🛡️ Add incident response program

[JFWooten4]

Adds a written incident response program for Regulation S-P compliance under 17 CFR § 248.30(a)(3). The program should define how BlockTransfer detects, assesses, contains, controls, recovers from, and escalates unauthorized access to or use of customer information, including when customer notification procedures must be triggered.

Recordkeeping implementation is out of scope for this PR and should be handled separately under the transfer-agent recordkeeping issue.

Regulatory basis

17 CFR § 248.30(a)(3): response program

Written policies and procedures in paragraph (a)(1) of this section must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures.

This response program must include procedures for the covered institution to:

(i) Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization;

(ii) Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information; and

(iii) Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with paragraph (a)(4) of this section unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

17 CFR § 248.30(a)(4)(i): notification obligation

Unless a covered institution has determined, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information that occurred at the covered institution or one of its service providers that is not itself a covered institution, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, the covered institution must provide a clear and conspicuous notice, or ensure that such notice is provided, to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

The notice must be transmitted by a means designed to ensure that each affected individual can reasonably be expected to receive actual notice in writing.

17 CFR § 248.30(a)(4)(iii): notice timing

A covered institution must provide the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred unless the United States Attorney General determines that the notice required under this rule poses a substantial risk to national security or public safety, and notifies the Commission of such determination in writing.

17 CFR § 248.30(a)(5): service providers

A covered institution's response program prepared in accordance with paragraph (a)(3) of this section must include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including to ensure that the covered institution notifies affected individuals as set forth in paragraph (a)(4) of this section.

The policies and procedures must be reasonably designed to ensure service providers take appropriate measures to:

(A) Protect against unauthorized access to or use of customer information; and

(B) Provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of such notification, the covered institution must initiate its incident response program adopted pursuant to paragraph (a)(3) of this section.

Notwithstanding a covered institution's use of a service provider in accordance with paragraphs (a)(5)(i) and (ii) of this section, the obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of this section rests with the covered institution.

Changes to be made

• [] Create a written incident response program for unauthorized access to or use of customer information.
• Define incident intake, triage, escalation, assessment, containment, control, recovery, and closeout procedures.
• Add procedures to identify affected customer information systems and the types of customer information involved.
• Add a reasonable-investigation workflow for determining whether sensitive customer information was or is reasonably likely to have been accessed or used without authorization.
• Add customer notification decision procedures tied to the 30-day notice requirement.
• Add service-provider escalation requirements, including the 72-hour provider breach notice expectation.
• Define internal roles responsible for legal, technical, vendor, customer-notice, and executive escalation.
• Cross-reference the separate customer notice template/procedure and vendor oversight workstreams.

[JFWooten4]

There are bits of this that are written without full contextualization or independent implementation for the sake of (i) time and (ii) merge order. It is not generally possible to cross-reference the other policies that haven't been written yet in the other PRs.