By Katanga Johnson
WASHINGTON (Reuters) – The U.S. securities regulator is considering extending cyber risk management rules to third-party service providers, and beefing up public company disclosures when they experience a breach, the head of the Securities and Exchange Commission (SEC) said on Monday.
Gary Gensler, in an address to securities industry professionals, mapped out a sweeping overhaul of SEC cyber rules, including changes to how stock exchanges and clearinghouses mitigate and report on cyber risk under the Regulation “Systems Compliance and Integrity” (SCI) aimed at reducing systems issues and improving resilience.
Gensler added that new cybersecurity rules could extend to registered firms’ third-party service providers, including fund administrators, index providers, custodians and others not currently registered with SEC.
These new rules could include a variety of measures, such as requiring certain registrants to identify service providers that could pose such risks; holding registrants accountable for service providersâ€™ cybersecurity measures and protecting against inappropriate access and investor information.
Analysts said Gensler’s outline comes at a time of growing concern about how cyber security issues could affect markets and investors. President Joe Biden’s administration has also ratcheted up its focus on the issue after a recent series of high-profile cyber attacks on U.S.-based companies.
(Reporting by Katanga Johnson in Washington)