2021: Year In Review - SEC Signals More Aggressive Posture In Cybersecurity Space

We continue our year-end review of SEC enforcement activity and turn our attention to a topic grabbing seemingly daily headlines across multiple industries: cybersecurity. As the risks - and realities - of cyberattacks increase around the world, the SEC continues to prioritize cybersecurity for the Divisions of Examinations and Enforcement. Although standalone SEC enforcement actions related to cybersecurity risks and disclosures remain a small fraction of the Enforcement Division's overall filed actions, enforcement trends and proposed rulemaking point toward heightened activity in the space in the years to come.

Most of the agency's enforcement activity to date has focused on regulated entities such as investment advisers and broker-dealers. These entities are subject to specific cybersecurity-related obligations, such as Regulation S-P (Safeguards Rule) and Regulation S-ID (Identity Theft Red Flags Rule). While we look forward to unpacking the