The SEC brings its first enforcement action under the identity theft red flags rule
Purpose To explain the significance of the first enforcement action under the Identity Theft Red Flags Rule by the US Securities and Exchange Commission (SEC), which was announced on September 26, 2018. Design/methodology/approach Explains how the SEC’s order not only cites violations of the Safeguards Rule under Regulation S-P (a staple of SEC cybersecurity enforcement actions against broker-dealers and investment advisers) but also is the SEC’s first enforcement action for a violation of the Identity Theft Red Flags Rule under Regulation S-ID, which requires certain SEC registrants to create and implement policies to detect, prevent and mitigate identity theft. Findings Cybersecurity policies and procedures must match business risks and change as business risks change. Originality/value Practical guidance from experienced cybersecurity and privacy lawyers.