What is an incident response program?

Definition

Amended Regulation S-P requires covered firms to have written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. It must include procedures to assess and contain incidents, to notify affected individuals, and to oversee service providers.

Customer notice is due as soon as practicable but not later than 30 days after the firm becomes aware of an incident involving sensitive customer information, with limited exceptions.

Why it matters for advisors

AI adds new kinds of incidents: client data pasted into an unapproved tool, a notetaker recording shared with the wrong person, or a breach notice from an AI vendor. Naming these in your program helps staff spot them and act quickly.

Because vendor breaches can trigger your notice obligation, the program and your vendor contracts need to fit together.

Example

A firm's incident response plan lists "client data entered into a non-approved AI tool" as an incident type, with steps: tell compliance the same day, ask the vendor to delete, assess whether sensitive customer information was involved, and document the decision on notice.

Watch out for

Skipping notice is allowed only after a reasonable investigation finds no reasonable likelihood of substantial harm or inconvenience. Document the investigation.