Over two decades ago, the Securities and Exchange Commission (SEC) adopted Regulation S-P to require broker-dealers, registered funds, and investment advisers to adopt written policies and procedures covering safeguards that protect customer records and information. The cyber landscape was markedly different in the year 2000 when the SEC made its foray into information security. The world had only recently emerged from Y2K panic, in which many people, including corporate and government leaders, feared the internet would crash on New Year's Eve and possibly cripple modern civilization. While the move toward digital banking had begun, only 43% of Americans were online—just 17% of those internet users had ever engaged in any kind of online banking. And that year, the first truly global computer virus—a worm called ILOVEYOU—infected millions of systems and revealed to a largely cyber-indifferent public the dangers posed by online threat actors.