Three SEC cyber proposals, three audiences, one rule adopted

The week

The week after Silicon Valley Bank and Signature Bank failed, the financial world was watching deposit flows and emergency lending. Almost nobody outside compliance departments noticed what the Securities and Exchange Commission did on March 15, 2023. It proposed three related cybersecurity measures in a single day, each of which could have reshaped how securities firms handle a hacking incident.

The banking news did not let up while the Commission met. On the same day, Credit Suisse’s shares fell sharply, and early the next morning it said it would borrow from the Swiss National Bank. On March 16, eleven large US banks deposited $30 billion with First Republic Bank. By the next weekend, Swiss authorities had arranged for UBS to take over Credit Suisse. Cybersecurity rulemaking was nowhere near the front pages.

The SEC is the federal agency that oversees the securities markets: stock exchanges, the firms that buy and sell securities for clients, investment funds and investment advisers. A cybersecurity incident, in its language, covers anything from a hacker breaking into a network to criminals stealing customer data.

The SEC already had rules touching cybersecurity, though none built around incident response. Regulation S-P, adopted in 2000 under the Gramm-Leach-Bliley Act, required written safeguards for customer records. Regulation S-ID, adopted jointly with the CFTC in 2013, required identity theft red-flag programs. Regulation SCI, adopted in 2014, governed the core systems of exchanges and clearing agencies. Enforcement under Regulation S-P had picked up. In 2021 the SEC sanctioned several firms whose employees’ email accounts were taken over. In 2022 it imposed a $35 million penalty on Morgan Stanley Smith Barney over the disposal of devices holding customer data.

The first measure, Proposed Rule 10, would have required broker-dealers, clearing agencies, transfer agents, exchanges and other “market entities” to adopt cybersecurity policies and to notify the SEC promptly of significant incidents. Notice would come first as an immediate written electronic alert, followed within 48 hours by a detailed report on a new form, Form SCIR. A broker-dealer buys and sells securities for clients. A clearing agency makes sure trades actually settle, with money and securities changing hands. A transfer agent keeps the official record of who owns a company’s shares.

The second measure amended Regulation S-P, the SEC’s long-standing rule on protecting customer information. It would require broker-dealers, investment companies, registered investment advisers and transfer agents to maintain incident response programs, meaning a planned, practiced way of detecting and handling a breach. They would also have to notify affected individuals when sensitive information was, or was reasonably likely to have been, accessed or used without authorization, generally within 30 days. The proposal would also bring transfer agents under the rule for the first time, and it would require service providers to tell a covered firm about a breach within 48 hours.

The third proposal would extend Regulation SCI, which governs the systems of key market infrastructure, to more entities, including some large broker-dealers. SCI stands for Systems Compliance and Integrity, and it covers the technology that keeps markets running. The proposal would add broker-dealers above thresholds based on total assets or on their share of trading volume in certain securities, including US Treasury securities. It would also tighten requirements on third-party providers such as cloud services and on security testing.

All of this arrived while an earlier proposal, the SEC’s 2022 cybersecurity proposal for investment advisers, was still pending. The SEC reopened the comment period on that proposal the same day, so that commenters could consider all the measures together. A separate proposal on cybersecurity disclosure by public companies, issued in March 2022, was also still awaiting a final vote. For a chief executive or general counsel at a securities firm, it was a lot to take in during a week when the banking system itself seemed shaky. Each release was long and technical, and each opened its own comment period. For compliance teams, that meant three sets of comment letters and three gap analyses at once. Firms with bank affiliates already lived under a separate federal rule, in force since 2022, requiring banking organizations to notify their primary regulator of serious computer-security incidents within 36 hours. It was also easy to file all three under one heading and move on. That turned out to be a mistake, because the three proposals had different owners and different clocks.

Proposing three rules on the same day invited firms to treat them as one compliance program. That made sense for budgeting: one project, one budget line, one steering committee. But it hid the fact that each proposal answered to a different audience with different expectations.

The package is clearest read by audience. There were obligations owed to the regulator, obligations owed to customers, and obligations owed to the market. Each depends on a different capability inside a firm, and readiness for one says little about the others. A firm can be excellent at telling the SEC about a problem and still be unable to tell which customers were affected. It can have superb customer data maps and still have trading systems that would buckle under stress.

The proposals also reached different sets of firms, which made the audience split sharper. An SEC-registered investment adviser that is not also a broker-dealer would have been covered by the customer rule but not by Proposed Rule 10. A large broker-dealer could have been caught by all three. A bank holding company with a broker-dealer subsidiary would add the banking rules on top. Each kind of firm needed its own map of which obligations applied.

This article takes the three audiences in turn: first the regulator, then customers, then the market. It then runs a single incident through all three and closes with how ownership should be divided.

Information, function and three kinds of worry

A securities firm holds two things that criminals want and that the public depends on. The first is information: names, account numbers, Social Security numbers and investment details for thousands or millions of customers. The second is function: the ability to take orders, execute trades and settle them so that money and shares end up in the right place. A breach can steal the first. An outage, whether caused by an attack or a technical failure, can halt the second.

A single incident can hit both. Modern ransomware groups commonly steal data before they encrypt systems, then threaten to publish it. One intrusion then produces a data exposure, which concerns customers, and an outage, which concerns the market, while also triggering the question of what to tell the regulator. The categories describe obligations, and one event can set off several of them.

Regulators worry about each of these from a different angle. The SEC itself wants to know quickly when something serious happens, so it can assess whether the problem might spread. Customers want to know when their personal information has been exposed, so they can protect themselves. And the market as a whole needs critical firms to keep working, because one firm’s failure can disrupt trading for everyone.

A hospital faces the same split. It has obligations to its licensing authority, which wants to be told of serious incidents. It has obligations to patients, who must be told if their records are breached. And it has obligations to the community, which relies on its emergency room staying open. Those are three different promises, owned by different people, and being good at one does not guarantee the others.

Which firms each proposal reached

Proposed Rule 10 covered “market entities”: broker-dealers, clearing agencies, transfer agents, national securities exchanges, FINRA, the Municipal Securities Rulemaking Board, security-based swap dealers and related entities. Smaller broker-dealers would have faced lighter requirements than larger ones. Investment advisers and funds were left to the separate 2022 adviser proposal.

The Regulation S-P amendments covered broker-dealers, investment companies, SEC-registered investment advisers, funding portals and, newly, transfer agents. That made it the widest of the three. It reached thousands of small advisory firms that would never be market infrastructure and that had little reason to follow the other two proposals.

The Regulation SCI expansion was the narrowest. It would have reached only firms whose size or trading share made their outage a market event, plus a few categories of infrastructure not yet covered. Most firms could read it once, confirm they were below the thresholds and set it aside, while keeping an eye on the vendors and venues they depend on.

A few common firm types show how this sorted out. A ten-person wealth manager registered with the SEC faced the customer rule and the pending adviser rule. A regional broker-dealer that introduces trades to a clearing firm faced Rule 10 and the customer rule. A broker-dealer active enough in Treasuries to cross the SCI thresholds faced all three. A broker-dealer owned by a bank also had to fit the new clocks alongside the banking ones.

Obligations to the regulator

Proposed Rule 10 centered on the SEC itself. Market entities would have had to keep written cybersecurity policies, review them annually and give the Commission immediate written notice of a significant cybersecurity incident. A detailed report on a new form would follow. Some entities would also have had to disclose summary information about their cyber risks and incidents publicly.

The capability this demanded was internal judgment under time pressure. When a security team spots unusual activity, it rarely knows at first whether it is a minor nuisance or a serious breach. A firm had to recognize quickly that an incident was significant and route that judgment to the people responsible for regulatory notice.

Many broker-dealers already notified FINRA and other regulators of material events. FINRA, the Financial Industry Regulatory Authority, is the industry’s self-regulatory body, which oversees broker-dealers under the SEC’s supervision. So the habit of reporting existed. The proposal’s timing, though, was tighter than most incident response plans assumed.

How the notice would have worked

The trigger matters as much as the deadline. Under the proposal, the clock started when a firm had a reasonable basis to conclude that a significant incident had occurred or was occurring. That standard does not wait for a full investigation. A firm would need to document when it reached that point, because an examiner could later compare that moment with the timestamps in its own logs.

The design layered three disclosures. An immediate alert told the SEC something serious was happening. A confidential report on Form SCIR followed, with updates as facts changed. A public summary of cyber risks and significant incidents in the past year completed the set, and some entities would also have given it to customers.

Other clocks already existed for some firms. Banking organizations had 36 hours to tell their primary federal regulator about notification incidents. Firms licensed by the New York Department of Financial Services had 72 hours under its cybersecurity regulation. FINRA Rule 4370 required member firms to keep business continuity plans. A firm with several of these obligations needed one decision process able to feed several clocks.

The case against fast notice

The proposal drew a serious objection. Early in an incident, the people who know most are also the people most needed to contain it. Pulling them into notice drafting can slow the response. Public disclosure of incidents can also tell attackers which firms are weak, and a confidential regulatory report can be hard to keep consistent with facts that change hourly.

The objection has force, and it argues for preparation more than for delay. A firm that has pre-agreed criteria, a template notice and a named decision-maker spends minutes on the notice decision rather than hours. Most of the burden falls on firms that have not done that work in advance.

Different starting points

Firms came to Rule 10 from very different places. Exchanges and clearing agencies were already SCI entities, used to reporting systems events to the SEC within tight windows. Large broker-dealers had mature security operations centers and legal teams that had handled incidents before. Small introducing broker-dealers often relied on their clearing firm and a managed service provider for much of their technology, so their first task was to find out what those providers would tell them, and how fast.

Transfer agents started furthest back. Their SEC rules had focused on recordkeeping and processing, and many were small firms with lean technology teams. For them, written policies, annual reviews and a 48-hour report would have been a new discipline. That gap helps explain why both Rule 10 and the customer rule reached into transfer agents at the same time.

What an examiner would ask to see

Examiners test notice processes after the fact, using documents. They would expect written significance criteria, the names of the people authorized to decide, and records of tabletop exercises with their timings. They would also want incident files showing when the firm reached a reasonable basis to conclude and when it notified. A firm that cannot reconstruct its own timeline will struggle to show that it met any deadline.

Deciding fast, and deciding together

The work was to define significance criteria in advance, with examples drawn from the firm’s own systems. “Significant” is a vague word until someone writes down what it means in practice: for example, an intrusion into the order management system, or ransomware on any server that holds client records. Ransomware is malicious software that locks up an organization’s files and demands payment to unlock them.

It also meant assigning decision authority to named roles with deputies, so the decision does not stall because one person is on a plane. And it meant rehearsing the path so legal, compliance and security reached a decision together.

A tabletop exercise is a useful test. This is a structured rehearsal in which the relevant people sit around a table, are walked through a realistic scenario, and talk through what they would do. A good one times the interval from detection to a documented notice decision. Most firms find the bottleneck lies less in detection than in convening the right people and agreeing on facts. The security team knows something is wrong within minutes. Getting the general counsel, the chief compliance officer and the head of technology into the same conversation, with the same understanding of what happened, can take far longer.

Tabletop scenarios work best when they are specific to the firm. A ransomware event that encrypts the back office, a compromised vendor account used to reach client records, and an outage at the clearing firm are three different exercises. Each tests a different notice decision and a different set of people.

One version of the truth

Public disclosure was the second element. Summaries of cyber risk and incidents would have meant that what a firm told the SEC, its customers and investors had to be consistent. If the regulator hears one account, customers another and the public a third, the firm has created a credibility problem on top of a security one.

That requires a single, controlled record of incident facts, maintained from the first hours of response. In practice, this is a shared log, owned by a named person, that records what is known, when it was learned and how confident the team is. Every external statement draws from it.

The record has a legal dimension that firms should settle in advance. Many firms run forensic investigations through outside counsel in the hope of protecting the work as privileged. Courts have not always agreed. In the Capital One breach litigation in 2020, a federal court held that a forensic firm’s report was not protected, partly because the company used it for business purposes. A shared factual log and a privileged legal analysis can coexist, but the boundary between them should be set before an incident, with counsel.

Obligations to customers

The Regulation S-P amendments addressed individuals. The existing rule required written safeguards for customer information but did not require notice after a breach. Notice obligations came instead from state breach laws, which vary in triggers, content and timing. Every US state has its own law about when and how people must be told of a data breach, and they do not line up neatly.

The amendments would set a federal floor for covered firms, a minimum standard that applies everywhere. Firms would need an incident response program to detect, respond to and recover from unauthorized access. Affected individuals would have to be notified unless the firm determined, after a reasonable investigation, that substantial harm or inconvenience was not reasonably likely.

How the assessment would work

The default ran toward notice. A firm that detected unauthorized access to “sensitive customer information” had to notify affected people unless an investigation showed harm was not reasonably likely. Sensitive customer information meant data whose compromise could create a reasonably likely risk of substantial harm or inconvenience. Examples included Social Security numbers and account numbers combined with access codes or passwords.

A notice would need to describe the incident, the kind of information involved, the approximate date and how affected people could get help. The firm also had to keep records of its investigation and its decision. If it concluded that notice was not required, the file would need to show why. Examiners can test a no-notice decision long after the event, so the reasoning had to survive scrutiny without the context of the moment.

Vendors and other people’s customers

Two features reached into technology and vendor management. First, firms would need written policies to oversee service providers, including a requirement that providers notify the firm quickly so the firm could meet its own deadline. Most firms rely on outside companies for everything from customer statements to cloud hosting to account opening software. If one of those vendors is breached and takes weeks to say so, the firm’s own 30-day clock may already be nearly gone.

Second, the definition of covered information was broad and included information about customers of other financial institutions that the firm held. A transfer agent or a clearing firm may hold records on people who are not its direct customers at all, and those records would count too.

Introducing firms, clearing firms and custodians

That clause mattered most where one firm holds data for another. Many smaller broker-dealers introduce their customers’ accounts to a clearing firm, which keeps the books, sends statements and holds the assets. Many investment advisers keep client assets with a third-party custodian. In both models, the most complete copy of customer data often lives with a firm that the customer did not choose directly.

A breach at a clearing firm or custodian could therefore touch the customers of dozens or hundreds of firms at once. The proposal would have put duties on both sides. The clearing firm or custodian had to handle information about customers of other institutions. The introducing firm or adviser had to oversee its service provider and receive timely notice. Contracts had to say who notifies whom, using which customer contact details and in whose name.

Knowing where the data lives

Meeting a 30-day clock requires knowing where customer information sits, including in vendor systems, and being able to identify affected people from logs and data stores. Logs are the automatic records computer systems keep of who accessed what, and when.

That is a data management capability more than a security one. Firms need an inventory of systems holding customer information and a map of which service providers receive it. They also need forensic logging good enough to scope an incident to specific records. Forensic here means detailed enough to reconstruct what happened after the fact.

Logging has a cost that should be planned. Detailed access logs for file shares, databases and software-as-a-service platforms take storage and licensing. Some cloud services keep detailed audit logs only at higher subscription tiers or for limited periods. Retention must cover the time it takes to discover an intrusion, which is often weeks. A firm that keeps logs for seven days will often find that the evidence it needs has already expired.

Suppose an attacker gets into a shared drive used by a wealth management firm’s operations team. If the firm’s logs show exactly which files were opened, and its data inventory shows which customers appear in those files, it can notify the 400 people genuinely at risk. A firm that can only say “the file share was accessed” will notify everyone, at high cost and with little benefit to customers. Mass notifications are expensive to send, alarm people who were never exposed and dilute the warning for those who were.

The federal floor would not displace state laws. Firms would still need to track state-specific content and regulator notice rules alongside the federal deadline. The best vehicle is one notification playbook: a single, pre-written guide that tells the team which notices go to whom, with what content, by when.

State laws differ in ways that matter operationally. Some require notice only when harm is likely, while others presume notice after unauthorized acquisition. Several require a copy of the notice or a report to the state attorney general when the number of affected residents passes a threshold. Content requirements differ too. A firm with customers in every state needs these rules in a maintained table, not in a lawyer’s memory.

Trade-offs in the customer clock

A 30-day federal deadline helps customers, but it creates choices. Notifying early, with incomplete facts, risks a second notice that corrects the first. Notifying late, with complete facts, risks missing the deadline. Firms needed a decision rule for each case. Where should the firm draw the line between a confirmed exposure and a possible one, and when does a precautionary notice serve customers better than silence?

Smaller advisers felt the cost most. A firm with a few dozen staff rarely has in-house forensic capability. It depends on its custodian, its CRM provider, its email provider and an outside incident response firm. For such a firm, the practical work is contractual: notice terms with every provider that holds client data, and a response firm on retainer before anything happens.

Obligations to the market

The Regulation SCI expansion addressed the integrity of market infrastructure. Regulation SCI already covered exchanges, large alternative trading systems, clearing agencies and certain other entities. An alternative trading system is a trading venue that is not a formal exchange but still matches buyers and sellers of securities.

The rule required them to maintain systems with adequate capacity, integrity, resilience and security, to test business continuity plans, and to report systems events to the SEC. A business continuity plan is the playbook for keeping critical operations running, or restoring them fast, when something goes wrong. The proposal would extend coverage to large broker-dealers above certain thresholds and other entities. It also strengthened requirements on third-party providers and on security.

Why broker-dealers were proposed for SCI

The rationale was concentration. A small number of broker-dealers account for a large share of trading in equities and in Treasuries. If one of them stops functioning, counterparties cannot confirm or settle trades, and liquidity in that market can thin out quickly. The SEC’s argument was that firms of that scale perform an infrastructure function, whatever their legal form.

Regulation SCI defines three kinds of events: systems disruptions, systems compliance issues and systems intrusions. When responsible staff have a reasonable basis to conclude that one has occurred, the entity must notify the SEC immediately and follow with a written notice within 24 hours, then updates. That reporting regime is broader than cyber incident reporting, because it treats a software failure and an attack the same way.

Opponents argued that the rule was built for exchanges and clearing agencies with a few central systems, and that broker-dealers run many interconnected systems serving different businesses. Applying SCI to all of them could have been expensive without improving resilience in the systems that matter. Because the proposal was never adopted, that question of fit was never settled.

A different style of discipline

For firms that would have been newly covered, this meant a different style of discipline. SCI entities must classify critical systems, conduct annual reviews and participate in coordinated business continuity testing with other market participants. Those industry-wide tests involve many firms switching to backup systems together to prove the market as a whole can keep running.

They must notify the SEC of systems disruptions as well as cyber intrusions. A software update that crashes the trading platform counts just as much as a hacker. The obligation runs to the market as a whole: the concern is that one firm’s outage degrades price discovery or settlement for everyone. Price discovery is the process by which buying and selling establishes what a security is worth. If a large firm’s systems go dark, that process can be distorted for all participants.

A broker-dealer approaching the thresholds would need to treat order routing and execution systems as market infrastructure, with change management and capacity planning to match. Order routing is the technology that sends client orders to the venues where they are executed. Change management is the formal process for approving and testing changes to systems before they go live. Capacity planning means making sure systems can handle peak volumes, such as a sudden market sell-off, as well as on an ordinary Tuesday.

What newly covered firms would have had to build

Regulation SCI sets concrete expectations. Business continuity and disaster recovery plans must be designed to resume critical SCI systems within two hours of a wide-scale disruption, and other SCI systems by the next business day. Backup sites must be geographically diverse. Entities must run an annual SCI review, including penetration testing, and submit the resulting report to senior management and to the SEC. Most broker-dealers already had continuity plans under FINRA rules, but plans written to that standard were not usually designed to meet a two-hour goal.

Vendors inherit the standard

Technology vendors would have been drawn in as well. SCI entities must ensure that systems operated on their behalf by third parties meet the same standards. That pushes testing, reporting and change-control requirements into contracts with providers that may never have faced them. A vendor used to updating its software whenever it liked would suddenly need to follow its client’s approval process and support its continuity tests.

The proposal also addressed cloud dependence directly. It would have required SCI entities to manage the risk of third-party providers, including cloud services, with a program covering due diligence, contract terms, monitoring and exit planning. A cloud provider typically offers standard terms to all customers. A single broker-dealer has little bargaining power to change them, so firms would have needed to show how they compensated for terms they could not negotiate.

One incident, three clocks

The three obligations can pull in different directions during a single event. Say a mid-sized broker-dealer’s security team, at 9:40 a.m. on an ordinary Tuesday, notices that an outside party has gained access to a server used by the operations group. By 10:15 the team suspects the same intruder has tried to reach the system that routes client orders.

Three separate questions now start running at once. For the regulator, someone must decide whether this is significant enough to report, and that decision needs legal, compliance and security in the same conversation. For customers, someone must work out whether the operations server held personal information, whose it was, and whether it was actually viewed or copied. The answer depends on the quality of the firm’s data inventory and its logs. For the market, someone must decide whether order routing is safe to keep running, or whether to switch to backup arrangements, which is an engineering and continuity call.

A firm with a bank parent adds more clocks to the same morning. The bank’s 36-hour rule may apply if the incident affects the bank’s operations. A New York license may bring a 72-hour notice to the Department of Financial Services. If the parent is listed, the public company rule adopted in July 2023 later required a Form 8-K within four business days after the company determines an incident is material. State breach laws apply to customer data regardless of federal rules.

If one person or team owns all three, the questions get answered in the order that team finds most comfortable. A security-led team may spend the first day chasing the intruder while the customer clock ticks unnoticed in the background. A compliance-led team may draft a careful regulatory notice while nobody checks whether the trading platform should stay up.

The better version is three parallel tracks feeding one shared record of facts. Each track has a named owner and a deadline. Each draws on the same timeline of what was found and when. And the chief executive receives one briefing that covers all three, rather than three briefings that may not agree.

The tracks also need a rule for conflict. Suppose the market track wants to keep order routing up while the investigation track wants to isolate the server it connects to. Someone must decide, and the decision should be documented in the shared record with its reasons. A firm that has named that arbiter in advance avoids a standoff at the worst moment.

The clocks also run on different timescales. The regulator track works in hours, the market track in minutes, and the customer track in days to weeks. A sensible hypothetical timeline might see a notice decision on the first day, a trading decision within the first hour, and scoping of affected customers over the following two weeks. The shared record keeps each track honest about what the others have learned.

Who should own what

Sorting the obligations by audience clarifies ownership. Regulator notice belongs to compliance and legal, with security supplying facts. Customer notice depends on data management and vendor oversight. Market obligations depend on engineering, capacity and continuity planning.

A single “SEC cyber rules” project risks giving all three to the same team, which tends to favor whichever capability it already has. If the project rests with the security team, it will likely produce excellent detection tools and a weak data inventory. If it falls to compliance, it will produce careful policies and an untested trading platform. Each team is doing good work, but in its own lane.

The case for a single program

There is a serious argument for one program. Shared tooling, one budget and one steering committee reduce duplication. Three separate tracks can leave gaps between them. A vendor contract, for example, may need breach notice terms for the customer track and change control terms for the market track, and nobody may negotiate both at once.

The answer is to separate accountability from coordination. A single program office can own the budget, the tooling and the calendar. Three named owners remain accountable for the three audiences. The program office checks for gaps, such as vendor contracts that serve one track and not another.

Ownership in small and large firms

Firm size changes how this looks. In a large broker-dealer, the three owners are different executives with their own teams. In a ten-person advisory firm, the chief compliance officer may hold all three, and the firm will not have SCI obligations at all. There, the split is a matter of the written plan: separate checklists and deadlines for the regulator and for clients, plus a list of outside providers to call.

Mid-sized firms are hardest. They have enough systems to need real engineering ownership, but often a compliance team of one or two people. For them, outsourcing parts of the response, such as forensics and notification mailing, is usually more realistic than building those skills in house.

Sorting by audience also helps sequencing. Firms could act on the customer obligations early, because state laws already demanded much of the same work, while the other two proposals stayed uncertain. Building a data inventory and tightening vendor notification terms was valuable whatever happened to the other rules.

Three owners and one record

The better-prepared firms had three named owners, one for each audience, each with a clear deadline and decision path. They avoided a single “cyber compliance” workstream in which the strongest team’s priorities crowded out the rest. They had written significance criteria with concrete examples from their own systems and ran a timed tabletop at least once a year, rehearsing the decision to notify as well as the detection. A single incident record, owned by one person, fed every external statement.

They kept a current inventory of systems and vendors holding customer information, with logs detailed enough to identify affected individuals. Logs that prove a system was breached but cannot show which records were touched leave a firm notifying everyone. Their vendor contracts required prompt breach notice, rather than assuming vendors would volunteer it, and for critical systems, participation in testing and change control. And they did not wait for final rules before starting work that state laws already required.

They also kept evidence that examiners could test. That meant dated tabletop records with timings and follow-up actions, a current data and vendor inventory with owners, vendor contracts showing notice terms, and incident files showing how each notice decision was made. Those records serve every audience at once, which is why they are worth keeping even where a proposal never becomes a rule.

Owners, rehearsal times and vendor deadlines to pin down

1. Who owns our notice to regulators, who owns notice to customers, and who owns keeping our critical systems running, and are those three different people?
2. In our last rehearsal, how long did it take from first detection to a documented decision about notifying regulators, and what slowed it down?
3. If one of our systems holding customer information were breached, could we identify exactly which customers were affected, or would we have to notify everyone?
4. How quickly are our vendors contractually required to tell us about a breach on their side?
5. Which of our systems would we consider market-critical, and are they managed with the change control and capacity planning that implies?

With hindsight

In the end, only the customer rule was adopted. The SEC finalized the Regulation S-P amendments in May 2024, with a 72-hour deadline for service providers to notify covered firms and a 30-day customer notice requirement. Compliance began in December 2025 for larger entities and June 2026 for smaller ones.

The final rule kept the proposal’s structure but adjusted details. Service providers got 72 hours rather than the proposed 48 to notify covered firms. Transfer agents stayed in scope. The 30-day customer deadline survived, with a possible delay if the US Attorney General determined that notice would pose a substantial risk to national security or public safety. For most advisers and broker-dealers, the practical work turned into contract renegotiation with service providers and a data inventory good enough to scope a breach.

The other proposals faded. Proposed Rule 10, the Regulation SCI expansion and the 2022 adviser cybersecurity proposal were never adopted. On June 12, 2025, the SEC withdrew them along with 11 other pending proposals and said it did not intend to finalize them. Any future action in those areas would require a new proposal. Any work aimed specifically at the details of those proposals was, in the end, aimed at rules that never arrived.

Events tested the market obligation anyway. In November 2023, a ransomware attack on the US broker-dealer arm of Industrial and Commercial Bank of China disrupted its ability to settle US Treasury trades for some market participants. A single firm’s incident briefly affected one of the world’s most important markets, which was the scenario the SCI expansion had in mind. In July 2024, a faulty CrowdStrike software update crashed Windows systems around the world, including at banks and brokerages. It showed that a technical failure, not an attack, could produce the same kind of disruption.

The customer obligation was also tested before the rule took effect. Beginning in late May 2023, a criminal group exploited a flaw in the MOVEit Transfer file-sharing product. Many financial firms learned their customers’ data had been taken from vendors they used, sometimes several steps removed. That episode made the service-provider notice terms in the final rule look less like paperwork and more like a necessity.

Separately, the SEC’s July 2023 disclosure rule for public companies added a Form 8-K item for material cyber incidents, which affected listed financial firms. A Form 8-K is the filing a public company uses to tell investors about major events between its regular reports. So for listed firms, the question of what to say publicly about a serious incident, and how quickly, came back by a different route. The rule took effect in December 2023, with the 8-K due within four business days after a company determines an incident is material. In May 2024 the SEC’s corporate finance staff clarified that companies disclosing incidents not yet judged material should use a different 8-K item, keeping Item 1.05 for material incidents.

Regulator and market obligations remain matters of existing rules and examination. That means they are enforced through rules already on the books and through the SEC’s and FINRA’s routine inspections of firms, rather than through new, specific mandates. The expectation that firms can make a fast, well-founded decision about a serious incident has not gone away; it lives in older rules. Other regulators kept tightening their own clocks. New York’s Department of Financial Services amended its cybersecurity regulation in November 2023, and CISA proposed its rule under the Cyber Incident Reporting for Critical Infrastructure Act in April 2024.

The data mapping and vendor oversight that the customer rule requires is where covered firms have spent most of their effort since. That bears out the value of sorting by audience. A firm that had separated the customer work from the rest, and started it early because state laws already demanded much of it, would have had a head start when the final rule arrived. More broadly, a cluster of proposals on one day is not one project, and the parts most likely to survive are often the ones closest to protecting ordinary people.