Published on February 9 by the Securities and Exchange Commission (SEC) the Proposed rule will require registered investment companies and funds as well as registered investment advisers to implement written policies and procedures to address their cybersecurity risks.

The policies and procedures should covers areas such as:

• User security and access to prevent unauthorised access to information and systems

• Information protection to prevent unauthorised access and use through periodic assessment

• Threat and vulnerability management to detect, mitigate, and remediate cybersecurity threats and vulnerabilities with respect to adviser or fund information and systems.

• Cybersecurity incident response and recovery to detect, respond to, and recover from a cybersecurity incident

The Proposed rule also includes amendments to the requirements relating to recordkeeping, the reporting of incidents to the SEC as well as to the disclosure of cybersecurity risks and incidents to clients and investors.