Amended SEC Regulation S-P requires covered institutions to maintain a written incident response program reasonably designed to detect, respond to and recover from unauthorized access to customer information. It must include procedures to assess scope, contain the incident, and notify affected individuals. Engineers supply the detection, scoping and containment parts.
This is general information, not legal advice.
Who is covered
The rule text defines a covered institution as any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. If you build for those firms, their program shapes the questions you will get.
The three procedure blocks
Paragraph (a)(3) of the amended rule says the response program must include procedures to:
- Assess the nature and scope of any incident and identify the customer information systems and types of customer information that may have been accessed or used without authorization.
- Take appropriate steps to contain and control the incident to prevent further unauthorized access or use.
- Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless a reasonable investigation shows it has not been and is not reasonably likely to be used in a way that causes substantial harm or inconvenience.
What engineering contributes
| Procedure | Engineering deliverable |
|---|---|
| Assess scope | A map of which systems hold which customer data, and logs that show what was touched |
| Identify types of data | Data classification at field level |
| Contain and control | Runbooks to revoke credentials, isolate hosts and block egress |
| Detect | Alerting on unusual access to customer records |
| Recover | Tested restores and a clean rebuild path |
| Support notice | A way to produce the list of affected individuals quickly |
The rule says that if specific individuals cannot be identified, notice goes to all individuals whose sensitive customer information resides in the affected system. Good scoping data reduces that number.
Records
The rule requires covered institutions to keep written documentation of detected unauthorized access, the response and recovery, and the investigation and determination about notification, including its basis. The timelines for retaining these records are set in the rule text, so check them with the compliance team.
Practice before it matters
Run a tabletop where the starting fact is "a service account read customer records it should not have." Ask the team to name the affected systems and data types within an hour. Gaps in that answer are the first backlog items.
Mistakes to avoid
Programs trip on a few things. The data map exists but lists systems, not data types. Logs show who logged in but not which records were read. Containment steps assume the team can reach a system that may be down. And service providers are named in a contract but have no tested notification path. Map data types per system, log record level access for customer data, write containment steps that work with limited access, and test provider contacts.
Quick check
Is a vendor's breach covered by the program?
The notification obligation applies to incidents at the covered institution or at a service provider that is not itself a covered institution. The program also requires oversight of service providers.
Does the rule list technical tools?
No. It requires a program reasonably designed to detect, respond and recover, and leaves tool choice to the institution.
Sources
- SEC fact sheet, Final Rules: Enhancements to Regulation S-P
- SEC adopting release 34-100155 (rule text)
Last reviewed: 19 October 2026.
