Three SEC cyber proposals, three audiences, one rule adopted

The week

On March 15, 2023, days after Silicon Valley Bank and Signature Bank failed, the Securities and Exchange Commission proposed three related cybersecurity measures. Proposed Rule 10 would have required broker-dealers, clearing agencies, transfer agents, exchanges and other “market entities” to adopt cybersecurity policies and to notify the SEC promptly of significant incidents. Amendments to Regulation S-P would require broker-dealers, investment companies, registered investment advisers and transfer agents to maintain incident response programs. They would also have to notify affected individuals when sensitive information was, or was reasonably likely to have been, accessed or used without authorization, generally within 30 days. A third proposal would extend Regulation SCI, which governs the systems of key market infrastructure, to more entities, including some large broker-dealers. The SEC’s 2022 cybersecurity proposal for investment advisers was still pending.

Proposing three rules on the same day invited firms to treat them as one compliance program. That made sense for budgeting, but it hid the fact that each proposal answered to a different audience with different expectations. The package is clearest read by audience: obligations owed to the regulator, obligations owed to customers, and obligations owed to the market. Each depends on a different capability, and readiness for one says little about the others.

Obligations to the regulator

Proposed Rule 10 centered on the SEC itself. Market entities would have had to keep written cybersecurity policies, review them annually and give the Commission immediate written notice of a significant cybersecurity incident. A detailed report on a new form would follow. Some entities would also have had to disclose summary information about their cyber risks and incidents publicly.

The capability this demanded was internal judgment under time pressure. A firm had to recognize quickly that an incident was significant and route that judgment to the people responsible for regulatory notice. Many broker-dealers already notified FINRA and other regulators of material events. The proposal’s timing, though, was tighter than most incident response plans assumed.

The work was to define significance criteria in advance, with examples drawn from the firm’s own systems. It meant assigning decision authority to named roles with deputies, and rehearsing the path so legal, compliance and security reached a decision together. A tabletop exercise that times the interval from detection to a documented notice decision is a useful test. Most firms find the bottleneck is not detection but convening the right people and agreeing on facts.

Public disclosure was the second element. Summaries of cyber risk and incidents would have meant that what a firm told the SEC, its customers and investors had to be consistent. That requires a single, controlled record of incident facts, maintained from the first hours of response.

Obligations to customers

The Regulation S-P amendments addressed individuals. The existing rule required written safeguards for customer information but did not require notice after a breach. Notice obligations came instead from state breach laws, which vary in triggers, content and timing. The amendments would set a federal floor for covered firms. Firms would need an incident response program to detect, respond to and recover from unauthorized access. Affected individuals would have to be notified unless the firm determined, after a reasonable investigation, that substantial harm or inconvenience was not reasonably likely.

Two features reached into technology and vendor management. First, firms would need written policies to oversee service providers, including a requirement that providers notify the firm quickly so the firm could meet its own deadline. Second, the definition of covered information was broad and included information about customers of other financial institutions that the firm held. Meeting a 30-day clock requires knowing where customer information sits, including in vendor systems, and being able to identify affected people from logs and data stores.

That is a data management capability more than a security one. Firms need an inventory of systems holding customer information and a map of which service providers receive it. They also need forensic logging good enough to scope an incident to specific records. A firm that can only say “the file share was accessed” will notify everyone, at high cost and with little benefit to customers.

The federal floor would not displace state laws. Firms would still need to track state-specific content and regulator notice rules alongside the federal deadline, ideally in one notification playbook.

Obligations to the market

The Regulation SCI expansion addressed the integrity of market infrastructure. Regulation SCI already covered exchanges, large alternative trading systems, clearing agencies and certain other entities. It required them to maintain systems with adequate capacity, integrity, resilience and security, to test business continuity plans, and to report systems events to the SEC. The proposal would extend coverage to large broker-dealers above certain thresholds and other entities. It also strengthened requirements on third-party providers and on security.

For firms that would have been newly covered, this meant a different style of discipline. SCI entities must classify critical systems, conduct annual reviews and participate in coordinated business continuity testing with other market participants. They must notify the SEC of systems disruptions, not only cyber intrusions. The obligation runs to the market as a whole: the concern is that one firm’s outage degrades price discovery or settlement for everyone. A broker-dealer approaching the thresholds would need to treat order routing and execution systems as market infrastructure, with change management and capacity planning to match.

Technology vendors would have been drawn in as well. SCI entities must ensure that systems operated on their behalf by third parties meet the same standards. That pushes testing, reporting and change-control requirements into contracts with providers that may never have faced them.

Sorting the obligations by audience clarifies ownership. Regulator notice belongs to compliance and legal, with security supplying facts. Customer notice depends on data management and vendor oversight. Market obligations depend on engineering, capacity and continuity planning. A single “SEC cyber rules” project risks giving all three to the same team, which tends to favor whichever capability it already has. It also helps sequencing. Firms could act on the customer obligations early, because state laws already demanded much of the same work, while the other two proposals stayed uncertain.

With hindsight

Only the customer rule was adopted. The SEC finalized the Regulation S-P amendments in May 2024, with a 72-hour deadline for service providers to notify covered firms and a 30-day customer notice requirement. Compliance began in December 2025 for larger entities and June 2026 for smaller ones. Proposed Rule 10, the Regulation SCI expansion and the 2022 adviser cybersecurity proposal were never adopted. On June 12, 2025, the SEC withdrew them along with 11 other pending proposals and said it did not intend to finalize them. Separately, the SEC’s July 2023 disclosure rule for public companies added a Form 8-K item for material cyber incidents, which affected listed financial firms. Regulator and market obligations remain matters of existing rules and examination. The data mapping and vendor oversight that the customer rule requires is where covered firms have spent most of their effort since.