Regulation S-P is a U.S. Securities and Exchange Commission rule that requires covered financial institutions to protect customer information. It combines privacy duties, safeguards for nonpublic personal information, and incident-response expectations when records may have been exposed. In practice, it pushes firms to control how data is collected, shared, stored, and destroyed, and to maintain policies that reduce unauthorized access.
In cyber security, Regulation S-P matters because a breach is not only a technical problem; it can trigger legal and operational obligations. If attackers steal account details, identifiers, or other customer records, the firm may need to assess scope, contain access, document the event, and notify affected parties when required. Defenders use the rule as a baseline for security governance: access controls, encryption, vendor oversight, monitoring, and tested response plans. Attackers target firms covered by the rule because customer data can support fraud, phishing, and identity abuse, making compliance and resilience closely linked.