Proposed SEC Amendments Will Require Regulated Companies To Scrutinize Cybersecurity Risks

As cyber-attacks and data breaches pose an increasing threat to market participants, the US Securities and Exchange Commission ("SEC") has become increasingly focused on the cyber risks to the public and the market at large. Last week, the SEC proposed three separate proposals designed to increase the cybersecurity readiness of financial institutions: proposed amendments to Regulation S-P, proposed new requirements to address cybersecurity risks for certain market entities, and proposed new requirements to Regulation SCI.¹

These proposed amendments and rules suggest that there is a growing fear that as financial institutions become more adept at collecting nonpersonal public information for business purposes, they are inviting a commensurate risk of having such information be targeted by bad actors. Thus, the SEC is requiring these institutions to have in place established policies and procedures that would allow them to react efficiently and quickly to