The SEC brings its first enforcement action under the identity theft red flags rule

Purpose: To explain the significance of the first enforcement action under the Identity Theft Red Flags Rule by the US Securities and Exchange Commission (SEC), which was announced on September 26, 2018. Design/methodology/approach: Explains how the SEC’s order not only cites violations of the Safeguards Rule under Regulation S-P (a staple of SEC cybersecurity enforcement actions against broker-dealers and investment advisers) but also is the SEC’s first enforcement action for a violation of the Identity Theft Red Flags Rule under Regulation S-ID, which requires certain SEC registrants to create and implement policies to detect, prevent and mitigate identity theft. Findings: Cybersecurity policies and procedures must match business risks and change as business risks change. Originality/value: Practical guidance from experienced cybersecurity and privacy lawyers.