Key Takeaways
- • The SEC released proposed cybersecurity rules on February 9, 2022, establishing mandatory cybersecurity risk management, incident reporting, and disclosure standards for registered investment advisers and funds—the most detailed cybersecurity ruleset Chair Gensler's SEC has issued to date.
- • Proposed rules require advisers and funds to adopt "reasonably designed" policies addressing risk assessment, user security and access controls, prevention of unauthorized fund access, threat and vulnerability management, and incident response and recovery procedures.
- • SEC cybersecurity requirements align broadly with New York's Part 500 Cybersecurity Regulation and the Federal Trade Commission's updated Safeguards Rule, creating consistency across regulatory jurisdictions.
- • Chair Gensler has prioritized cybersecurity rulemaking as a core regulatory objective, signaling the SEC's intent to deploy full regulatory authority to establish cybersecurity hygiene standards across the investment management industry.
Summary
On February 9, 2022, the SEC released proposed rules addressing cybersecurity risk management, incident reporting, and disclosure obligations for registered investment advisers and funds. The proposals represent Chair Gary Gensler's most comprehensive cybersecurity rulemaking effort to date and reflect the agency's heightened focus on systemic cyber risk within the investment management sector.
Chair Gensler has positioned cybersecurity rulemaking as a regulatory priority and emphasized the establishment of baseline cybersecurity hygiene standards and mandatory incident reporting protocols for all registrants. The proposed rules demonstrate the SEC's willingness to exercise its full regulatory authority to address what the agency views as material risks to market integrity and investor protection.
The proposed rules impose significant operational requirements on investment advisers and funds. Under the framework, registrants must adopt and implement cybersecurity risk management policies and procedures that are "reasonably designed" to mitigate cyber threats. Key policy elements include documented risk assessment practices, user security protocols and access controls, mechanisms to prevent unauthorized access to client funds, systematic threat and vulnerability management processes, and comprehensive incident response and recovery capabilities.
The SEC's approach reflects regulatory alignment across jurisdictions. The proposed federal rules are generally consistent with New York's Part 500 Cybersecurity Regulation and the FTC's updated Safeguards Rule, reducing compliance fragmentation for multi-jurisdictional firms. This convergence signals coordinated regulatory strategy around cybersecurity standards in the financial services industry, establishing enforceable baseline expectations for institutional asset managers and advisers.
Chair Gensler has positioned cybersecurity rulemaking as a regulatory priority and emphasized the establishment of baseline cybersecurity hygiene standards and mandatory incident reporting protocols for all registrants. The proposed rules demonstrate the SEC's willingness to exercise its full regulatory authority to address what the agency views as material risks to market integrity and investor protection.
The proposed rules impose significant operational requirements on investment advisers and funds. Under the framework, registrants must adopt and implement cybersecurity risk management policies and procedures that are "reasonably designed" to mitigate cyber threats. Key policy elements include documented risk assessment practices, user security protocols and access controls, mechanisms to prevent unauthorized access to client funds, systematic threat and vulnerability management processes, and comprehensive incident response and recovery capabilities.
The SEC's approach reflects regulatory alignment across jurisdictions. The proposed federal rules are generally consistent with New York's Part 500 Cybersecurity Regulation and the FTC's updated Safeguards Rule, reducing compliance fragmentation for multi-jurisdictional firms. This convergence signals coordinated regulatory strategy around cybersecurity standards in the financial services industry, establishing enforceable baseline expectations for institutional asset managers and advisers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.