As we have previously discussed, Rule 30 of Regulation S-P (“Regulation S-P”) issued by the U.S. Securities and Exchange Commission (“SEC”) requires SEC registered investment advisers to adopt written policies and procedures designed to ensure the security and confidentiality of client information. For state registered investment advisers, the Federal Trade Commission (“FTC”) has enacted Safeguard Rules which are similar to Regulation S-P and apply to state registered investment advisers. Additionally some states have enacted their own information security requirements that apply to SEC and state registered investment advisers.
Category Archives: Information Security
Investment advisers must protect records that contain certain clients’ non-public, personal information. In efforts to safeguard client records and information, investment advisers should have in place a written information security plan. The main purpose of developing and implementing a strong written information security plan is to make sure that investment advisers have written policies and procedures in place to protect clients’ personal information. Investment advisers’ information security written policies and procedures must be reasonably designed to ensure the security and confidentiality of client records and information and to protect such records and information against any anticipated threats, hazards or unauthorized access or use.
Investment Advisers must have Procedures in Place to Safeguard Client Records and Information
August 22, 2012
Pursuant to Rule 30 of Regulation S-P (“Regulation S-P”), investment advisers registered with the U.S. Securities and Exchange Commission (“SEC”) “…must adopt policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information. These policies and procedures must be reasonably designed to:
Based upon the formal and informal expectations of state and federal securities regulators, every investment adviser should consider developing a written information security plan. Rule 30 of Regulation S-P issued by the U.S. Securities and Exchange Commission (“SEC”) requires SEC registered investment advisers to adopt written policies and procedures designed to ensure the security and confidentiality of client information. The enforcement of Rule 30 was highlighted by a recent SEC enforcement action against an investment adviser who had their trading system hacked. A year before the hacking occurred, an internal audit showed that the adviser did not utilize strong passwords. When the hacking occurred a year later, the investment adviser had taken no action to increase password security. Thus, the adviser was fined $275,000 for failing to safeguard customer information.
