Compliance Training Attestation Reg SP

Enter Your Name (First, Last)

Enter your email address

By checking each item, I confirm that I have reviewed the following training materials in full:

Regulation S-P Staff Training presentation (15 slides)

What is Regulation S-P — rule overview and 2024 amendments

What constitutes “Customer Information” under Reg S-P

My duty to report incidents immediately to the CCO or Privacy Officer

MAMC’s 6-Phase Incident Response Program (Phases 1–6)

Phases 2 & 3 deep dive: detection triggers and DO/DON’T containment rules

The 30-day customer notification requirement and required notice content

Service providers and the 72-hour vendor notification rule

Real-world scenarios and knowledge check (Scenarios A, B, C)

Quick reference card: Reg S-P IRP at a Glance

If you have any questions about the training content, or if any aspect of the policy is unclear or presents a challenge for your specific role, please describe below. This section will be reviewed by the CCO. Completing this section does not affect your attestation.

By checking each item, I confirm that I understand the following:

Reg S-P Purpose: Regulation S-P requires MAMC to protect client nonpublic personal information (NPI) — including for former clients — and to respond to security incidents in a structured, documented way.

What to Report: I must report to the CCO or Privacy Officer immediately if I notice unusual system behavior, accidentally click a phishing link, lose or have stolen a work device, send client data to the wrong recipient, or receive any vendor alert about possible unauthorized access.

Report Immediately — Do Not Investigate Alone: I must not wait to see if anything actually happened, attempt to investigate or remediate an incident on my own, or delete or power off any device involved in a potential incident.

30-Day Notification Rule: If MAMC determines that a Reportable Incident has occurred, affected clients must be notified within 30 calendar days. The clock starts when MAMC becomes aware. I will not delay reporting, as any delay shortens MAMC’s response window.

72-Hour Vendor Rule: All service providers that handle MAMC client data are required by contract to notify MAMC within 72 hours of becoming aware of any unauthorized access to that data. If I manage a vendor relationship, I must ensure the CCO is aware and that the contract contains this requirement.

Contacts for Reporting: I know that I must report to Paige Ducey, CCO (via the Compliance Portal or direct email) or to the Privacy Officer (IT Manager) for technical or system incidents.

By checking each item, I confirm the following with respect to my ongoing obligations under MAMC’s Compliance Manual:

I have read and understand the Incident Response Program section of the MAMC Compliance Manual (adopted May 21, 2026) and my obligations thereunder.

I will immediately report any actual or suspected security incident to the CCO (Paige Ducey) or the Privacy Officer (IT Manager) — without delay and without attempting to investigate on my own.

I will not delete, power off, or alter any device or system that may be involved in a suspected incident until authorized to do so by the Incident Response Team.

I understand that failure to report a known or suspected incident is a violation of the Compliance Manual and may result in disciplinary action, up to and including termination.

I will complete any future Reg S-P refresher training as required by the CCO.

I will immediately notify the CCO if my role changes in a way that increases my access to client nonpublic personal information or my involvement in managing vendor relationships.