for
entities that are included in the definition of ``service providers?''
    19. The proposed definition of service providers applies to
entities that receive, maintain or process customer information, or are
permitted access to a covered institution's customer information. Is
this scope of activities appropriate? Should we exclude any of these
activities? Should we include any other activities?
    20. To what extent do covered institutions already have written
policies and procedures that include contractually requiring service
providers to take appropriate measures designed to protect against
unauthorized access to or use of customer information? For example, to
what extent have contractual requirements been incorporated pursuant to
an exception from Regulation S-P's opt-out requirements for service
providers and joint marketing provided by 17 CFR 248.13, which is
conditioned on having a contractual agreement prohibiting the service
provider from disclosing or using customer information other than to
carry out the purposes for which it is disclosed, or pursuant to
Regulation S-ID's requirements \95\ at 17 CFR

248.201(d)(2)(iii) to respond appropriately to any detected identity
theft red flags to prevent and mitigate identity theft, and under 17
CFR 248.201(e)(4) to exercise appropriate and effective oversight of
service provider arrangements?
---------------------------------------------------------------------------

    \95\ See 17 CFR 248.201(d)(2)(iii) and (e)(4). As discussed
further below, Regulation S-ID, among other things, requires
financial institutions subject to the Commission's jurisdiction with
covered accounts to develop and implement a written identity theft
prevention program that is designed to detect, prevent, and mitigate
identity theft in connection with covered accounts, which must
include, among other things, policies and procedures to respond
appropriately to any red flags that are detected pursuant to the
program. See also infra note 547.
---------------------------------------------------------------------------

    21. The proposed rule would require policies and procedures
requiring a covered institution, by contract, to require that its
service providers take appropriate measures designed to protect against
unauthorized access to or use of customer information, including
notification to a covered institution in the event of certain types of
breaches in security. Are there any contexts in which a written
contract may be more feasible than others? Rather than using a
contractual approach to implement this requirement that a covered
institution take the required appropriate measures, should the rule
require policies and procedures that require due diligence of or some
type of reasonable assurances from its service providers? What should
reasonable assurances include? For example, should they cover
notification to the covered institution as soon as possible in the
event of any breach in security resulting in unauthorized access to a
customer information system maintained by the service provider to
enable the covered institution to implement its response program? Are
there other reasonable assurances we should require? Alternatively,
should we only require disclosure of whether a covered institution has
or does not have a written contract with service providers?
    22. Should there be a written contract requirement for certain
service providers and not others? For example, should the rule identify
a sub-set of service providers as critical service providers and
require a written agreement in those circumstances only, and if so,
what service providers should be included?
    23. Are there other methods that we should permit or require
covered institutions to use to help ensure that service providers take
appropriate measures that are designed to protect against unauthorized
access to or use of customer information (for example, a security
certification or representation)? Should we have different requirements
for smaller covered institutions?
    24. The proposed rule would require policies and procedures
requiring a covered institution, by contract, to require its service
providers to provide notification to a covered institution as soon as
possible, but no later than 48 hours after becoming aware of a breach,
in the event of any breach in security resulting in unauthorized access
to a customer information system maintained by the service provider. Is
``as soon as possible, but no later than 48 hours after becoming aware
of a breach'' an appropriate timeframe for service providers to provide
notification to a covered institution after such a breach occurs? Why
or why not? Should we use a different timeframe such as ``as soon as
practicable''?
    25. Is it appropriate to permit covered institutions to delegate
providing notice to service providers? If service providers are
permitted to provide notice on behalf of covered institutions, should
there be additional or specific requirements for a service provider
that provides notification on behalf of a covered institution? If so,
please describe those requirements and why they should be included.
    26. The proposed rule would set forth that as part of its incident
response program, a covered institution may enter into a written
agreement with its service provider for the service provider to notify
affected individuals on its behalf (i.e., to delegate the notice
functions required under the rule to service providers while remaining
responsible for the notice obligation). Should we set forth that a
covered institution may enter into a written agreement with its service
provider for other potentially delegated functions as discussed in this
proposal? For example, should we set forth that a covered institution
may enter into a written agreement for delegating the performance of a
reasonable investigation (e.g., to determine whether sensitive customer
information has not been, and is not reasonably likely to be, used in a
manner that would result in substantial harm or inconvenience) to a
service provider? Should we set forth that a covered institution may
enter into a written agreement for delegating the performance of
assessment activities, or containment and control activities, to a
service provider? Additionally, is it appropriate for a service
provider to assist with these functions, with the responsibility
remaining with the covered institution? Why or why not?
    27. To what extent do service providers sub-delegate functions
provided in this proposal to third parties? If so, how should the rule
address sub-delegations between service providers and third parties?
4. Notice to Affected Individuals
    Under the proposed amendments, a covered institution must notify
each affected individual whose sensitive customer information was, or
was reasonably likely to have been, accessed or used without
authorization, unless the covered institution has determined, after a
reasonable investigation of the incident, that sensitive customer
information has not been, and is not reasonably likely to be, used in a
manner that would result in substantial harm or inconvenience. The
covered institution must provide a clear and conspicuous notice to each
affected individual by a means designed to ensure that the individual
can reasonably be expected to receive actual notice in writing. The
notice must be provided as soon as practicable, but not later than 30
days, after the covered institution becomes aware that unauthorized
access to or use of customer information has occurred or is reasonably
likely to have occurred.
a. Standard for Providing Notice
    The proposed amendments would create an affirmative requirement for
a covered institution to provide notice to individuals whose sensitive
customer information was, or is reasonably likely to have been,
accessed or used without authorization.\96\ These notices would be
designed to give affected individuals an opportunity to respond to and
remediate issues arising from an information security incident, such as
monitoring credit reports for unauthorized activity, placing fraud
alerts on relevant accounts, or changing passwords used to access
accounts.\97\ Such measures, when taken in a timely fashion, may help
affected individuals avoid or mitigate the risk of substantial harm or
inconvenience (``harm risk''),\98\ and in an environment of expanded
risk of cyber incidents,\99\ taking such actions may be particularly
important to protect individuals. Conversely, giving covered
institutions greater discretion to determine whether and when to
provide notices could jeopardize affected

individuals' ability to evaluate the risk of harm posed by an incident
and choose how to respond to and remediate it.
---------------------------------------------------------------------------

    \96\ See proposed rule 248.30(b)(3)(iii). As noted above, a
covered institution could delegate its responsibility for providing
notice to an affected individual to a service provider, by contract,
but the covered institution would remain responsible for any failure
to provide a notice as required by the proposed rules. See infra
section II.A.
    \97\ Affected individuals include individuals with whom the
covered institution has a customer relationship, or are individuals
that are customers of other financial institutions whose information
has been provided to the covered institution, and whose sensitive
information was, or is reasonably likely to have been, accessed or
used without authorization. See infra note 127.
    \98\ See infra section II.A.4.e (Timing Requirements); see also
supra note 7 and accompanying text (addressing environment of
expanded risks).
    \99\ See supra note 7 and accompanying text.
---------------------------------------------------------------------------

    A covered institution would not have to provide notice if, after a
reasonable investigation of the facts and circumstances of the incident
of unauthorized access to or use of sensitive customer information, it
determines that sensitive customer information has not been, and is not
reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience.\100\ To be clear, although the
incident response program would be required to address information
security incidents involving any form of customer information, the
notice requirement would only be triggered by unauthorized access to or
use of sensitive customer information.\101\ Unauthorized access to or
use of sensitive customer information presents an increased risk of
harm to the affected individual and accordingly is the appropriate
trigger for customer notification.\102\
---------------------------------------------------------------------------

    \100\ See proposed rule 248.30(b)(3)(iii). In 2003, the Banking
Agencies also proposed a similar standard for customer notification,
though it was not ultimately adopted. See Interagency Guidance on
Response Programs for Unauthorized Access to Customer Information
and Customer Notice, 68 FR 47954 (Aug. 12, 2003) (``Banking
Agencies' Proposing Release''). The proposed guidance stated that an
institution should notify affected customers whenever it becomes
aware of unauthorized access to sensitive customer information,
unless the institution, after an appropriate investigation,
reasonably concludes that misuse of the information is unlikely to
occur. See id. at 47960. In adopting the Banking Agencies' Incident
Response Guidance, the Banking Agencies indicated that they wanted
to give institutions greater discretion in determining whether to
send notices, to avoid alarming customers with too many notices and
not to require institutions to prove a negative. See the Banking
Agencies' Incident Response Guidance, supra note 47, at 15743. We
preliminarily believe, however, that a presumption that individuals
would be timely provided with the information in the notifications
would enable them to make their own determinations regarding the
incident.
    \101\ See infra section II.A.4.a and section II.A.4.b.
    \102\ Customer information that is not disposed of properly
could trigger the requirement to notify affected individuals under
proposed rule 248.30(b)(4)(i). For example, a covered institution
whose employee leaves un-shredded customer files containing
sensitive customer information in a dumpster accessible to the
public would be required to notify affected customers, unless the
institution has determined that sensitive customer information has
not been, and is not reasonably likely to be, used in a manner that
would result in substantial harm or inconvenience.
---------------------------------------------------------------------------

    The proposed amendment is designed to permit covered institutions
to rebut the affirmative presumption of notification based on a
reasonable investigation of the facts and circumstances of the incident
of unauthorized access to or use of sensitive customer information.
Such an investigation would have to provide a sufficient basis for the
determination that sensitive customer information has not been, and is
not reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience. In these limited circumstances, the
proposed amendments would not require the covered institution to
provide a notice.
    In contrast, if a malicious actor has gained access to a customer
information system and the covered institution simply lacked
information indicating that any particular individual's data stored in
that customer information system was or was not used in a manner that
would result in substantial harm or inconvenience, a covered
institution would not have a sufficient basis to make this
determination.\103\ In order to have a sufficient basis to determine
that notice is not required, a covered institution's investigation
would need to have revealed information sufficient for the institution
to conclude that sensitive customer information has not been, and is
not reasonably likely to be, used in a manner that would result in
substantial harm or inconvenience.
---------------------------------------------------------------------------

    \103\ See also infra section II.A.4.d (discussing the
identification of affected individuals in such circumstances).
---------------------------------------------------------------------------

    For any determination that a covered institution makes that notice
is not required, the covered institution generally should maintain a
record of the investigation and basis for its determination.\104\
Whether an investigation qualifies as reasonable would depend on the
particular facts and circumstances of the unauthorized access or use.
For example, unauthorized access that is the result of intentional
intrusion by a bad actor may warrant more extensive investigation than
inadvertent unauthorized access by an employee. The investigation may
occur in parallel with an initial assessment and scoping of the
incident and may build upon information generated from those
activities, and the scope of the investigation may be refined by using
available data and the results of ongoing incident response activities.
Information related to the nature and scope of the incident may be
relevant to determining the extent of the investigation, such as
whether the incident is the result of internal unauthorized access or
an external intrusion, the duration of the incident, what accounts have
been compromised and at what privilege level, and whether and what type
of customer information may have been copied, transferred, or retrieved
without authorization.\105\
---------------------------------------------------------------------------

    \104\ Proposed rules 248.30(d), 240.17a-4, 240.17ad-7, 270.31a-
1, 270.31a-2, and 275.204-2; see infra section II.C. The
Commission's proposal includes an amendment to a CFR designation in
order to ensure regulatory text conforms more consistently with
section 2.13 of the Document Drafting Handbook. See Office of the
Federal Register, Document Drafting Handbook (Aug. 2018 Edition,
Revision 1.4, dated January 7, 2022), available at https://www.archives.gov/files/federal-register/write/handbook/ddh.pdf. In
particular, the proposal is to amend the CFR section designation for
Rule 17Ad-7 (17 CFR 240.17Ad-7) to replace the uppercase letter with
the corresponding lowercase letter, such that the rule would be
redesignated as Rule 17ad-7 (17 CFR 240.17ad-7).
    \105\ For example, depending on the nature of the incident, it
may be necessary to consider how a malicious intruder might use the
underlying information in light of current trends in identity theft.
---------------------------------------------------------------------------

    As discussed above, while some state laws currently include similar
standards for providing notifications, the proposed rules would impose
a minimum standard to help ensure all individuals would presumptively
receive notifications.\106\ Twenty-one states only require notice if,
after an investigation, the institution finds that a risk of harm
exists, and in eleven states, customer notification laws do not apply
to entities subject to or in compliance with the GLBA.\107\ We
preliminarily believe that setting a minimum standard based on an
affirmative presumption of notification appropriately balances the need
for transparency (i.e., the need for affected individuals to be
informed so that they can take steps to protect themselves, including
for example, by placing fraud alerts in credit reports) with concerns
that the volume of notices that individuals would receive could erode
their efficacy or lead to complacency by affected individuals. Notice
of every incident could diminish the impact and effectiveness of the
notice in a situation where enhanced vigilance is necessary.\108\
Covered institutions likely would be able to send a single notice that
complies with multiple regulatory requirements, which may reduce the
number of notices an individual

receives. In addition, the proposed standard would help to improve
security outcomes in general by incentivizing covered institutions to
conduct more thorough investigations after an incident occurs, because
a reasonable investigation provides the only means to rebut the
presumption of notification. Reasonably designed policies and
procedures generally should include that a covered institution would
revisit a determination whether a notification is required based on its
investigation if new facts come to light. For example, if a covered
institution determines that risk of use in a manner that would result
in substantial harm or inconvenience is not reasonably likely based on
the use of encryption in accordance with industry standards at the time
of the incident, but subsequently the encryption is compromised or it
is discovered that the decryption key was also obtained by the threat
actor, the covered institution generally should consider revisiting its
determination.
---------------------------------------------------------------------------

    \106\ A risk of harm provision under a particular state's rules
may either (i) require a notice only after an entity performs a
required analysis to determine that there is a reasonable likelihood
of harm, or (ii) require notice unless a permitted analysis
determines that there is no reasonable likelihood of harm. This
latter approach is a stricter standard imposed by 22 states and is
consistent with the standard we are proposing. See National
Conference of State Legislatures, Security Breach Notification Laws,
(``NCSL Security Breach Notification Law Resource''), available at
https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.
    \107\ See NCSL Security Breach Notification Law Resource, supra
note 106.
    \108\ Eight states do not have risk of harm provisions,
including California and Texas. See NCSL Security Breach
Notification Law Resource, supra note 106. In these states, notices
must generally be provided in all cases of a breach.
---------------------------------------------------------------------------

    We request comment on the proposed standard for notification to
affected individuals, including the following:
    28. The proposed standard requires providing notice to affected
individuals whose sensitive customer information was, or is reasonably
likely to have been, accessed or used without authorization. Is the
proposed standard for providing notification sufficiently clear? Is a
standard of ``reasonably likely'' appropriate? Should the trigger for
notification be a determination by a covered institution that the risk
of unauthorized access or use of sensitive customer information has
occurred or is ``reasonably possible'' which would suggest a more
expansive standard than ``likely''?
    29. A covered institution can rebut the presumption of notification
if it determines that, after a reasonable investigation of the facts
and circumstances of the incident of unauthorized access to or use of
sensitive customer information, sensitive customer information has not
been, and is not reasonably likely to be, used in a manner that would
result in substantial harm or inconvenience. Is this standard ``not
reasonably likely to be'' for rebutting the presumption to notify the
appropriate standard? Should the standard be ``not reasonably
possible''?
    30. Should customer notification be required for any incident of
unauthorized access to or use of sensitive customer information
regardless of the risk of use in a manner that would result in
substantial harm or inconvenience? Is there a risk that the volume of
notices received under such a standard would inure affected individuals
to notices of potentially harmful incidents and result in their not
taking protective actions?
    31. Do covered institutions expect to be able to perform reasonable
investigations in order to rebut the notification presumption? Why or
why not? Would it be helpful to include specific requirements for a
reasonable investigation? Are there other factors that would influence
whether a covered institution decides to conduct a reasonable
investigation or notify individuals? If additional clarity would assist
covered institutions in making these determinations, please explain.
    32. Should we require a covered institution to revisit a
determination that notification is not required based on its
investigation if new facts come to light? If yes, should the rule
provide specific requirements for a covered institution to revisit its
determination?
    33. Should we incorporate any additional aspects of the protections
offered to individuals under state laws into the proposed rules?
Alternatively, should any components of the proposal that offer
additional protections to individuals beyond some states' laws be
omitted? Please explain.
    34. Under what scenarios would a covered institution be unable to
comply with both the proposed rules and applicable state laws? Please
explain.
    35. Should the proposed rules be modified in order to help ensure
covered institutions would not need to provide multiple notices in
order to satisfy obligations under the proposed rules and similar state
laws?
b. Definition of ``Sensitive Customer Information''
    We propose to define the term ``sensitive customer information'' to
mean ``any component of customer information alone or in conjunction
with any other information, the compromise of which could create a
reasonably likely risk of substantial harm or inconvenience to an
individual identified with the information.'' \109\ This definition is
intended to cover the types of information that could most likely be
used in a manner that would result in substantial harm or
inconvenience, such as to commit fraud, including identify theft.\110\
We do not believe that notification would be appropriate if
unauthorized access to customer information is not reasonably likely to
cause a harm risk because a customer is unlikely to need to take
protective measures. Moreover, the large volume of notices that
individuals might receive in the event of unauthorized access to such
customer information could erode their efficacy. Accordingly, the
proposed definition is limited to information that, if compromised,
could create a ``reasonably likely risk of substantial harm or
inconvenience.'' \111\
---------------------------------------------------------------------------

    \109\ See proposed rule 248.30(e)(9)(i). Our proposed definition
is limited to information identified with customers of financial
institutions. See proposed rule 248.30(e)(5)(i); infra section
II.C.1. Information subject to the safeguards rule, including the
incident response program and customer notice requirements would be
information pertaining to a covered institution's customers and to
customers of other financial institutions that the other
institutions have provided to the covered institution. See proposed
rule 248.30(a); infra section II.C.1.
    \110\ See supra note 6 and accompanying text (noting increased
risks of unauthorized access and use of personal information).
    \111\ See proposed rule 248.30(e)(9)(i).
---------------------------------------------------------------------------

    The definition also provides examples of the types of information
included within the definition of ``sensitive customer information.''
\112\ These examples include certain customer information identified
with an individual that, without any other identifying information,
could create a substantial risk of harm or inconvenience to an
individual identified with the information.\113\ For example, Social
Security numbers alone, without any other information linked to the
individual, would be sensitive because they have been used in ``Social
Security number-only'' or ``synthetic'' identity theft. In this type of
identity theft, a Social Security number,

combined with identifying information of another real or fictional
person, is used to create a new (or ``synthetic'') identity, which then
may allow the malicious actor to, among other things, open new
financial accounts.\114\ A similar sensitivity exists with other types
of identifying information that can be used alone to authenticate an
individual's identity. A biometric record of a fingerprint or iris
image would present a significant threat of account fraud, identity
theft, or other substantial harm or inconvenience if the image is used
to authenticate a customer of a financial institution.
---------------------------------------------------------------------------

    \112\ See proposed rule 248.30(e)(9)(ii). While the information
cited in these examples is sensitive customer information, when that
information is encrypted, it would not necessarily be sensitive
customer information. That cipher text (i.e., the data rendered in a
format not understood by people or machines without an encryption
key) may be analyzed as such (rather than as the decrypted sensitive
customer information, e.g., a Social Security number referenced in
the examples provided in 248.30(e)(9)(ii)(A)(1)-(4) or in
248.30(e)(9)(ii)(B), and be determined not to be sensitive customer
information). And as discussed infra note 119, a covered institution
could consider the strength of the encryption and the security of
the associated decryption key as factors in determining whether
information is sensitive customer information. Accordingly, in
certain circumstances, information that is an encrypted
representation of, for example, a customer's Social Security number
may not be sensitive customer information under the proposed
definition.
    \113\ In this respect, our proposed definition is broader than
the definition of ``sensitive customer information'' provided in the
Banking Agencies' Incident Response Guidance. That definition
includes a customer's name, address, or telephone number, only in
conjunction with other pieces of information that would permit
access to a customer account. Our proposed definition would also be
broader than similar definitions of personal information used in