SEC issues final rule to establish cyber requirements for investment firms

The Securities and Exchange Commission has adopted a final rule to require broker-dealers, investment companies and advisors to create incident response plans and notify customers of breaches to their personal information.

The rule announced on Thursday amends the so-called “Regulation S-P,” which was originally established in 2000. It is the SEC’s first action to establish cyber requirements since the controversial rulemaking adopted last year that mandated cyber incident disclosures for publicly traded companies.

“Over the last 24 years,...