SS&C Blog

BLOGS. June 28, 2024

Cybersecurity and Rapid Response – Updates to SEC Regulation S-P

More than 24 years have passed since the U.S. Securities and Exchange Commission (SEC) first adopted Regulation S-P, which governs the treatment of consumers’ private information by certain financial institutions. In May of 2024, the SEC unanimously agreed to update these rules to keep pace with modern cyber-attacks and data breaches. The amendments to Regulation S-P will require covered institutions (including broker-dealers, investment companies and registered investment advisors) to implement and maintain written procedures that aim to detect, respond to and recover the unauthorized use of their customer’s information. As a result, covered institutions may also be required to notify affected customers within 30 days of becoming aware of the incident and must include details about the incident, the breached data and offer the next steps for responding to the breach.