{"id":6244,"date":"2023-03-13T15:17:49","date_gmt":"2023-03-13T15:17:49","guid":{"rendered":"https:\/\/iqeq-staging.j.layershift.co.uk\/?p=6244"},"modified":"2023-08-16T15:14:51","modified_gmt":"2023-08-16T15:14:51","slug":"10-elements-secs-proposed-cybersecurity-rules","status":"publish","type":"post","link":"https:\/\/iqeq.com\/insights\/10-elements-secs-proposed-cybersecurity-rules\/","title":{"rendered":"10 elements of the SEC\u2019s proposed cybersecurity rules"},"content":{"rendered":"
\n
\n

On February 9, 2022, the U.S. Securities and Exchange Commission (SEC) proposed Rule 206(4)-9 under the Investment Advisers Act of 1940 and Rule 38a-2 under the Investment Company Act of 1940. The proposed rules would provide registered investment advisers and funds with a set of rules governing how they address cybersecurity risks.<\/strong><\/p>\n

These rules would build on existing Commission rules and regulations regarding cybersecurity. Regulation S-ID, for instance, sets rules for broker-dealers, investment advisers, investment companies and other financial institutions governing their identity theft prevention programs. Regulation S-P requires many of these same entities to adopt policies and procedures centering around protecting customer records and data.<\/p>\n

The rules cover 10 different elements of cybersecurity protection, including:<\/p>\n

1. Risk assessment<\/h2>\n

The first step for advisers and funds to address any cybersecurity risks is to understand what those risks are.<\/p>\n

Advisers and funds would be tasked with categorizing and prioritizing cybersecurity risks associated with their information systems (and the information within). They\u2019d also have to identify any service providers that receive, maintain or process adviser or fund information, or that otherwise have access to their information systems, and identify any cybersecurity risks associated with their access.<\/p>\n

2. User security and access<\/h2>\n

Advisers and funds would also be tasked with installing controls that would minimize unauthorized access to information systems. These controls would include:<\/p>\n