🛡️ Add breach assessment procedures

[JFWooten4]

Creates assessment procedures for Regulation S-P incident response under 17 CFR § 248.30, Subsection (a)(3)(i). The procedures should define how BlockTransfer assesses the nature and scope of unauthorized access to or use of customer information, identifies affected customer information systems, determines the types of customer information involved, and supports customer-notification decisions under 17 CFR § 248.30, Subsection (a)(4).

Recordkeeping implementation is out of scope for this PR and should be handled separately under the transfer-agent recordkeeping issue.

Regulatory basis

17 CFR § 248.30, Subsection (a)(3): response program

Written policies and procedures in paragraph (a)(1) of this section must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

17 CFR § 248.30, Subsection (a)(3)(i): assessment procedures

Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization;

17 CFR § 248.30, Subsection (a)(4)(i): notification obligation

Unless a covered institution has determined, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information that occurred at the covered institution or one of its service providers that is not itself a covered institution, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, the covered institution must provide a clear and conspicuous notice, or ensure that such notice is provided, to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

The notice must be transmitted by a means designed to ensure that each affected individual can reasonably be expected to receive actual notice in writing.

17 CFR § 248.30, Subsection (a)(4)(ii): affected individuals

If an incident of unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, but the covered institution is unable to identify which specific individuals' sensitive customer information has been accessed or used without authorization, the covered institution must provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization.

Notwithstanding the foregoing, if the covered institution reasonably determines that a specific individual's sensitive customer information that resides in the customer information system was not accessed or used without authorization, the covered institution is not required to provide notice to that individual under this paragraph.

17 CFR § 248.30, Subsection (d)(6): customer information systems

Customer information systems means the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information to maintain or support the covered institution's operations.

17 CFR § 248.30, Subsection (d)(9): sensitive customer information

Sensitive customer information means any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.

Changes to be made

• Create written incident assessment procedures for unauthorized access to or use of customer information.
• Define how incidents are scoped, documented, and escalated after detection.
• Identify the customer information systems that may have been accessed or used without authorization.
• Identify the types of customer information that may have been accessed or used without authorization.
• Determine whether sensitive customer information was or is reasonably likely to have been accessed or used without authorization.
• Define how BlockTransfer determines the affected individuals, including when notice must be sent to all individuals whose sensitive customer information resides in an affected customer information system.
• Define how assessment findings feed into containment, control, recovery, and customer-notification decisions.
• Cross-reference the separate customer notice procedure, incident response program, and transfer-agent recordkeeping workstreams.

[JFWooten4]

Honestly, this and the next PRs might repeat stuff, but that is a design choice. As these procedures expand, they will need the sections (which is why we scoped out #37). So I may say something like "observe the physical attack" multiple times, but in the future, different instances of that phrase in different parts of the docs could mean different things and require different responses based on whether it's the assessment, prevention, or response from backup.