In its recent Cybersecurity Conference, FINRA shared how its Cybersecurity Specialist Team has been handling an increasing number of cyber incidents. In 2019, there were approximately 20 attacks, while 2021 saw 200. That's a 900% increase in attacks in just two years — possibly due to the following:

• Increased trading volume
• Increased number of imposter websites
• More ransomware infections
• Greater number of customer and firm account takeovers
• More digital currency/asset fraud schemes

This year, the SEC proposed cybersecurity risk rules for registered investment advisers and registered investment companies. The rules were prescriptive, detailed, and included disclosures that need to be made on SEC registration forms (e.g., Form ADV, Registration Statement) as well as additional governance requirements. This suggests that securities regulators are cyber-ready and cyber-focused — perhaps to an extreme.

In a dissenting opinion, SEC Commissioner Hester Peirce writes:

"We have an important role to play in ensuring that investors get the information they need to understand issuers' cybersecurity risks if they are material. This proposal, however, flirts with casting us as the nation’s cybersecurity command center, a role Congress did not give us."

"Some argued that these rules were perhaps overly prescriptive," notes Melissa MacGregor, AGC and Managing Director from SIFMA. "The rules seemed to take a more one-size-fits-all approach. Form ADV amendments are challenging for firms, and obviously there's always risk there, so we don't necessarily think that the commission is perhaps the best body for collecting cyber incident disclosures."

Further, public companies would have to report material cybersecurity incidents no later than four business days after they occur. Completing these disclosures may take focus away from mitigating the actual incident that's occurring.

While investors must comply with various rules that may have implications for their cybersecurity practices (e.g., books-and-records, compliance), the proposal builds upon those requirements by requiring:

• Investment advisers and funds to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks and incidents
• Related recordkeeping obligations for advisers and funds
• Confidential reporting to the Commission by investment advisers if the adviser (or a fund they advise) is subject to certain cybersecurity incidents
• Disclosure by advisers on brochures and registered funds on registration statements regarding certain cybersecurity incidents

"But overall, the securities industry is very cyber ready," says MacGregor. "We conduct tests. We certainly have had rules in place for a very long time that apply, since Gramm-Leach-Bliley was adopted. So, this is not a new area for us."