An investment adviser registered with the SEC stores client records with a third-party cloud vendor. On March 3, the vendor detects that an intruder accessed a file containing client names, addresses, and tax identification numbers, and it notifies the adviser on March 4. The adviser's Form ADV Part 2A brochure states that the firm will notify clients of a suspected data breach within 45 days. The adviser's internal review, completed on March 28, confirms that the data were accessed; the adviser does not determine that the information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. The adviser mails notices to all affected clients on April 12.
Which statement is correct regarding the adviser's notification obligation under federal privacy and cybersecurity rules? Answer: The adviser violated the notification requirement because the notices were mailed more than 30 days after it became aware of the breach.
Governing authority: SEC Regulation S-P, as amended in 2024 and now fully in force. An SEC-registered adviser must maintain a written incident response program and must notify affected customers no later than 30 days after it becomes aware of unauthorized access to sensitive customer information, unless after a reasonable investigation it determines the information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. The adviser made no such determination, so notice was required. The vendor's March 4 notice made the adviser aware of the breach, so the adviser had until April 3 to notify its clients, and the April 12 mailing was late. The statement crediting the adviser for mailing within 30 days of completing its internal review wrongly starts the clock at confirmation rather than at awareness. The statement crediting the 45-day period in the brochure is wrong because a firm's own disclosure cannot override the regulatory deadline. The statement that the vendor violated the rule by not notifying clients directly misstates the division of duties: the obligation to notify customers rests with the covered institution, and the 72-hour vendor notice is imposed only through the adviser's oversight policies, not as a direct duty on the vendor.
An investment adviser registered with the SEC maintains advisory accounts for individual clients. Under its advisory agreements, the adviser has authority to direct transfers of funds from client accounts to third parties on the clients' instructions, and clients can view account information through an online portal. The adviser does not extend credit.
Under federal identity theft prevention requirements, which statement is correct? Answer: The adviser must implement a written program to detect, prevent, and mitigate identity theft in its advisory accounts.
SEC Regulation S-ID requires financial institutions and creditors that offer or maintain covered accounts to implement a written identity theft prevention program designed to detect, prevent, and mitigate identity theft. The adviser is a financial institution under Reg S-ID because it can direct transfers from client accounts to third parties at its clients' instructions, and the individual accounts that permit those transfers are covered accounts. No extension of credit is necessary. The not-a-creditor answer ignores the financial-institution prong of the rule, the credit-report answer would impose an obligation the rule does not create, and the filing-and-approval answer substitutes SEC pre-approval for the internal board or senior-management approval the rule requires.
- Under Regulation S-P, as amended in 2024, which of the following statements regarding breach notification involving a covered institution's service provider is true?
Answer: The covered institution's oversight policies must require each service provider to notify the institution no later than 72 hours after the provider becomes aware of a breach.
Regulation S-P (17 CFR 248.30), as amended in 2024. The rule places no notice duty directly on a service provider. Instead, the covered institution's incident response program must include policies and procedures requiring oversight of its service providers, including due diligence and monitoring, reasonably designed to ensure that each provider notifies the institution as soon as possible, but no later than 72 hours, after becoming aware of a breach affecting a customer information system the provider maintains. The statement requiring the provider to notify the institution and each affected customer is wrong: the rule binds the institution, not the provider, and the customer notice is the institution's obligation. The statement giving the provider 30 days and the institution 72 hours swaps the two windows: 72 hours is the provider's notice to the institution, and 30 days after becoming aware is the institution's deadline for notifying customers. The statement that the institution's duty ends once the provider notifies customers is wrong: the institution may arrange for the provider to send the notice, but the obligation to ensure that affected customers are notified stays with the covered institution.
A federal covered investment adviser has a written business continuity plan that designates an alternate office and describes records backup. It does not have a written incident response program. The chief compliance officer orally instructs staff that if a data breach occurs, they should call the firm's lawyer. No breach has occurred.
Under federal privacy rules, which statement is correct? Answer: The adviser must adopt a written incident response program, and neither the oral instructions nor the business continuity plan satisfies that requirement.
SEC Regulation S-P requires covered institutions to maintain written policies and procedures reasonably designed to detect, respond to, and recover from unauthorized access to customer information, and to notify affected customers. Because the adviser has no written incident response program, and neither its oral instructions nor its business continuity plan qualifies as one, the adviser is not in compliance. The duty to maintain the program exists before any breach occurs, so the statement that a program is required only after an unauthorized access event is wrong. The 30-day notification obligation applies only after the adviser becomes aware of an actual breach, not when it discovers that a required program is missing; a business continuity plan addresses resiliency, not incident response.
- Which of the following statements regarding Regulation S-ID is true?
Answer: A broker-dealer offering or maintaining covered accounts must adopt a written identity theft prevention program with reasonable policies and procedures to identify, detect, and respond to red flags.
Regulation S-ID requires a broker-dealer or other financial institution that offers or maintains covered accounts to develop and implement a written identity theft prevention program with reasonable policies and procedures to identify relevant red flags, detect them in covered accounts, respond to prevent and mitigate identity theft, and update the program periodically. No SEC filing or pre-approval is required, so the statement that the program must be filed and approved before opening covered accounts is wrong. The statement limiting covered accounts to those opened by natural persons for personal, family, or household purposes ignores the second prong of the definition: covered accounts also include any other account with a reasonably foreseeable risk of identity theft. The statement treating a Regulation S-P incident response program as satisfying Regulation S-ID is wrong because the two regulations impose separate obligations and no such safe harbor exists.
On March 3, a cloud storage vendor that hosts client records for a federal covered investment adviser detected unauthorized access to its file servers. The vendor identified the adviser's client files on March 12 and notified the adviser that same day that unencrypted client names, account numbers, and Social Security numbers had been viewed. The adviser's chief compliance officer completed its own internal review on March 18 and confirmed the vendor's finding.
Under federal privacy rules, which statement describes the adviser's obligation to notify affected clients? Answer: Notify affected clients by April 11; the adviser's 30-day notice period began when the vendor notified it of the breach on March 12.
SEC Regulation S-P requires a covered institution to notify affected customers no later than 30 days after it becomes aware of a breach involving sensitive customer information, including a breach at its service provider. The adviser became aware when the vendor notified it on March 12, so April 11 is the deadline; completion of the CCO's internal review does not restart or delay that clock. The 72-hour vendor notice is a separate matter: the rule places no direct duty on the vendor, and the adviser's own oversight policies must require the vendor to notify the adviser within 72 hours. The April 17 answer impermissibly defers awareness until the adviser's confirmation, the April 2 answer runs the clock from the vendor's discovery rather than the adviser's awareness, and waiting for a complete forensic list is not a basis to withhold notice beyond the 30-day deadline.
A state-registered investment adviser keeps client account records on its office server and stores the only backup drive in the same office building. The business continuity plan says the firm's owner will work from home if the office is unusable. However, the plan does not explain how clients will be told where to direct communications.
Which of the following is the best assessment of the plan under NASAA rules? Answer: It is deficient because the backup is in the same building as the records and the plan does not address client communications.
NASAA's business continuity model rule requires a written plan reasonably addressing records backup and recovery, an alternate work location, communications with clients, and minimizing client harm. The backup drive here is in the same building as the primary records, so it would not protect client records against a building-wide disruption, and the plan does not explain how clients would be told where to direct communications. The filing-and-approval answer is wrong because NASAA does not require the plan to be filed or pre-approved. The answer that the plan is adequate because it has a backup copy and an alternate location ignores the co-located backup and the missing client-communication procedure. The answer relying on the owner's home and informal notification is also wrong because informal notification is not a substitute for a plan that addresses client communications.
A state-registered investment adviser is a sole proprietorship. Its written business continuity plan describes off-site electronic backups, an alternate office location, and a method for communicating with clients by email. The plan does not designate anyone to handle client communications or record recovery if the owner-adviser dies or becomes incapacitated.
Under NASAA rules, which statement is correct? Answer: The plan is deficient because it must address the assignment of duties when key persons, including a sole owner, are unavailable.
NASAA's business continuity model rule requires a written plan reasonably designed to address, among other things, records backup, alternate communications, office relocation, assignment of duties if key people die or become unavailable, and minimizing client harm. A sole owner-adviser is a key person, so the absence of any designated person for client communication and record recovery is a deficiency. The no-employees answer treats the sole owner as though the owner were not a key person, the only-required-elements answer omits the assignment-of-duties element, and the filing-and-approval answer adds an approval requirement the model rule does not impose.
- Under Regulation S-P, as amended in 2024, which of the following statements regarding a covered institution's duty to notify customers after a breach of sensitive customer information is true?
Answer: The institution must notify affected customers within 30 days after learning of the breach, and the deadline may be delayed if the U.S. Attorney General tells the SEC in writing that notice risks national security or public safety.
Regulation S-P (17 CFR 248.30), as amended in 2024. The covered institution owes affected customers notice as soon as practicable, and no later than 30 days after becoming aware that unauthorized access to sensitive customer information occurred or is reasonably likely to have occurred, including a breach at one of its service providers. The deadline can be delayed only if the U.S. Attorney General determines that notice poses a substantial risk to national security or public safety and notifies the SEC of that determination in writing (up to 30 days, another 30 on a renewed determination, and in extraordinary circumstances a final 60 for national security). The statement letting a law-enforcement agency investigating the breach delay the notice is wrong: under Regulation S-P only the Attorney General's written determination to the SEC can delay it; a law-enforcement request for delay belongs to the FTC Safeguards Rule's notice to the FTC. The statement giving the institution 72 hours and the service provider 30 days swaps the windows: 72 hours is the provider's notice to the institution, which the institution's oversight policies must require, and 30 days is the institution's notice to customers. The statement that the 30-day period begins only after the provider's 72-hour period expires is wrong because the clock starts when the institution becomes aware of the breach, including when the provider tells it.
A federal covered investment adviser has already provided its clients with the privacy notices required by federal law. The adviser plans to hire a third-party vendor to prepare and mail client account statements, and it also plans to share its client mailing list with an unaffiliated financial publisher for the publisher's own marketing use.
Which statement about the adviser's obligations before making these disclosures is correct? Answer: It may share information with the vendor without offering an opt-out if the vendor's contract limits use of the data, but it must offer an opt-out before sharing the mailing list.
SEC Regulation S-P requires an adviser to give customers a reasonable opportunity to opt out before disclosing nonpublic personal information to a nonaffiliated third party. A service-provider exception permits disclosure without an opt-out where the third party performs services for the adviser under a contract that requires confidentiality and restricts use of the information. The statement vendor fits the exception; the publisher, which is receiving the list for its own marketing, does not. The answer requiring opt-out for both ignores the service-provider exception, the opt-in answer imposes the wrong consent standard, and the annual-notice answer ignores the separate opt-out requirement for marketing disclosures to nonaffiliated third parties.
- Under NASAA rules, a state-registered investment adviser's business continuity plan must address all of the following EXCEPT:
Answer: Annual testing of the plan through simulated cyber-attack exercises, with the results documented in writing.
NASAA's business continuity model rule requires a state-registered investment adviser to maintain written policies and procedures addressing, at a minimum, backup and recovery of records, alternate means of communication with clients, relocation of office operations, assignment of duties if key personnel die or become unavailable, and minimization of client harm. The options describing backup and recovery, alternate communications, and relocation and assignment of duties all state required elements. The option describing annual testing through simulated cyber-attack exercises is not part of the model rule's required list, so it is the exception.
- Under federal privacy rules, which of the following statements is true regarding a covered institution's incident response program?
Answer: A covered institution must maintain a written incident response program containing policies and procedures reasonably designed to detect, respond to, and contain security incidents involving customer information.
Regulation S-P, as amended in 2024, requires every covered institution to maintain a written incident response program containing policies and procedures reasonably designed to detect, respond to, and contain security incidents involving customer information, and to notify affected customers no later than 30 days after becoming aware of a breach. The statement requiring an annual independent third-party review and five-year retention of the reviewer's report is not part of Regulation S-P. The statement limiting the duty to firms with custody or discretion is wrong because the rule applies to all covered institutions, not only those with custody or discretion. The 72-hour customer-notification statement reverses the rule's timing: service providers must notify the covered institution within 72 hours, while customer notification is due within 30 days.
- Which of the following statements is true regarding the scope of Regulation S-P?
Answer: Regulation S-P applies to broker-dealers and SEC-registered investment advisers, not state-registered advisers, which fall under the FTC Safeguards Rule.
Regulation S-P (17 CFR Part 248), the SEC's rule implementing the privacy and safeguarding provisions of the Gramm-Leach-Bliley Act. Its covered institutions are broker-dealers, investment companies, and investment advisers and transfer agents registered with the SEC. A state-registered investment adviser is not a covered institution; the FTC Safeguards Rule expressly covers investment advisers that are not required to register with the SEC, and their privacy notices come under the CFPB's Regulation P. The statement that the rule covers state-registered advisers and leaves broker-dealers to FINRA rules is wrong in both respects: state-registered advisers are outside it, and broker-dealers are covered institutions. The statement that the rule reaches every adviser and broker-dealer regardless of registration overstates its scope: implementing GLBA does not bring state-registered advisers within the SEC's rule. The statement that coverage depends on custody is wrong because the privacy-notice, safeguarding and breach-notification duties apply to every covered institution regardless of custody.
- Under Regulation S-P, which of the following statements regarding a covered broker-dealer's treatment of nonpublic personal information is true?
Answer: The firm must deliver an initial privacy notice when the customer relationship begins and give the customer a reasonable opportunity to opt out before disclosing nonpublic personal information to a nonaffiliated third party.
Regulation S-P requires a covered institution to deliver an initial privacy notice no later than when it establishes a customer relationship and, before disclosing nonpublic personal information to a nonaffiliated third party, to give the customer a reasonable opportunity to opt out. The statement requiring affirmative written consent is wrong in two respects: the rule uses an opt-out rather than an opt-in mechanism, and a disclosure to a service provider that prepares account statements falls within the rule's permitted exceptions, so it requires only the confidentiality safeguards the rule specifies. The statement requiring a new annual notice on every account anniversary regardless of changed policies is wrong because an institution that has not changed its policies and makes only permitted disclosures is not required to deliver an annual notice. The statement extending the opt-out right to affiliates is wrong: the Regulation S-P opt-out governs sharing with nonaffiliated third parties, while affiliate information sharing is addressed separately under the Fair Credit Reporting Act.
A state-registered investment adviser is operated by a single IAR. The adviser's written business continuity plan provides for off-site backup of client records, a toll-free telephone line for client communications during an emergency, and relocation to a nearby office if its building becomes unusable. The plan does not say who would perform the IAR's duties or access the firm's records if the IAR became unavailable, and it does not describe how the firm would limit harm to clients during a prolonged disruption. The adviser has no custody of client funds and does not exercise discretionary trading authority.
Under NASAA rules, which statement is correct regarding the adviser's business continuity plan? Answer: The plan is deficient because it must also provide for reassignment of essential duties during an outage and for procedures that protect client interests if operations are interrupted for an extended period.
Governing authority: the NASAA business continuity model rule, as adopted under the Uniform Securities Act. A state-registered investment adviser must maintain a written business continuity plan covering records backup, alternate communications, office relocation, assignment of duties if key personnel become unavailable, and minimizing client harm. The plan covers the first three elements, but it does not provide for reassignment of the sole IAR's essential duties and has no procedures for protecting clients during an extended interruption. Therefore, the statement that the plan is deficient is correct. The statement that the rule requires naming a licensed IAR to take over client accounts misstates the assignment-of-duties element: the plan must address how duties would be assigned, but it does not have to appoint a licensed successor. The statement that the three listed elements are the only required elements ignores the assignment and client-protection requirements. The statement that the rule applies only to advisers with custody or discretionary authority is wrong; the business continuity requirement applies to the adviser's business generally, and the absence of custody or discretion does not exempt the adviser.
