According to the head of the Securities and Exchange Commission (SEC), the US securities regulator is considering expanding cyber risk management regulations to third-party service providers and beefing up public business disclosures when there is a breach.
In a speech to securities industry professionals, Gary Gensler outlined a comprehensive overhaul of SEC cyber rules, including changes to how stock exchanges and clearinghouses mitigate and report on cyber risk under the regulation “systems compliance and integrity” (SCI), with the goal of reducing system issues and improving resilience.
According to Gensler, the new cyber security standards might apply to registered businesses’ third-party service providers, including as fund administrators, index providers, custodians, and others who are not currently registered with the SEC.
These proposed laws might include steps such as mandating some registrants to identify service providers who may pose such risks, holding registrants liable for service providers’ cyber security measures, and safeguarding against inappropriate access and investor information.
“As financial industry registrants increasingly rely on outsourced services, this might assist guarantee vital investor safeguards are not lost and key services are not interrupted,” Gensler said.
The government may also amend the regulations governing how corporations report cyber security measures and cyber risk, such as how they must alert investors when cyber incidents occur. According to analysts, Gensler’s blueprint comes at a time when there is rising worry about how cyber security vulnerabilities may harm markets and investors.
Following a recent spate of high-profile cyber assaults on US-based corporations, US President Joe Biden’s government has also increased its emphasis on the problem.
