A Closer Look At The SEC's Cybersecurity Rules For Covered Entities And Market Entities

The SEC is continuing its campaign to overhaul cybersecurity, cyber incident reporting, and privacy controls and requirements for financial services industry registrants, their service providers, and corporate America generally. We've already analyzed the proposed changes to Regulation S-Pthat, among other things, seek to implement a notification requirement to individuals affected by data breaches. This alert will focus on the two additional March 2023 cyber proposals:

1. Proposed new Rule 10, new Form SCIR, and related cybersecurity requirements for "Market Entities" that perform critical services to support the fair, orderly, and efficient operations of the US securities markets, including broker-dealers, FINRA, the MSRB, exchanges, TAs, and clearing agencies.