On May 16, 2024, the Securities and Exchange Commission (SEC) unanimously approved amendments to Regulation S-P, which imposes new rules relating to cybersecurity breaches involving investment advisers and broker-dealers. Larger entities must comply with the new rules by December 3, 2025, while smaller entities must comply by June 3, 2026. The amendments to Regulation S-P added requirements compelling covered institutions to adopt written policies and procedures that are reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer nonpublic personal information.
Source: New SEC Cybersecurity Rules Begin to Take Effect – Lexology