The SEC's Role in Cybersecurity Regulations

The Securities and Exchange Commission (SEC) plays a crucial role in the realm of cybersecurity, particularly in the financial sector. As markets become increasingly global and complex, so too do the threats posed by cyber intrusions, denial of service attacks, manipulation, misuse by insiders, and other forms of cyber misconduct. In the United States, aspects of cybersecurity fall under the responsibilities of multiple government agencies, including the SEC. Cybersecurity is also a responsibility of every market participant, and the SEC is committed to working with federal and local partners, market participants, and others to monitor developments and effectively respond to cyber threats.

Cybersecurity Update: CISA's Recommendations

The Cybersecurity and Infrastructure Security Agency (CISA) recommends all organizations, regardless of size, to adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets. The recommended actions include reducing the likelihood of a damaging cyber intrusion, taking steps to quickly detect a potential intrusion, ensuring that the organization is prepared to respond if an intrusion occurs, and maximizing the organization's resilience to a destructive cyber incident.

SEC's Resources and Guidance

The SEC provides valuable guidance to help broker-dealers, investment advisers, investment companies, exchanges, and other market participants protect their customers from cyber threats. The agency also keeps a watchful eye over market participants, making cybersecurity a priority of its National Exam Program.

The SEC uses its civil law authority to bring cyber-related enforcement actions that protect investors, hold bad actors accountable, and deter future wrongdoing. The Division of Enforcement’s Cyber Unit, established in September 2017, has substantial cyber-related expertise. The Cyber Unit focuses on violations involving digital assets, initial coin offerings and cryptocurrencies; cybersecurity controls at regulated entities; issuer disclosures of cybersecurity incidents and risks; trading on the basis of hacked nonpublic information; and cyber-related manipulations, such as brokerage account takeovers and market manipulations using electronic and social media platforms.

SEC's Role in Investor Protection

Investors increasingly rely on the internet to open investment accounts, check up on their holdings, and make securities transactions. The SEC provides valuable guidance, including an Investor Alert and Investor Bulletin, to help investors protect themselves from cyber threats.

Conclusion

The SEC plays a pivotal role in the cybersecurity landscape, particularly in the financial sector. Through its guidance, oversight, and enforcement actions, the SEC helps protect investors and market participants from cyber threats. As cyber threats continue to evolve, the SEC's role in cybersecurity will remain critical.