SEC Sets Comment Deadline for Proposed Cybersecurity Requirements

Comments on an SEC proposal that would create new cybersecurity risk management and disclosure requirements are due by June 5, 2023. The comment deadline was published in the Federal Register.

As previously covered, the SEC proposed new Rule 10 that would require market entities to (i) create and maintain written policies and procedures to address cybersecurity risks, (ii) annually review these policies, (iii) submit an annual review to the SEC and (iv) immediately inform the SEC of any significant cybersecurity incidents once the market entity concluded that a cybersecurity incident occurred. The proposal would also require covered entities to disclose and document through new Form SCIR (i) steps taken to remedy any significant cyber incidents and (ii) an annual summary of cybersecurity risks and incidents.

If adopted, the requirements would apply to broker-dealers, the MSRB and FINRA, clearing agencies, national securities exchanges, security-based swap data repositories, security-based swap dealers and transfer agents.