SEC Withdraws Cyber Rules for Investment Companies and Advisers

The recent move by the Securities and Exchange Commission (SEC) to withdraw proposed cybersecurity regulations for investment companies and advisers signals a shift in regulatory policy under the Biden administration. The rules that were pulled back would have mandated these entities to craft written policies addressing cybersecurity risks and report significant incidents to the SEC. Additionally, they would have been required to disclose cyber incidents and risks from the past two fiscal years on a publicly available registration form.

This action is part of a broader trend of deregulation at the SEC under President Donald Trump, where proposed rules on topics like artificial intelligence use and outsourcing have also been dropped. Industry groups have been pushing the SEC to reconsider another rule that mandates swift public disclosure of major cybersecurity incidents, which they view as even more contentious.

The original proposal for these rules in 2022 was championed by then-Chairman Gary Gensler as a crucial safeguard for investment advisers and business development companies. Gensler highlighted the importance of enhancing cybersecurity preparedness to boost investor confidence in the resilience of advisers and funds against cyber threats and attacks.

Following the reopening of the public comment period on the rule in 2023, in light of other regulatory developments, concerns were raised about the potential effects of the rule on cybersecurity risk management and disclosure. High-profile data breaches at companies like Fidelity Investments and Prudential in the previous year were pointed out by advocacy groups as evidence of the pressing need for robust cybersecurity programs.

However, industry groups argued that the rule would have unintended negative consequences. Detailed public disclosures on cyber risks and past incidents could potentially aid hackers in refining their tactics. Furthermore, ongoing incident disclosures outlined in the rule might hinder other regulators from leveraging confidential reports and cautioning potential victims. Compliance with a multitude of cybersecurity regulations could divert attention from actual threats and towards regulatory obligations, ultimately making the financial sector less secure.

Following the SEC’s decision to withdraw the cybersecurity rules, industry voices like Heather Hogsett from the Bank Policy Institute have praised this new approach. She commended the SEC for prioritizing effectiveness over quantity in rulemaking and appreciated the agency’s willingness to reassess what truly works. Focusing cybersecurity experts’ efforts on procedural compliance rather than protecting against real threats can undermine the overall security of the financial system by diverting resources away from combating actual cyber threats.