02.14.22

SEC Proposes Cyber Rules for Investment Funds and Advisers

by: James Rundle

Financial regulators proposed long-awaited cybersecurity rules for investment funds and advisers last week that would require thousands of companies to report cyberattacks within 48 hours. The SEC said funds and registered investment advisers must develop written policies and procedures for dealing with cybersecurity incidents and keep detailed records on them. Significant events should be disclosed to investors and reported to regulators, the agency said. While the SEC has included elements of cyber guidance in other rules—notably Regulation Systems Compliance and Integrity, and its Identity Theft Red Flags Rule, known as Regulation S-ID—this is the first time it has specifically detailed the cybersecurity preparations it expects from advisers and funds. Ken Joseph, who worked as an SEC investigator for 21 years, said the real change in the regulator’s approach is the requirement that advisers report major cyber incidents within 48 hours.

Read the full article on Wall Street Journal