Senators Want More out of SEC Plans to Address Cyberattacks

A bipartisan letter from a handful of notable senators to the Securities and Exchange Commission points to a potential disconnect over how to protect companies, and individuals, from cyberattacks.   

The expectant letter came one day before the SEC proposed a rule requiring certain registrants—investment funds and advisors—to write and implement cybersecurity policies to protect their customers from related harm, disclose any recent cybersecurity incidents on their brochures and to report such incidents along with related records to the commission.

“We applaud your efforts to promote transparency and oversight of cybersecurity risks at public companies and at financial sector registrants like investment funds, investment advisers and broker-dealers,” reads the Tuesday letter. “Investors deserve a clear understanding of whether companies and investment managers are prioritizing cybersecurity. They also have a right to prompt notification of serious cybersecurity incidents. More information will enable investors to hold companies and investment managers accountable.”

The senators and the SEC are expressing the same desired ultimate result. But the commission’s approach was not quite what the letter signers—Sens. Angus King, I-Maine, Susan Collins, R-Maine, Ron Wyden, D-Ore., Jack Reed, D-R.I., Mark Warner, D-Va., Susan Cortez Masto, D-Nev., and Kevin Cramer, R-N.D.—and others from the Cyberspace Solarium Commission pushed for.

Mark Montgomery was the executive director of the congressionally created Solarium commission. He now leads an eponymous nonprofit continuing to push the Solarium’s numerous recommendations now that the body’s statutory charter has expired. 

“Very specifically, we pushed for Sarbanes-Oxley to include cybersecurity,” he told Nextgov reacting to the commission’s proposal. “That is not what they did [Wednesday].”

The Sarbanes-Oxley Act is sweeping legislation enacted in 2002 in response to incidents of corporate fraud like the Enron scandal. It looked to institute an auditing culture that would protect investors, and requires the SEC to issue rules for public companies’ compliance. 

The SEC may yet propose cybersecurity rules for public companies, although during recent remarks Chairman Gary Gensler noted the commission is already enforcing its authority on that front.  

“Make no mistake: public companies already have certain obligations when it comes to cybersecurity disclosures,” he said. “If customer data is stolen, if a company paid ransomware, that may be material to investors. As recent cases show, failure to make accurate disclosures of cybersecurity incidents and risks can result in enforcement actions.”

If the SEC were to explicitly invoke Sarbanes-Oxley for cybersecurity, it could have much broader implications. 

Katie Arrington, former Chief Information Security Officer for acquisitions at the Defense Department, often cited the Solarium Commission’s recommendation that the law be tweaked to include cybersecurity in an effort to acclimate vendors to the Pentagon’s Cybersecurity Maturity Model Certification program. The law specifically looks to preserve records in the case of litigation. The government, for example, might then have an easier time suing for something that was not delivered according to specifications outlined in a contract. 

While it’s good that the SEC has started taking some action, Montgomery said, “we still believe in the need for Sarbanes-Oxley reform to clarify cybersecurity oversight and reporting requirements for publicly traded companies. I would expect several of the CSC Commissioners who are legislators to continue to advocate for this change in 2022.”

“Either legislation or rule-making is acceptable, as long as it establishes cybersecurity risk management and accountability as a company leadership responsibility,” he continued.

As the senators wait for an outcome on the SEC’s proposal, which cites anti-fraud authorities specific to the narrower set of investor advisors and funds, a dissenting commissioner’s argument provides insight on the road ahead for Congress.

“Central to my opposition to the Investment Advisor rule proposal is that we have chosen to ground it in section 206, the Investment Advisor Act's anti-fraud provision,” Commissioner Hester Peirce said during Wednesday’s open meeting. “The rules under this section should be designed to prevent advisors from engaging in acts, practices and courses of business that are fraudulent, deceptive or manipulative. Here, however, the fraudulent, deceptive and manipulative acts and practices and courses of business that the Commission seeks to prevent with the proposed rule are not ones in which the advisor is the perpetrator but the victim.” 

Peirce agreed cybersecurity is important to protect users of the system at large. She even offered that it would have been better for the commission to exercise section 211 of the law granting general rulemaking authority, or a specific section on fraud having to do with false claims. But, as is, she said, the proposal incorrectly suggests not having reasonably designed cybersecurity policies in itself is a fraudulent practice.

“While having good cyber policies is important, there's no apparent logical connection between the effectiveness of an advisor's cyber policies and the soundness of its investment advice,” she said. “Deeming illegal all advice provided during a period in which cyber policies were deficient in the estimation of the commission sitting in its Monday morning quarterback chair seems extreme.”