Full-Service Law Firm solving complex challenges through bold thinking, precise execution, and shared purpose.

Full Service Law Firm | Michael Best & Friedrich LLP

Specializing in the Intersection of Business &amp; Government

Meet our team of trusted advisors, strategic thinkers, and community builders dedicated to client success.

Learn about our full-service legal and business solutions, designed to address complex challenges for leading organizations across industries.

Access thought leadership, news, and resources to stay informed about the latest trends, legal developments, and industry innovations.

Discover how partnership, bold thinking, and precise execution drive results for clients nationwide.

Explore how our national reach and local expertise support clients across the United States and beyond.

Grow at a firm designed to bring out your best.

On March 15, 2023, the Securities and Exchange Commission (“SEC”) concurrently proposed three rules designed to address the growing prevalence of data breaches at financial institutions and their impact on customers. The proposed rules follow pending proposals published in 2022 that address cybersecurity risks with respect to investment advisers, investment companies, and public companies.The proposed rules would require various financial institutions to adopt written policies and procedures governing various data security issues, assess cybersecurity risks and procedures annually, report security incidents to the Commission and to the public, and expand existing security requirements to new covered entities.<h2>Proposed Amendments to Regulation S-P</h2>The first proposal would amend Regulation S-P to require covered entities to adopt certain written policies and procedures and to notify customers of security breaches.Written Policies and ProceduresCurrently, Regulation S-P requires registered broker-dealers, investment companies, and investment advisers to inform customers about how those institutions use customer financial information. However, Regulation S-P does not require institutions to notify customers about data breaches. The proposed rule would amend Regulation S-P to require registered broker-dealers, investment companies, investment advisers, and transfer agents (“Covered Institutions”) to adopt written policies and procedures that:<ol><li>Ensure the security and confidentiality of customer information;</li><li>Protect against any anticipated threats or hazards to the security or integrity of customer information; </li><li>Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer; and</li><li>Include an incident response program for detecting, responding to, and recovering from unauthorized access to or use of customer information.</li></ol>NotificationCovered Institutions would also be required to notify impacted individuals within 30 days of determining, through a reasonable investigation, that sensitive customer information has been, or is reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. If the Covered Institution is unable to identify which specific individuals’ sensitive customer information has been accessed/used, the Covered Institution must provide notice to all individuals whose sensitive customer information resides in the breached information system.<h2>Proposed Rule 10 of the Securities Exchange Act</h2>The second proposal would create a new Rule 10 under the Securities Exchange Act of 1934 requiring all “Market Entities” to adopt written policies and procedures that address their cybersecurity risks, and to report certain cybersecurity incidents. “Market Entities” are defined as broker-dealers, the MSRB, clearing agencies, major security-based swap participants, national securities associations, national securities exchanges, security-based swap repositories, security-based swap dealers, and transfer agents.Written Policies and ProceduresMarket Entities would be required to adopt policies and procedures that address cybersecurity risks and that specifically include the following:<ul><li>Periodic cybersecurity risk assessments, and written documentation of the same.</li><li>Controls to minimize user-related risks and unauthorized access to information systems.</li><li>Measures to monitor the entity’s information systems and oversee service providers that access those information systems.</li><li>Measures to detect, mitigate, and remediate cybersecurity threats and vulnerabilities.</li><li>Annual review and assessment of the design and effectiveness of cybersecurity policies and procedures, and preparation of a written report that describes the review, assessment, tests performed, results of the review/assessment, prior incidents, and material changes to policies and procedures.</li></ul>Reporting Significant Cybersecurity IncidentsMarket Entities would further be required to immediately notify the Commission of a significant cybersecurity incident upon having a reasonable basis to conclude one has occurred or is occurring. A “significant cybersecurity incident” is an incident that jeopardizes the confidentiality, integrity, or availability of the information systems or any information on those systems.Market Entities would also need to file a new Form SCIR promptly, but no later than 48 hours, after having a reasonable basis to conclude that the incident has occurred or is occurring. Form SCIR gathers information about the significant cybersecurity incident and the entity’s efforts to respond to and recover from the incident.The Market Entity would need to disclose to the public the following information on Form SCIR:<ol><li>A plain-English summary description of the cybersecurity risks that could materially affect its business and operations and how the Covered Entity assesses, prioritizes, and addresses those cybersecurity risks; and</li><li>A summary description of each significant cybersecurity incident that occurred during the current or previous calendar year.</li></ol><h2>Proposed Expansion and Updates to Regulation SCI</h2>The third proposal would expand Regulation Systems Compliance and Integrity (Reg SCI) to account for the evolution of technology since the regulation’s adoption in 2014. The Reg SCI updates would expand the entities covered by Regulation SCI to include the DTCC Data Repository and the ICE Trade Vault, approximately 20 of the largest broker-dealers in the U.S. (based on total asset and transaction activity thresholds), and the five currently exempt clearing agencies.All SCI covered entities would need to update their policies and procedures to include:<ul><li>An inventory, classification, and lifecycle management program.</li><li>A program to oversee third party providers.</li><li>Business continuity/disaster recovery plans that address the unavailability of key third party providers.</li><li>A program to prevent unauthorized access to SCI systems and information.</li><li>Identification of current SCI industry standards with which each policy and procedure is consistent.</li></ul>The proposed rules are open for comment until 60 days after publication in the Federal Register. Additionally, on light of the proposed rules and other technological advancements, the SEC has reopened comments on its 2022 Investment Management Cybersecurity Proposal until May 22, 2023.If you have questions about the proposed regulations or your current cybersecurity obligations, please reach out to a member of Michael Best’s Securities and Capital Markets team. Michael Best also has Privacy and Cybersecurity attorneys that help you meet industry security standards.<input type='hidden' id='passle-remote-hosting-tracking-shortcode' value='102ic9t'/><blockquote class="wp-block-quote passle-quote has-cite-link">Our staff is particularly focused on identifying and prosecuting any form of misconduct that might threaten investors, capital formation, or the markets more broadly….we will investigate and bring enforcement actions if we find violations of the federal securities laws. - Gary Gensler<cite><a href="" aria-label="newtab/..." title="edge://newtab/" target="_blank">newtab/...</a></cite></blockquote><div class="passle-featured-image passle-featured-image-position-bottom"><img src="https://images.passle.net/fit-in/400x400/filters:crop(0,13,611,342)/Passle/5f6edd8e8cb62a0bec3e5fd2/SearchServiceImages/2023-04-05-18-11-51-155-642db9e7f636e913c4ff23ae.jpg" alt="Featured Image" /></div>

SEC Proposes Three Rules Establishing Comprehensive Cybersecurity Requirements

Related People

Related Capabilities

You may also be interested in these

OSHA Site Targeting 2026: Are You a Target?

Trademark Watch Services in Practice: Turning Alerts into Informed Decisions

Legal Bites: Q4 2025 Edition