Key Takeaways
- • The SEC voted on February 9, 2022, to propose the first comprehensive cybersecurity rules for registered investment advisers and private funds, establishing mandatory cybersecurity programs and incident reporting requirements.
- • Advisers must report "significant cybersecurity incidents" within 48 hours of discovery using a new confidential Form ADV-C, with the reporting clock triggered upon a "reasonable basis to conclude" an incident has occurred—not requiring definitive proof.
- • A cybersecurity incident qualifies as "significant" if it either substantially disrupts critical operations or results in unauthorized access to adviser or fund information causing substantial harm to the adviser, clients, funds, or investors.
- • The proposal defines concrete incident triggers, including malware attacks disabling websites or email functions and system breaches impairing business operations or resulting in theft of fund information.
- • These rules represent an unprecedented regulatory expansion into cybersecurity governance for the investment advisory industry, establishing the first SEC rules specifically dedicated to cybersecurity programs and breach reporting protocols.
Summary
On February 9, 2022, the Securities and Exchange Commission voted to propose sweeping cybersecurity rules targeting registered investment advisers and private funds. The proposal marks the first time the SEC has developed rules specifically addressing cybersecurity programs and reporting requirements for advisory firms, representing a significant expansion of regulatory oversight in this domain.
The centerpiece of the proposal is a rapid breach notification requirement mandating that advisers report any "significant cybersecurity incident" within 48 hours of discovery. Rather than waiting for complete certainty, advisers must initiate reporting based on a "reasonable basis to conclude" that a significant incident has occurred or is occurring. This lower threshold reflects the SEC's determination that firms should err on the side of disclosure rather than delay while conducting full investigations.
The rules define "significant cybersecurity incidents" using a dual-trigger standard. An incident qualifies if it either (1) substantially disrupts or degrades an adviser's or fund's ability to maintain critical operations, or (2) results in unauthorized access to adviser or fund information that causes substantial harm to the adviser, its clients, the fund, or investors. The proposal provides explicit examples including malware attacks that disable websites or email functions and system breaches that impede business operations or result in theft of fund information.
Advisers would submit incident reports confidentially using a proposed new Form ADV-C, maintaining the confidential nature of breach disclosures while ensuring regulatory visibility. The framework emphasizes early notification over investigative completeness, acknowledging that attackers often move quickly and that delayed reporting could allow further damage or compromise of client assets and information. This approach reflects the SEC's assessment that the advisory industry faces material cybersecurity risks requiring immediate regulatory intervention.
The centerpiece of the proposal is a rapid breach notification requirement mandating that advisers report any "significant cybersecurity incident" within 48 hours of discovery. Rather than waiting for complete certainty, advisers must initiate reporting based on a "reasonable basis to conclude" that a significant incident has occurred or is occurring. This lower threshold reflects the SEC's determination that firms should err on the side of disclosure rather than delay while conducting full investigations.
The rules define "significant cybersecurity incidents" using a dual-trigger standard. An incident qualifies if it either (1) substantially disrupts or degrades an adviser's or fund's ability to maintain critical operations, or (2) results in unauthorized access to adviser or fund information that causes substantial harm to the adviser, its clients, the fund, or investors. The proposal provides explicit examples including malware attacks that disable websites or email functions and system breaches that impede business operations or result in theft of fund information.
Advisers would submit incident reports confidentially using a proposed new Form ADV-C, maintaining the confidential nature of breach disclosures while ensuring regulatory visibility. The framework emphasizes early notification over investigative completeness, acknowledging that attackers often move quickly and that delayed reporting could allow further damage or compromise of client assets and information. This approach reflects the SEC's assessment that the advisory industry faces material cybersecurity risks requiring immediate regulatory intervention.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.