2022-03145: Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies

Summary

The Securities and Exchange Commission is proposing new rules under the Investment Advisers Act of 1940 ("Advisers Act") and the Investment Company Act of 1940 ("Investment Company Act") to require registered investment advisers ("advisers") and investment companies ("funds") to adopt and implement written cybersecurity policies and procedures reasonably designed to address cybersecurity risks. The Commission also is proposing a new rule and form under the Advisers Act to require advisers to report significant cybersecurity incidents affecting the adviser, or its fund or private fund clients, to the Commission. With respect to disclosure, the Commission is proposing amendments to various forms regarding the disclosure related to significant cybersecurity risks and cybersecurity incidents that affect advisers and funds and their clients and shareholders. Finally, we are proposing new recordkeeping requirements under the Advisers Act and Investment Company Act.

The agency’s own summary, as published.

What this changes

Amends 7 parts of the Code of Federal Regulations — the standing rules this notice rewrites.

• 17 CFR 230 General Rules and Regulations, Securities Act of 1933
• 17 CFR 232 Regulation S-T—General Rules and Regulations for Electronic Filings
• 17 CFR 239 Forms Prescribed Under the Securities Act of 1933
• 17 CFR 270 Rules and Regulations, Investment Company Act of 1940
• 17 CFR 274 Forms Prescribed Under the Investment Company Act of 1940
• 17 CFR 275 Rules and Regulations, Investment Advisers Act of 1940
• 17 CFR 279 Forms Prescribed Under the Investment Advisers Act of 1940