SEC requires advisers to set up identity-theft-detection programs