SEC Delays Enactment of Cyber Rules Related to Investment Adviser and Public Companies to October 2023, Updates Timeline to April 2024 for Recently Proposed Cybersecurity Rules

On June 13, 2023, the Office of Management and Budget released its Spring 2023 Unified Agenda of Regulatory and Deregulatory Actions, which includes updates on Securities and Exchange Commission (“SEC”) proposed rules.  The SEC pushed back  its estimate for the final action date to October 2023 for its proposed cybersecurity rules related to public companies, as well as for its investment advisers and funds proposal.  Notably, the SEC’s timelines are typically estimates for implementation, and the proposed rules could be introduced sooner or later than these dates. However, the updated timeline indicates that the SEC is prioritizing finalizing its cybersecurity rules related to public companies and investment advisers and funds.

The agenda sets out the following timelines for SEC proposed rules:

• Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure: stated Final Action Date: October 2023.  See here for more information on this proposal.
• Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies: stated Final Action Date: October 2023.  See here for more information on this proposal.
• Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information: stated Final Action Date: April 2024.  See here for more information on this proposal.
• Cybersecurity Risk Management Rule for Broker-Dealers, Clearing Agencies, Major Security-Based Swap Participants, the Municipal Securities Rulemaking Board, National Securities Associations, National Securities Exchanges, Security-Based Swap Data Repositories, Security-Based Swap Dealers, and Transfer Agent: Stated Final Action Date: April 2024.  See here for more information on this proposal.
• Regulation Systems Compliance and Integrity: stated Final Action Date: April 2024. See here for more information on this proposal.

Sidley represented the Securities Industry and Financial Markets Association (“SIFMA”) and other trade associations in preparing comments submitted to the SEC in response to the proposed [public company], [Regulation S-P] and [Rule 10] rulemakings.

This post is as of the posting date stated above. Sidley Austin LLP assumes no duty to update this post or post about any subsequent developments having a bearing on this post.